Fortinet fortigate-200a Betriebsanweisung

Replacement messages can be text or HTML messages. You can add HTML code to 
HTML messages. In addition, replacement messages can include replacement 
message tags. When users receive the replacement message, the replacement 
message tag is replaced with content relevant to the message. 

 lists the 

replacement message tags that you can add.

%%FILE%%

The name of a file that has been removed from a content stream. 

This could be a file that contained a virus or was blocked by 

antivirus file blocking. %%FILE%% can be used in virus and file block 

messages.

%%VIRUS%%

The name of a virus that was found in a file by the antivirus system. 

%%VIRUS%% can be used virus messages

%%QUARFILENAME%%

The name of a file that has been removed from a content stream 

and added to the quarantine. This could be a file that contained a 

virus or was blocked by antivirus file blocking. 

%%QUARFILENAME%% can be used in virus and file block messages. 

Quarantining is only available on FortiGate units with a local disk.

%%URL%%

The URL of a web page. This can be a web page that is blocked by 

web filter content or URL blocking. %%URL%% can also be used in 

http virus and file block messages to be the URL of the web page 

from which a user attempted to download a file that is blocked.

%%CRITICAL_EVENT%% Added to alert email critical event email messages. 

%%CRITICAL_EVENT%% is replaced with the critical event message 

that triggered the alert email.

%%PROTOCOL%%

The protocol (http, ftp, pop3, imap, or smtp) in which a virus was 

detected. %%PROTOCOL%% is added to alert email virus messages.

%%SOURCE_IP%%

The IP address of the request originator who would have received 

the blocked file. For email this is the IP address of the user’s 

computer that attempted to download the message from which the 

file was removed. 

%%DEST_IP%%

The IP address of the request destination from which a virus was 

received. For email this is the IP address of the email server that 

sent the email containing the virus. For HTTP this is the IP address 

of web page that sent the virus.