Context Variables

In the table below, you will find context variables that you can use in your rules to trigger particular actions and override global settings.

Variable	Accepted values (case sensitive)	Description
`DynamicScanMode`	`AlwaysInline` `NoDynamicScan` `Inline` `Offline`	Controls when and how to apply a dynamic email analysis. See Dynamic Analysis Configuration
`QuarantineName`	text	Sets the assigned quarantine for a quarantined message
`ReportAcknowledgment.Template`	template name	Sets the template for an acknowledgment email of a reported incident (if applicable). Default: `REPORT_NOTIFICATION_ACKNOWLEDGEMENT`
`ReportFeedback.Template`	template name	Sets the template for a reported email (normally, this is configured with a rule per verdict by the `_template` parameter)
`ReportFeedback.AttachIncidentEml`	`DELIVER\|DROP`	Specifies whether to attach the reported email to the report feedback template that can be set with `ReportFeedback.Template`; by default, the email is attached for the `DELIVER` decision
`EmailScreenshot`	`true` `false`	If set to `true`, the .eml files will be rendered to .png images
`KeepDanaAssets`	`true` `false`	If set to `true`, Sandbox assets will be preserved. See Sandbox assets for benign verdicts
`NotifyUser`	`true` `false`	If set to true, the guarded recipient gets a notification mail about the quarantined message instead of the actual mail (you can set the template with `ReceiverNotification.Template`); the guarded sender gets a notification mail about their message not being delivered (you can set the template with `SenderNotification.Template`). This feature is independent of SSQ notifications, and we recommend using the latter—just make sure you don’t use both as it might result in two notifications for the same quarantined message
`SenderNotification.Template`	template name	When `NotifyUser` is set to `false`, this variable sends a notification email to the sender using the selected template
`SenderNotification.GuardedOnly`	`true` `false`	When `NotifyUser` is set to `false`, and this variable is set to `true` (default), a notification is sent to a guarded email sender only
`ReceiverNotification.Template`	template name	When `NotifyUser` is set to `false`, this variable sends a notification email to the recipient using the selected template
`ReceiverNotification.GuardedOnly`	`true` `false`	When `NotifyUser` is set to `false`, and this variable is set to the default `true`, a notification is sent to a guarded email recipient only
`Delivery.SubjectPrefix`	text	Adds a prefix to the rewritten email subject. Works in inline mode only
`Delivery.Attachment.Remove`	`true` `false`	Completely remove the attachment which contains a specifically marked ScanRequest
`Delivery.Attachment.Replace.Enable`	`true` `false`	If enabled, the attachment which contains a specifically marked ScanRequest will be replaced with a text file (set with the optional `Delivery.Attachment.Replace.Text` and `Delivery.Attachment.Replace.NameFormatString` parameters)
`Delivery.Attachment.Replace.Text`	text	Content of a text file that will be displayed to the reader of the email instead of an attachment (default: `Attachment removed by policy`)
`Delivery.Attachment.Replace.NameFormatString`	text	Filename of a text file that will replace the attachment (default: `replaced-%s.txt`)
`PublishThreatIntel`	`true` `false`	Selectively decide if threat intel should be published for this particular email (default: publish it only for malicious emails)
`KeepRawMail`	`true` `false`	If set to true, the source .eml file will be published to XCC and available for download in the Detail view. The email will be kept until the global time-to-live is reached
`verdict.value`	text	Sets a verdict that will be displayed in the XCC, quarantine notification emails and a report

Rule example

Below is a rule example that sets seven context variables for an incoming email with a spam score equal to or higher than 8. This email will be put in the Spam quarantine with a spam verdict, and the following actions will be performed:

The .eml file will be rendered as a .png image.
All Sandbox assets will be kept.
The subject won’t be changed.
No notification will be sent to the recipient.
Threat intel info will be published.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<rule name="CUSTOM_SPAM_high_score" state="ACTIVE" priority="550" applyTo="INCOMING">
    <pipeline>Emails</pipeline>
    <if>
        <spamScore cmp="GREATER_OR_EQUAL" threshold="8"/>
        <then>
            <decision decision="QUARANTINE">
                <tag>#quarantine</tag>
                <contextSetString contextKey="QuarantineName" value="Spam"/>
                <contextSetString contextKey="verdict.value" value="spam"/>
                <contextSetString contextKey="EmailScreenshot" value="true"/>
                <contextSetString contextKey="KeepDanaAssets" value="true"/>
                <!-- As the email is put into quarantine, leave SubjectPrefix empty. -->
                <contextSetString contextKey="Delivery.SubjectPrefix" value=""/>
                <!-- Do not send a quarantine notification. Normally, notifications are triggered through SSQ which is a completely separate mechanism -->
                <contextSetString contextKey="NotifyUser" value="false"/>
                <contextSetBool contextKey="PublishThreatIntel" value="true"/>
            </decision>
        </then>
    </if>
</rule>

​Rule example

Rule example