Substitution symbols for alerts

To ensure that PureMessage for Microsoft Exchange includes specific details about an event (such as the date or the action that has been carried out) in an alert subject line or message, use the substitution symbols below.

Message body and subject substitution symbols

Description

%MESSAGE_EVENTS%

Events that were encountered; for example, Infected mail processed.

%MESSAGE_ACTION%

Action that has been carried out on the message.

%DATE%

Date when event occurred.

%TIME%

Time when event occurred.

%MESSAGE_ID%

Message identifier.

%SERVER%

Name of the server that encountered the event.

%SUBJECT%

Message subject.

%SENDER%

Sender of the message.

%RECIPIENTS%

Message recipients.

%JOB%

Job name, such as Transport (SMTP) scanning or Exchange store scanning.

Per incident substitution symbol

Description

%EVENT%

Incident event; for example, Infection detected.

%LOCATION%

Location where the event occurred, e.g. Body Text or Subject or Name of the attachment.

%REPLACED%

Specifies whether the location was replaced or not.

%DETAILS_TYPE%

Type of additional information, e.g. Virus name(s).

%DETAILS%

Additional information itself, e.g. "W32/Trojman".

Substitution symbols for replacement text

To ensure that PureMessage for Microsoft Exchange includes specific details of a virus or error event (for example, the date or the action that has been carried out) in the replacement text, use the substitution symbols below.

Symbol

Description

%EVENT%

Infected, encrypted or unscannable.

%LOCATION%

Location where the event occurred, e.g. Body Text or Subject or Name of the attachment.

%MESSAGEID%

Message identifier.

%DATE%

Date when attachment was replaced.

%TIME%

Time when attachment was replaced.

%SERVER%

Name of the server that added the replacement text.

%JOB%

The job name; Transport (SMTP) scanning or Exchange store scanning.

%DETAILS TYPE%

Type of additional information, e.g. Virus name(s).

%DETAILS%

Additional information itself, e.g. "W32/Trojman".