IronPort - Configuration Guide - AsyncOS 7.6.1

Chapter 14 Text Resources
DLP Notification Variables
OL-25136-01
Figure 14-18 DLP Notification Templates Enabled in a DLP Policy
DLP notification templates can use the following variables.
Table 14-6 DLP Notification Variables
Variable Substituted With
$DLPPolicy Replaced by the name of the email DLP policy violated.
$DLPSeverity Replaced by the severity of violation. Can be “Low,” “Medium,”
“High,” or “Critical.”
$DLPRiskFactor Replaced by the risk factor of the message’s sensitive material
(score 0 - 100).
$To Replaced by the message To: header (not the Envelope
Recipient).
$From Replaced by the message From: header (not the Envelope
Sender).
$Subject Replaced by the subject of the original message.
$Date Replaced by the current date, using the format MM/DD/YYYY.
$Time Replaced by the current time, in the local time zone.
$GMTimestamp Replaced by the current time and date, as would be found in the
Received: line of an email message, using GMT.
$MID Replaced by the Message ID, or “MID” used internally to
identify the message. Not to be confused with the RFC822
“Message-Id” value (use $Header to retrieve that).
$Group Replaced by the name of the sender group the sender matched on
when injecting the message. If the sender group had no name, the
string “>Unknown