%NODE_IP%

IP address of the cluster node that processed the message.

%NODE_PORT%

Connection port of the cluster node that processed the message.

%PRODUCT_NAME%

Application name — Kaspersky Secure Mail Gateway.

%SMTP_MESSAGE_ID%

Message-ID message header.

%SENDER%

Mail sender's address.

%SENDER_IP%

IP address of the message sender

%ALL_RECIPIENTS%

Addresses of all recipients of the original message.

%AFFECTED_RECIPIENTS%

List of recipient addresses of the original message that are related to the triggered scanning modules for which notifications were generated.

The addresses are taken from the SMTP session (values of the RCPT TO command).

%AFFECTED_RULES%

List of triggered rule IDs.

%MESSAGE_ID%

ID assigned to the message by KSMG.

%SUBJECT%

Subject of an original message.

If the subject contains a link, KSMG makes the link inactive by adding spaces.

%DATE%

Date when the message was received.

%MESSAGE_ACTION%

Action performed on the message by the application.

Possible values:

• Skipped.
• Disinfected.
• AttachmentDeleted.
• Deleted.
• Rejected.

If the message was placed in Backup, the action is followed by a comma and the words backed up.

%DATA_BEGIN%

Service macro for designating the beginning of the list of attachments.

%DATA_END%

Service macro for designating the end of the list of attachments.

%OBJECT_NAME%

Name of the detected object. If the object name contains a link, KSMG makes the link inactive by adding spaces.

The value of the macro depends on its position in the notification body:

• Between the %DATA_BEGIN% and %DATA_END% macros:
  • If a Content Filtering expression was triggered with a condition for the Attachment type, Attachment name, or MIME part size attribute, the macro is replaced with the Message value and the name of the message attachment on which this condition was triggered.
  • If a Content Filtering module expression triggers and it contains a condition for other attributes, or if the Anti-Phishing, Link scanning, Anti-Spam, Mail Sender Authentication, or KATA Protection modules are triggered, the macro is replaced with the Message value.
  • If the Anti-Virus module is triggered and the application could get a status for the entire message, but could not identify the specific attachment that this status was assigned to, the macro is replaced with the Message value.
  • If the Anti-Virus module is triggered, the macro is replaced with the names of the attachments that the module was triggered by.
• Outside the %DATA_BEGIN% and %DATA_END% macros, the Message value is inserted.

In the notification subject, the macro is always replaced with the Message value.

%OBJECT_SIZE%

Size of the whole message or individual attachments.

The value of the macro depends on its position in the notification body:

• Between the %DATA_BEGIN% and %DATA_END% macros:
  • If a Content Filtering module expression triggers and it contains a condition for the Attachment type, Attachment name, or MIME part size attribute, the macro is replaced with the the size of the entire message and the size of the attachment.
  • If a Content Filtering module expression triggers and it contains a condition for other attributes, or if the Anti-Phishing, Link scanning, Anti-Spam, Mail Sender Authentication, or KATA Protection modules are triggered, the macro is replaced with the size of the whole message.
  • If the Anti-Virus module is triggered and the application could get a status for the entire message, but could not identify the specific attachment that this status was assigned to, the macro is replaced with the size of the entire message.
  • If the Anti-Virus module is triggered, the macro is replaced with the sizes of the attachments that the module was triggered by.
• Outside %DATA_BEGIN% and %DATA_END% macros, the size of the whole message is inserted.

In the notification subject, the macro is always replaced with the size of the whole message.

%STATUS%

Scan result for the message or attachment.

The value of the macro depends on its position in the notification body:

• Between the %DATA_BEGIN% and %DATA_END% macros:
  • If a Content Filtering expression was triggered with a condition for the Attachment type, Attachment name, or MIME part size attribute, the macro is replaced with the status of the message assigned by the Content Filtering module as a result of scanning the entire message and the status of the attachment assigned as a result of scanning the attachment.
  • If a Content Filtering module expression triggers and it contains a condition for other attributes, or if the Anti-Phishing, Link scanning, Anti-Spam, or KATA Protection modules are triggered, the macro is replaced with the statuses assigned as a result of scanning the whole message with these modules.
  • If the Anti-Virus module is triggered and the application could get a status for the entire message, but could not identify the specific attachment that this status was assigned to, the macro is replaced with the status assigned by the scan of the entire message.
  • If the Anti-Virus module is triggered, the macro is replaced with the statuses assigned to the attachments based on scanning by the module.
  • If the Mail Sender Authentication module is triggered and the Consider DMARC authentication result as primary toggle switch is turned off, the macro is replaced with the message authentication statuses from the DKIM, DMARC, SPF, and Sender domain alignment technologies. If the Consider DMARC authentication result as primary toggle switch is enabled, the macro is replaced with the message authentication status from the DMARC technology only. Scan statuses in the list are separated by commas.
• Outside the %DATA_BEGIN% and %DATA_END% macros, statuses assigned by scanning the entire message are inserted.

In the notification subject, the macro is always replaced with statuses based on scanning the entire message.

A status is inserted instead of the macro if notifications are enabled in settings of modules that assigned this status. If there are multiple statuses, they are inserted as a comma-separated list.

%OBJECT_ACTION%

Action performed on the message or attachment by the application.

The value of the macro depends on its position in the notification body:

• Between the %DATA_BEGIN% and %DATA_END% macros:
  • If the application was able to get the status of the Content Filtering module scan for the Attachment type, Attachment name, or MIME part size attribute, the macro is replaced with the actions performed on the entire message and on attachments (Blocked, Not blocked).
  • If the application was able to get the status of the Content Filtering module scan for other attributes or the status of the Anti-Phishing, Link scanning, Anti-Spam, Mail Sender Authentication, or KATA Protection scan, the macro is replaced with the action performed on the entire message.
  • If the application was able to get the status of the Anti-Virus module scan for the entire message, but was unable to identify the specific attachment that this status was assigned to, the macro is replaced with the action performed on the entire message.
  • If the application was able to get the statuses of the Anti-Virus module scan for attachments, the macro is replaced with the actions performed on the attachments (Blocked, Not blocked, Disinfected).
• Outside %DATA_BEGIN% and %DATA_END% macros, the action performed on the whole message is inserted.

In the notification subject, the action performed on the whole message is always inserted.