Cisco Cisco Email Security Appliance C190 User Guide
14-455
Cisco IronPort AsyncOS 7.1 for Email Configuration Guide
OL-22158-02
Chapter 14 Text Resources
$From
Replaced by the message From: header (not the
Envelope Sender).
Envelope Sender).
$Subject
Replaced by the subject of the original message.
$Date
Replaced by the current date, using the format
MM/DD/YYYY.
MM/DD/YYYY.
$Time
Replaced by the current time, in the local time
zone.
zone.
$GMTimestamp
Replaced by the current time and date, as would be
found in the Received: line of an email message,
using GMT.
found in the Received: line of an email message,
using GMT.
$MID
Replaced by the Message ID, or “MID” used
internally to identify the message. Not to be
confused with the RFC822 “Message-Id” value
(use $Header to retrieve that).
internally to identify the message. Not to be
confused with the RFC822 “Message-Id” value
(use $Header to retrieve that).
$Group
Replaced by the name of the sender group the
sender matched on when injecting the message. If
the sender group had no name, the string
“>Unknown<” is inserted.
sender matched on when injecting the message. If
the sender group had no name, the string
“>Unknown<” is inserted.
$Reputation
Replaced by the SenderBase Reputation score of
the sender. If there is no reputation score, it is
replaced with “None”.
the sender. If there is no reputation score, it is
replaced with “None”.
$filenames
Replaced with a comma-separated list of the
message’s attachments’ filenames.
message’s attachments’ filenames.
$filetypes
Replaced with a comma-separated list of the
message's attachments' file types.
message's attachments' file types.
$filesizes
Replaced with a comma-separated list of the
message’s attachment’s file sizes.
message’s attachment’s file sizes.
$remotehost
Replaced by the hostname of the system that sent
the message to the IronPort appliance.
the message to the IronPort appliance.
$AllHeaders
Replaced by the message headers.
$EnvelopeFrom
Replaced by the Envelope Sender (Envelope From,
<MAIL FROM>) of the message.
<MAIL FROM>) of the message.
Table 14-5
DLP Notification Variables
Variable Substituted
With