Cisco Cisco Email Security Appliance C690 User Guide

Replaced by the SenderBase Reputation score of 
the sender. If there is no reputation score, it is 
replaced with “None”.

Replaced with a comma-separated list of the 
message’s attachments’ filenames.

Replaced with a comma-separated list of the 
message's attachments' file types.

Replaced with a comma-separated list of the 
message’s attachment’s file sizes.

Replaced by the hostname of the system that sent 
the message to the Cisco IronPort appliance.

Replaced by the message headers.

Replaced by the Envelope Sender (Envelope From, 
<MAIL FROM>) of the message.

Replaced by the hostname of the Cisco IronPort 
appliance.

$header[‘string’]

Replaced by the value of the quoted header, if the 
original message contains a matching header. Note 
that double quotes may also be used.

Replaced by all Envelope Recipients (Envelope 
To, <RCPT TO>) of the message.

Replaced by the size, in bytes, of the message.

Returns the name of the filter being processed. 

Returns the content that triggered a scanning filter 
rule (including filter rules such as 

body-contains

 

and content dictionaries).

Replaced by the name of the email DLP policy 
violated.

Replaced by the severity of violation. Can be 
“Low,” “Medium,” “High,” or “Critical.”