Using Tokens in Content Rules and Policy References
The following tables provide a full list of tokens that can be used in certain What To Do? actions and Policy References.
References to Web policy content are only available when a Web |
Token | Description/Value | Where it can be used... |
---|---|---|
%ADMIN% |
The administrator account email address used by the Policy Engine. |
Alerts, Annotations, Informs, Logs, Tag Subject, Add Header |
%ALARM_DESCRIPTION% |
A description of the raised alarm. |
Email Alarm Messages |
%ALARM_TEXT% |
The text of the raised alarm. |
Email Alarm Messages |
%ALARM_TYPE% |
The type of the raised alarm. |
Email Alarm Messages |
%AREANAME% |
The name of the message area containing the message. |
Alerts, Informs. Logs |
%CONTENTDETECTED% |
The names of the triggered content rules. |
Informs |
%DATE% |
The date the original message was sent. |
Alerts, Annotations, Informs, Log Message, Tag Subject, Add Header, Notify Sender, Notify Auditor |
%DETECTED% |
Items detected by the What To Look For? clauses in invoked content rules. |
Alerts, Annotations, Informs |
%HOSTNAME% |
The hostname of the machine on which an alarm has been raised. |
Email Alarm Message |
%IPADDRESS% |
The IP address of the machine on which an alarm has been raised. |
Email Alarm Message |
%LOCALDATE% |
The date the original message was sent, shown in the |
Alerts, Informs |
%MANAGE_MESSAGE% |
A manage message link that can be added to a Plain Format inform message. |
Informs |
%MODIFIED% |
Content rules that triggered, and hence modified the message. |
Annotations, Informs |
%POLICY% |
A list of the content rules invoked on the message. |
Alerts, Annotations, Informs, Logs, Tag Subject, Add Header, Notify Sender |
%POLICYVIOLATED% |
The policy that was violated. |
Notify Auditor |
%PRIMARYTHREATS% |
The threat type and name detected in a message. The values are separated by a colon, for example, VIRUS:EICAR. |
Alerts, Informs |
%RCPTS% |
A list of the recipients. (This is a concatenated list of all the "Recipient" responses.) |
Alerts, Annotations, Informs, Logs, Notify Sender, Notify Auditor |
%RECOGNISED% |
A list of the Clearswift Gateway format managers that recognized formats in the message (such as SMTP, text, HTML). |
Annotations, Informs |
%RELEASEDBY% | The name of the person who released the message. | Notify Auditor |
%REMOVEDNAMES% |
A list of the names of any removed attachments. |
Annotations, Informs, Tag Subject, Add Header |
%RESPONSES% |
The values of all the response tokens. |
Annotations, Informs |
%SENDER% |
The email address of the sender of the original message. |
Alerts, Annotations, Informs, Logs, Tag Subject, Add Header |
%SERVER% |
The Clearswift Gatewayserver email address. |
Alerts, Annotations, Informs, Logs, Tag Subject, Add Header |
%SUBJECT% |
The subject of the original message. |
Alerts, Annotations, Informs, Logs, Tag Subject, Add Header, Notify Sender, Notify Auditor |
%UNIQUEID% |
The Mail ID: the unique ID Clearswift Gateway assigns to a message. |
Alerts, Annotations, Informs, Logs, Tag Subject, Add Header |