Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More

Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More

Services
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Security
Unlock the full power of Microsoft Security
Offensive Security
Solutions to maximize your security ROI
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
Loading...
Loading...

INFO: What variables can I use in Trustwave MailMarshal (SEG) current versions?

Expand / Collapse


This article applies to:

  • Trustwave MailMarshal (SEG)

Question:

  • What variables can I use in MailMarshal SMTP?

Information:

The following is a list of variables that can be used in the email templates, message stamps, and logging classifications in MailMarshal SMTP 6.X and above.

Not all variables are available in all contexts. You should test any usage carefully.

  • In particular, when sending a notification for deadlettered messages (SEG 7.X and above), any variables that depend on unpacking of the message will not be available.

Note: Variables are marked with curly braces { }.  This is a change from some much older versions of MailMarshal (below 6.0).

  • Date formatting sub-variables continue to use %%var syntax.
  • Additional date formatting sub-variables are listed in the User Guide or Help.
  • Sender ID and SPF variables are available from version 6.2. Other variables are available from versions as noted. Also see the User Guide for specific product versions.

Variable Data inserted
{$MessageDigestTableHTML} The HTML version of a message digest detail listing. See also {MessageDigestTableText}. See the User Guide or Help for options.
{Administrator} Email address of the administrator as set on the General tab of Server Properties.
{ArrivalTime} The time when MailMarshal received a message.
{AttachmentName} File name of the attached file that triggered a rule condition.
{Date} The current date. See also "Date Formatting" in the User Guide or Help.
{DateLastRun} The date of the previous MailMarshal message digest for a folder.
{Errorlevel} The last error returned by a virus scanner or an external command.
{ExternalCommand} The name of the last External Command used.
{Env=varname} Inserts the value of a Windows environment variable.
{ExternalSender} Returns 'y' or 'n' depending on whether the sender was outside or inside the "allowed to relay" space.
{File=fullpath} Inserts a text file within the body of a message (for instance, can be used to insert the MailMarshal log for a message in a notification email body).
{Folder} The name of the folder that is the subject of a MailMarshal message digest email.
{FolderRetention} The retention period for a folder that is the subject of a MailMarshal message digest email.
{FormattedRecipients} Available in Engine default (dead letter) templates only. The recipients of the message, listed in the To: or CC: fields. Formatted for use in the message body.
{FormattedRecipientsAffected} Available in Sender templates only (versions 6.4 and above). Where a message could not be send to some recipients (in the To: or CC: fields), shows the affected recipients of the message. Formatted for use in the message body.
{From} Email address in the 'From' field of the message.
{HasAttachments} Returns '1' if the message has attachments.
{Header-Reply-To} Email address in the 'Reply-To' header of the email message. If the 'Reply-To' header is not present, the return-path email address is used. Available in SEG 7.5.5 and above.
{HelloName} Name given by the remote email server when MailMarshal received this message.
{Hostname} The host name of the server.
{If variable}...[{else}...]{endif} Allows conditional substitution of text. The condition is true if the variable is not empty. For example: {If VirusName} This message contained the virus {VirusName}.{endif} The Else clause is optional.
{InitialMessageBody} The first 200 characters of the body of the message.
{Install} The install location of MailMarshal.
{LastAttemptDate} The datea and time of the last attempt to deliver the message.
{LastTextCensorRuleTriggered} The name of the TextCensor Script that was run and the phrase that triggered.
{LocalRecipient} The message recipient, if any, within the local domains. Includes multiple recipients, CC and BCC recipients.
  • To preserve the privacy of BCC recipients when sending notifications, do not use this variable in the template TO: field or in the body of the template. Place this variable in the BCC: field. 
{LocalSender} The message sender, if any, within the local domains.
{LogName} The name of the Logging Classification used.
{Message-ID} Original SMTP Message ID of the message.
{MessageFullName} Full path to the message file.
{MessageCount} The number of messages quarantined for a user in a specific folder and listed in a message digest email.
{MessageDigestTableText} The plain text version of a message digest detail listing. See also{$MessageDigestTableHTML}.
{MessageName} Filename only of the message.
{MessageSize} The size of the message as originally received.
{MMSmtpMapsRBL} A list of DNS blocklists that triggered on the message within a Receiver rule. Does not include information generated by the Category Script (SpamCensor) process. (In 6.4.5 and above, use {ReputationServices}.)
{PolicyGroupTitle} The title of the policy group containing the rule triggered by the message. Replaces {RulesetTitle}.
{RawSubject} Message subject with any encoding included, as originally received. Use this variable to include the subject in the Subject field of notification templates. See also {Subject}.
{Reason} Detailed information about a delivery or processing problem. Used in administrative notification templates such as dead letter and delivery failure notifications.
{Recipient} Message recipient. Includes multiple recipients and CC recipients.
{ReleasePassThrough} Inserts a code recognized by the gateway to release the message applying no further rules. See "Using the Message Release External Command" in the User Guide.
{ReleaseProcessRemaining} Inserts a code recognized by the gateway to release the message applying any additional applicable rules. See "Using the Message Release External Command" in the User Guide.
{RemoteDomainName} The name of the domain on the remote machine.
{RemoteIP} The IP of the remote machine.
{ReplyTo} SMTP "Mail From" email address.
{ReputationServices} A list of Reputation Services (DNS blocklists) that triggered on the message within a Receiver rule. Does not include information generated by the Category Script (SpamCensor) process. (Available in 6.4.5 and above.)
{ReturnPath} SMTP "Mail From" email address.
{RuleTitle} The title of the rule triggered by the message.
{Sender} Email address of the sender. Uses the address in the "From" field unless it is empty, in which case the "Reply to" address is used.
{SenderIDFrom} The address used for the Sender ID check.
{SenderIDIPAddress} The IP address used for the Sender ID check.
{SenderIDResult} The result of the Sender ID check (Pass, Fail, None, SoftFail, Neutral, TempError, or PermError).
{SenderIDReturnedExplanation} The text explanation returned from the Sender ID query (if any).
{SenderIDScope} The scope of the Sender ID check (pra or mfrom).
{SenderIP} IP address of the sender.
{ServerAddress} Email address used as the 'From' address for notifications as set on the General tab of Server Properties.
{SpamBotCensorResult} The result string as returned by the SpamBotCensor facility. (Available in 7.2 and above.)
{SpamBotCensorScore}
The numeric score as returned by the SpamBotCensor facility. (Available in 7.2 and above.)
{SpamCategoryResult}
The result string as returned by a Category script rule condition (other
than SpamCensor or SpamBotCensor). If you run more than one
Category condition on a message, this variable returns only the result
of the latest condition (at the time the variable is used).
(Available in 7.2 and above.)
{SpamCategoryScore}
The numeric score as returned by the latest Category script rule
condition (other than SpamCensor or SpamBotCensor). If you run
more than one Category condition on a message, this variable returns
only the score of the latest condition (at the time the variable is used).
(Available in 7.2 and above.)
{SpamCensorResult}
The result string as returned by the SpamCensor facility.
{SpamCensorScore}
The numeric score as returned by the SpamCensor facility. (Available in 7.2 and above.)
{SPFExplanation} The default explanation configured in the SPF Settings window, or the text explanation returned from the SPF query (if any).
{SsmUrl} The URL of the MailMarshal Spam Quarantine Management Web site.
{StrippedFiles} The names of any attachment files stripped from the message by rule action.
{Subject} Message subject, decoded if applicable. Use this variable in most cases. See also {RawSubject}.
{ThreadWorking} The MailMarshal working folder name.
{Time} The current time. See also "Date Formatting" in the User Guide.
{TimeEnteredQueue} The time that the message entered the MailMarshal Queue.
{TimeLeft} The time left to attempt delivering the message in question.
{UnsubscribeUrl} (Versions 6.8 and above) The URL used to unsubscribe from digests. This variable can be used in digest templates. The variable evaluates blank if a user cannot unsubscribe. Suggested usage:
{if UnsubscribeUrl}To unsubscribe from this digest, use the following link: {UnsubscribeUrl} {endif}
{VirusName} Name of the virus detected. This information is only available if the virus scanner being used is a DLL based scanner. If a command line scanner reports a virus this variable is set to "Unknown."
{VirusScanner}

Name of the virus scanner used.

Notes:

This article was previously published as:
NETIQKB40860

To contact Trustwave about this article or to request support:


Rate this Article:
     
Tags:

Related Articles



Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.