Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More

Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More

Services
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Security
Unlock the full power of Microsoft Security
Offensive Security
Solutions to maximize your security ROI
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
Loading...
Loading...

HOWTO: How do I attach the message header to my email notification?

Expand / Collapse


This article applies to:

  • Trustwave MailMarshal (SEG)
  • Trustwave ECM/MailMarshal Exchange 7.X

Question:

  • How do I attach the message header to my email notification?
  • How do I insert the message header as text into my notification?
  • How do I attach the original MML message file to my notification?
  • Why is the header information lost when message notifications are sent to Exchange?

Causes:

Normally, if you wish to attach the original message in an email notification, then all you need to do is to check the "Message" box in the Edit Message Template window. However, this attaches the original message as a file with a .mml extension. Internal servers like Exchange may convert such attachments to MSG format, in the process removing the header information. If you have encountered this problem, and you need to retain this header information, there are several MailMarshal based workarounds you can use.

To attach the message or header, you can get the files from the location where they are unpacked in MailMarshal processing. Typically messages will be unpacked to:

 

{Install}\Unpacking\Tx\Ux

...where Tx is the Engine thread number
...where Ux is the unpacking depth.

Note the following points also:

  • The variable {Install} covers the install path. As the path may vary, always use this variable.
  • The "Unpacking" folder name is fixed and is explicitly written, as in the examples below.
  • The thread number is provided by the variable {ThreadNo}.
  • The header is always located in the second unpacking depth, therefore U2 is fixed.
  • The header is unpacked as filename MsgHeader.txt

 

Procedure:

Option 1 – Insert Header as text in body

If we wish to insert the text of the header into the body of the notification, use the {file=} construct and point this variable to where the message header is unpacked. It should look like the below example. All you need to do is to copy this variable string directly into the body of the notification.  

{file={Install}\unpacking\t{threadno}\u2\MsgHeader.txt}

Option 2 – Attach message file with envelope

In order to send the message file itself as an attachment in a notification, enable the checkbox under Attachments: | Other. The attached file will have a .mml extension.

The variable {MessageFullName} equates to the actual full file location of the message being worked on by the thread in question. Therefore, to attach the message file we simply enter {MessageFullName} in the "Other" field. However, this method includes the message envelope (server and SMTP handshaking information), which may be confusing to your end users.

Option 3 – Attach message file without envelope

If you wish to attach the message file without the envelope, follow the same logic as for attaching the header above. Here's what you need to consider to make this work:

  • The message file is always unpacked into U1
  • The variable for the message filename is {MessageName}

Thus construct the path of the filename for use in the "Other" field:

{Install}\unpacking\t{threadno}\u1\{MessageName}

Option 4 – Attach Header as text file

Likewise, if you want to attach the header as a text file, provide the path for the file using the string below:

{Install}\unpacking\t{threadno}\u2\MsgHeader.txt

This article was previously published as:
NETIQKB50364

To contact Trustwave about this article or to request support:


Rate this Article:
     
Tags:

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.