Using Tokens in Content Rules and Policy References

The following tables provide a full list of tokens that can be used in certain What To Do? actions and Policy References.

References to Web policy content are only available when a Web Gateway is included in the peer group.

Token	Description/Value	Where it can be used...
%ADMIN%	The administrator account email address used by the Policy Engine.	Alerts, Annotations, Informs, Logs, Tag Subject, Add Header
%ALARM_DESCRIPTION%	A description of the raised alarm.	Email Alarm Messages
%ALARM_TEXT%	The text of the raised alarm.	Email Alarm Messages
%ALARM_TYPE%	The type of the raised alarm.	Email Alarm Messages
%AREANAME%	The name of the message area containing the message.	Alerts, Informs. Logs
%CONTENTDETECTED%	The names of the triggered content rules.	Informs
%DATE%	The date the original message was sent.	Alerts, Annotations, Informs, Log Message, Tag Subject, Add Header, Notify Sender, Notify Auditor
%DETECTED%	Items detected by the What To Look For? clauses in invoked content rules.	Alerts, Annotations, Informs
%HOSTNAME%	The hostname of the machine on which an alarm has been raised.	Email Alarm Message
%IPADDRESS%	The IP address of the machine on which an alarm has been raised.	Email Alarm Message
%LOCALDATE%	The date the original message was sent, shown in the Gateway's local timezone.	Alerts, Informs
%MANAGE_MESSAGE%	A manage message link that can be added to a Plain Format inform message. This token is only applicable to the Email Gateway and should not be used in informs that are shared between the Email Gateway and Web Gateway in a conjoined environment.	Informs
%MODIFIED%	Content rules that triggered, and hence modified the message.	Annotations, Informs
%POLICY%	A list of the content rules invoked on the message.	Alerts, Annotations, Informs, Logs, Tag Subject, Add Header, Notify Sender
%POLICYVIOLATED%	The policy that was violated.	Notify Auditor
%PRIMARYTHREATS%	The threat type and name detected in a message. The values are separated by a colon, for example, VIRUS:EICAR.	Alerts, Informs
%RCPTS%	A list of the recipients. (This is a concatenated list of all the "Recipient" responses.)	Alerts, Annotations, Informs, Logs, Notify Sender, Notify Auditor
%RECOGNISED%	A list of the Clearswift Gateway format managers that recognized formats in the message (such as SMTP, text, HTML).	Annotations, Informs
%RELEASEDBY%	The name of the person who released the message.	Notify Auditor
%REMOVEDNAMES%	A list of the names of any removed attachments.	Annotations, Informs, Tag Subject, Add Header
%RESPONSES%	The values of all the response tokens.	Annotations, Informs
%SENDER%	The email address of the sender of the original message.	Alerts, Annotations, Informs, Logs, Tag Subject, Add Header
%SERVER%	The Clearswift Gatewayserver email address.	Alerts, Annotations, Informs, Logs, Tag Subject, Add Header
%SUBJECT%	The subject of the original message.	Alerts, Annotations, Informs, Logs, Tag Subject, Add Header, Notify Sender, Notify Auditor
%UNIQUEID%	The Mail ID: the unique ID Clearswift Gateway assigns to a message.	Alerts, Annotations, Informs, Logs, Tag Subject, Add Header

Tell me about...

• Tokens for use in Information Governance informs

  Token	Description
  %DOC_LIST_MATCHES%	The file name and file location if available, and a list of matches for each registered document where a match was found.
  %DOC_NAMES%	The file name and file location if available of registered documents where a match was found.
  %DOC_NAMES_CLASSIFICATION%	The file name and file location if available, and the classification of registered documents where a match was found.
  %DOC_NAMES_MATCH%	The file name and file location if available, and the percentage match of registered documents where a match was found.
  %DOC_OWNERS_COUNT%	The number of document owners where a match has been found. This token is available in both the subject and the body of a message.
  %DOC_NAMES_PROPERTIES%	The file name and file location if available, and any custom properties for each registered document where a match was found.
  %DOC_SETS%	The collection name where matched registered documents were detected.
  %DOC_SET_OWNERS%	The details of document owners of matched documents.

  When informs are copied to the document owners, tokens will only show information relevant to documents registered for that particular document owner.

• Where tokens are supported

  Where supported	Meaning
  Alert	A Generate an Alert action in a Content Rule.
  Annotation	A Message Annotation Policy Reference.
  Block Page	A Block Page Policy Reference.
  Email Alarm Message	An email message that is sent to a specified address when an alarm is raised, if the Gateway is configured to do so.
  Inform	An Inform Policy Reference.
  Log entry	A Log a Message action in a Content Rule.
  Tag subject	A Tag the Message Subject action in a Content Rule.
  Add header	An Add a Message Header action in a Content Rule.
  Notify Sender	An email message that is sent to a sender when a message is released, if the Gateway is configured to do so.
  Notify Auditor	An email message that is sent to an auditor when a message is released, if the Gateway is configured to do so.