Cisco Cisco Email Security Appliance C170 用户指南
22-21
User Guide for AsyncOS 9.7 for Cisco Email Security Appliances
Chapter 22 Text Resources
Using Text Resources
$AV_VERDICT
Replaced by the anti-virus verdict.
$AV_DROPPED_TABLE
Replaced by the table of attachments that were dropped. Each
row is composed of a part or filename followed by the list of
viruses associated with that part:
row is composed of a part or filename followed by the list of
viruses associated with that part:
“HELLO.SCR” : “W32/Bagel-f”, “W32/Bagel-d” “Love.SCR” :
“Netsky-c”, “W32/Bagel-d”
“Netsky-c”, “W32/Bagel-d”
$AV_REPAIRED_VIRUSES
Replaced by the list of all the viruses found and repaired.
$AV_REPAIRED_TABLE
Replaced by the table of all parts and viruses found and repaired:
“HELLO.SCR” : “W32/Bagel-F”
“HELLO.SCR” : “W32/Bagel-F”
$AV_DROPPED_PARTS
Replaced by the list of filenames that were dropped:
“HELLO.SCR”, “CheckThisOut.exe”
$AV_REPAIRED_PARTS
Replaced by the list of filenames or parts that were repaired.
$AV_ENCRYPTED_PARTS
Replaced by the list of filenames or parts that were encrypted.
$AV_INFECTED_PARTS
Replaced by a comma-separated list of filenames for the files that
contained a virus.
contained a virus.
$AV_UNSCANNABLE_PARTS
Replaced by the list of filenames or parts that were unscannable.
$Date
Replaced by the current date, using the format MM/DD/YYYY.
$Time
Replaced by the current time, in the local time zone.
$GMTimestamp
Replaced by the current time and date, as would be found in the
Received: line of an email message, using GMT.
Received: line of an email message, using GMT.
$MID
Replaced by the Message ID, or “MID” used internally to
identify the message. Not to be confused with the RFC822
“Message-Id” value (use $Header to retrieve that).
identify the message. Not to be confused with the RFC822
“Message-Id” value (use $Header to retrieve that).
$Group
Replaced by the name of the sender group the sender matched on
when injecting the message. If the sender group had no name, the
string “>Unknown<” is inserted.
when injecting the message. If the sender group had no name, the
string “>Unknown<” is inserted.
$Policy
Replaced by the name of the HAT policy applied to the sender
when injecting the message. If no predefined policy name was
used, the string “>Unknown<” is inserted.
when injecting the message. If no predefined policy name was
used, the string “>Unknown<” is inserted.
$Reputation
Replaced by the SenderBase Reputation score of the sender. If
there is no reputation score, it is replaced with “None”.
there is no reputation score, it is replaced with “None”.
$filenames
Replaced with a comma-separated list of the message’s
attachments’ filenames.
attachments’ filenames.
$filetypes
Replaced with a comma-separated list of the message's
attachments' file types.
attachments' file types.
$filesizes
Replaced with a comma-separated list of the message’s
attachment’s file sizes.
attachment’s file sizes.
$remotehost
Replaced by the hostname of the system that sent the message to
the Email Security appliance.
the Email Security appliance.
$AllHeaders
Replaced by the message headers.
Table 22-4
Anti-Virus Notification Variables (continued)
Variable Substituted
With