Macros

In many fields macros can be used that will be expanded prior to the filter using the data in the field. Macro names are case sensitive.

 

These macros are always available
     
{yyyy}   4-digit year (0000-9999), System Time
{yy}   2-digit year (00-99), System Time
{mm}   2-digit month (01-12), System Time
{dd}   2-digit day of month (01-31), System Time
{HH}   2-digit hour (00-23), System Time
{MM}   2-digit minute (00-59), System Time
{SS}   2-digit second (00-59), System Time
{utcyyyy}   4-digit year (0000-9999), Universal Coordinated Time
{utcyy}   2-digit year (00-99), Universal Coordinated Time
{utcmm}   2-digit month (01-12), Universal Coordinated Time
{utcdd}   2-digit day of month (01-31), Universal Coordinated Time
{utcHH}   2-digit hour (00-23), Universal Coordinated Time
{utcMM}   2-digit minute (00-59), Universal Coordinated Time
{utcSS}   2-digit second (00-59), Universal Coordinated Time
     
These macros are available during email processing
     
{source:drive}   Drive letter of source email file
{source:directory}   Path of source email file
{source:filename}   File name (without extension) of source email file
{source:extension}   File extension of source email file (including the beginning period), if any
{source:bytecount}   Size in bytes of the source email file
{mailfile}   Full path and filename of the source email
{mailfile.short}   Full path and filename of the source email converted to DOS 8.3 short names
{smtp:client_ip}   The IP address of the SMTP client sending the email, if available
{smtp:mail_from}   The contents of the SMTP "MAIL FROM" data sent by the SMTP client
{smtp:mail_from_domain}   The information to the right of the "@" of the SMTP "MAIL FROM" data
{smtp:mail_from_mailbox}   The information to the left of the "@" of the SMTP "MAIL FROM" data
{smtp:rcpt_to}   The contents of the SMTP "RCPT TO" data sent by the SMTP client
{smtp:this_recipient}   The full email address of the single recipient being processed
{smtp:rcpt_to_domain}   The information to the right of the "@" of the current recipients email address
{smtp:rcpt_to_mailbox}   The information to the left of the "@" of the current recipients email address
{smtp:helo}   The contents of the SMTP "HELO" or "EHLO" data sent by the SMTP client, if available
{smtp:recipient_id}   2-digit (or more when 100th or higher) index of the individual recipient being processed within the RCPT TO data
     
These macros are available during result processing
     
{virus:scanner}   Name of virus scanner that found the virus
{virus:name}   Name of virus found
{virus:location}   Location of virus
{virus:nameandlocation}   Name and (if available) location of virus found
{header:x-apparently-from}   The contents of the header line x-apparently-from, if present
{likely-sender}   The email address of the likely sender of the email
{likely-sender_domain}   The information to the right of the "@" of the likely sender of the email
{likely-sender_mailbox}   The information to the left of the "@" of the likely sender of the email
{smtp:header}   The complete initial header of the email
{header:from}   The contents of the header line from, if present
{header:to}   The contents of the header line to, if present

 

In certain contexts it is necessary to use a variant of the macro, such as when the text from the macro must be HTML-safe, URL-safe, or FILENAME-safe. Some macros might never contain unsafe content for a particular purpose, such as those representing time and date, but others can often have characters that would be invalid or have special meaning in certain contexts. You should use the appropriate variant of such macros whenever the macro could contain content that would be misinterpreted in that context.

You can use a variant of any macro by placing a period followed by the variant type at the end of the macro name (the name inside the braces). Valid variants are:

html   Converts certain characters to escaped codes such as "&lt;" for a less-than symbol ("<") such that the macro can be used within HTML content safely.
url   Converts certain characters to escaped codes such as "%20" for a space such that the macro can safely be used for a URL.
file   Converts certain characters to escaped codes such as "%XX" for a colon (":") such that the macro can safely be used to represent a valid filename.