Replacement text variables to use in the body of a outbreak, quarantined or deleted email
search cancel

Replacement text variables to use in the body of a outbreak, quarantined or deleted email

book

Article ID: 177111

calendar_today

Updated On:

Products

Mail Security for Microsoft Exchange

Issue/Introduction

A quarantined or deleted email has the body text replaced. Symantec Mail Security products use variables to replace the body text. You need a list of the variables to customize the replacement text.

A version of the following Symantec Mail Security product installed:

--Symantec Mail Security 6.X for Microsoft Exchange
--Symantec Mail Security 5.0 for Microsoft Exchange
--Symantec Mail Security 4.6 for Microsoft Exchange

Resolution

Part of the process of setting up outbreak triggers is inserting text and variables in the Message body box to inform the administrator of the outbreak. The list of variables you can use in the Message body box:
%action% = Autofills with the description of the action taken in response to a rule violation
%attachment% = Autofills with the name of the attachment in which a rule violation has been found
%datetime% = Autofills with the date and time of a violation
%information% = Autofills with any general information available about the violation
%location% = Autofills with the name of the location at which a violation was discovered, for example, inbox, outbox, public folder
%recipient% = Autofills with the name of the intended recipient of a message in which a violation was discovered
%rule% = Autofills with the name of the rule that was violated
%scan% = Autofills with the name of the scan that discovered a violation
%sender% = Autofills with the name of the sender of a message in which a violation was discovered
%subject% = Autofills with the contents of the subject line
%violation% = Autofills with the name of the violation detected
%n% Starts a new line in the notification message
%server% = Autofills with the name of the server on which a violation was discovered




Technical Information
To use variables in the message body, create a virus or heuristic outbreak trigger.


To create a virus outbreak trigger

  1. Do one of the following:
    • Open Symantec Mail Security for the single server.
  2. In the left pane, select Policies > Outbreak.
    • In the right pane, select the outbreak trigger you wish to modify and enable.
  3. In the Status box, change to EnableCheck Enable trigger.
  4. In the Occurrences box, type the number of occurrences of the virus event that are required for an outbreak.
  5. In the Time Period box, type the amount of time that must elapse between each occurrence of the virus event before declaring an outbreak.
  6. In the Units box set the type of measure to use. (Minutes, Hours, Days)
  7. In the Notify Administrator box, place a check mark if you wish a notification to go to the Administrator.
  8. In the Update Match List box, place a check mark if you wish the associated matchlist is to be updated when the violation occurs.
    • As seen there are only 2 match lists. The matchlists that will be updated if checked, and a violation occurs: Outbreak Triggered Attachment Names, and Outbreak Triggered Subject Lines.
  9. Under Initial Notification, do the following:
    • In the Subject line box, type the subject line for the email message that notifies administrators of the outbreak.
    • In the Message body box, type the message body for the email message that notifies administrators of the outbreak. Variables are specified by the percent sign (%), with text following it, and are automatically filled in when the message is sent.
    • Under Subsequent Notifications, in the Subject Line box, type the subject line for the follow-up email message that notifies administrators of the outbreak.
    • In the Message Body box, type the follow-up message.
  10. Repeat above steps for each Outbreak rule you wish to enable.
  11. Click Deploy Changes.


To modify the attachment text for Unscannable or Encrypted files.

  1. Do the following:
    • Open Symantec Mail Security.
  2. In the left pane, expand Policies > Exceptions.
  3. Select the Name of the rule you wish to modify:
    • In the lower right section, change the Action to Take to your requested action..
    • If using Log Only or Delete Entire Message, a notification will not be sent to the end-user.
  4. In the Replacement Text area: Type the message body for the attachment text the End-user will receive. Variables are specified by the percent sign (%), with text following it, and are automatically filled in when the message is sent
  5. In the Notify Administrator area
    • Place a check mark to Notify the Administrator
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the Administrator will receive.
  6. In the Notify Internal Sender area
    • Place a check mark to send a notification to an internal sender (If the message was sent from an Internal Sender)
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the Internal Sender will receive.
  7. In the Notify External Sender area
    • Place a check mark to send a notification to an external sender. (If the message was received from an external email address)
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the External Sender will receive.
  8. Repeat above steps for each Exception Rule you wish to change.
  9. Click Deploy Changes



To modify the attachment text for Anti Virus Rules.

  1. Do the following:
    • Open Symantec Mail Security.
  2. In the left pane, expand Policies > Antivirus Settings.
  3. Select the Name of the rule you wish to modify:
    • In the lower right section, change the Action to Take to your requested action..
    • If using Log Only or Delete Entire Message, a notification will not be sent to the end-user.
  4. In the Replacement Text area: Type the message body for the attachment text the End-user will receive. Variables are specified by the percent sign (%), with text following it, and are automatically filled in when the message is sent
  5. In the Notify Administrator area
    • Place a check mark to Notify the Administrator
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the Administrator will receive.
  6. In the Notify Internal Sender area
    • Place a check mark to send a notification to an internal sender (If the message was sent from an Internal Sender)
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the Internal Sender will receive.
  7. In the Notify External Sender area
    • Place a check mark to send a notification to an external sender. (If the message was received from an external email address)
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the External Sender will receive.
  8. Repeat above steps for each Antivirus Rule you wish to change.
  9. Click Deploy Changes



To modify the attachment text for Content Filtering Rules.

  1. Do the following:
    • Open Symantec Mail Security.
  2. In the left pane, expand Policies > Content Filtering Rules..
  3. Double Click the Name of the rule you wish to modify:
    • In the Actions Tab change the When a violation occurs to your requested action..
    • If using Log Only, Delete Entire Message, or Add tag to beginning of subject line, a notification will not be sent to the end-user.
  4. In the Replacement Text area: Type the message body for the attachment text the End-user will receive. Variables are specified by the percent sign (%), with text following it, and are automatically filled in when the message is sent
  5. In the Notification tab
    • Place a check mark to Notify the Administrator
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the Administrator will receive.
  6. In the Notify Internal Sender area
    • Place a check mark to send a notification to an internal sender (If the message was sent from an Internal Sender)
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the Internal Sender will receive.
  7. In the Notify External Sender area
    • Place a check mark to send a notification to an external sender. (If the message was received from an external email address)
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the External Sender will receive.
  8. Click OK
  9. Click Deploy Changes
  10. Repeat above steps for each Content filtering Rule you wish to change.



To modify the attachment text for File Filtering Rules.

  1. Do the following:
    • Open Symantec Mail Security.
  2. In the left pane, expand Policies > File Filtering Rules.
  3. Select the Name of the rule you wish to modify:
    • In the lower right section, change the Action to Take to your requested action..
    • If using Log Only or Delete Entire Message, a notification will not be sent to the end-user.
  4. In the Replacement Text area: Type the message body for the attachment text the End-user will receive. Variables are specified by the percent sign (%), with text following it, and are automatically filled in when the message is sent
  5. In the Notify Administrator area
    • Place a check mark to Notify the Administrator
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the Administrator will receive.
  6. In the Notify Internal Sender area
    • Place a check mark to send a notification to an internal sender (If the message was sent from an Internal Sender)
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the Internal Sender will receive.
  7. In the Notify External Sender area
    • Place a check mark to send a notification to an external sender. (If the message was received from an external email address)
    • Select the down Arrow, to modify the Subject line, and message body of the notification that the External Sender will receive.
  8. Repeat above steps for each Antivirus Rule you wish to change.
  9. Click Deploy Changes

 


Powered by Wolken Software