FSOCS keyword substitution macros

 

Applies to: Forefront Security for Office Communications Server

Microsoft Forefront Security for Office Communications Server (FSOCS) provides keyword macros that can be used in the deletion text (for more information, see IM Scan Job and FSOCS file filtering) and in the various fields of a notification (To, Cc, Bcc, Subject, and body; for more information, see FSOCS event notifications). These keyword-substitution macros are used in notification fields and deletion text in order to display information obtained from an item in which an infection was found or that matched a filter. Enter keywords into those fields, surrounded by leading and trailing percent symbols (%), as shown in the list below.

For example, to include the name of the virus in the subject line, you could use the %Virus% macro, in the Subject field, as follows:

The %Virus% virus was found by FSOCS.

Instead of typing the keyword, you can select it from a shortcut menu.

To select a keyword from the shortcut menu

  1. Position the cursor in any notification field, at the point where you want the keyword to appear, and then right-click to display a shortcut menu.

  2. Click Paste Keyword.

  3. In the list of available keywords, select the keyword macro, and then click Save.

The macros

These are the possible keyword substitution macros. Use consecutive percent signs (%%) in order to display the percent sign itself in the notification field.

Macro Description

%Company%

The name of your organization, as found in the registry.

%ERAddresses%

External recipient addresses. A list of the addresses of all the external To recipients.

%ERNames%

External recipient names. A list of the names of all the external To recipients.

%ESAddress%

External sender address. The address of the message sender, if external to the company.

%ESName%

External sender name. The name of the message sender, if external to the company.

%File%

The name of the detected file.

%Filter%

The name of the filter that detected the item.

%IRAddresses%

Internal recipient addresses. A list of the addresses of all the internal To recipients.

%IRNames%

Internal recipient names. A list of the names of all the internal To recipients.

%ISAddress%

Internal sender address. The address of the message sender, if internal to the company.

%ISName%

Internal sender name. The name of the message sender, if internal to the company.

%ScanJob%

The name of the scan job that scanned the attachment or performed the filtering operation.

%Server%

The name of the server that found the infection or performed the filtering operation.

%State%

The disposition of the detected item (Deleted, Cleaned, or Skipped).

%Virus%

The name of the virus, as reported by the file scanner.

%VirusEngines%

A list of all the scan engines that found the virus.