Cisco Cisco Email Security Appliance C170 Mode D'Emploi
18-26
User Guide for AsyncOS 9.8 for Cisco Email Security Appliances
Chapter 18 Data Loss Prevention
Message Actions
$From
Replaced by the message From: header (not the Envelope
Sender).
Sender).
$Subject
Replaced by the subject of the original message.
$Date
Replaced by the current date, using the format MM/DD/YYYY.
$Time
Replaced by the current time, in the local time zone.
$GMTimestamp
Replaced by the current time and date, as would be found in the
Received: line of an email message, using GMT.
Received: line of an email message, using GMT.
$MID
Replaced by the Message ID, or “MID” used internally to
identify the message. Not to be confused with the RFC822
“Message-Id” value (use $Header to retrieve that).
identify the message. Not to be confused with the RFC822
“Message-Id” value (use $Header to retrieve that).
$Group
Replaced by the name of the sender group the sender matched on
when injecting the message. If the sender group had no name, the
string “>Unknown<” is inserted.
when injecting the message. If the sender group had no name, the
string “>Unknown<” is inserted.
$Reputation
Replaced by the SenderBase Reputation score of the sender. If
there is no reputation score, it is replaced with “None”.
there is no reputation score, it is replaced with “None”.
$filenames
Replaced with a comma-separated list of the message’s
attachments’ filenames.
attachments’ filenames.
$filetypes
Replaced with a comma-separated list of the message's
attachments' file types.
attachments' file types.
$filesizes
Replaced with a comma-separated list of the message’s
attachment’s file sizes.
attachment’s file sizes.
$remotehost
Replaced by the hostname of the system that sent the message to
the Cisco appliance.
the Cisco appliance.
$AllHeaders
Replaced by the message headers.
$EnvelopeFrom
Replaced by the Envelope Sender (Envelope From, <MAIL
FROM>) of the message.
FROM>) of the message.
$Hostname
Replaced by the hostname of the Cisco appliance.
$bodysize
Replaced by the size, in bytes, of the message.
$header[‘string’]
Replaced by the value of the quoted header, if the original
message contains a matching header. Note that double quotes
may also be used.
message contains a matching header. Note that double quotes
may also be used.
$remoteip
Replaced by the IP address of the system that sent the message to
the Cisco appliance.
the Cisco appliance.
$recvlistener
Replaced by the nickname of the listener that received the
message.
message.
$dropped_filenames
Same as
$filenames
, but displays list of dropped files.
$dropped_filename
Returns only the most recently dropped filename.
$recvint
Replaced by the nickname of the interface that received the
message.
message.
$timestamp
Replaced by the current time and date, as would be found in the
Received: line of an email message, in the local time zone.
Received: line of an email message, in the local time zone.
$Time
Replaced by the current time, in the local time zone.
Variable Substituted
With