Fortinet 400 manual 167, Alert email message sections

System configuration			Customizing replacement messages
	Table 4: Alert email message sections
		%%EMAIL_FROM%%	The email address of the sender of the message in
			which the virus was found.
		%%EMAIL_TO%%	The email address of the intended receiver of the
			message in which the virus was found.
	Block alert	Used for file block alert email messages
	Section Start	<**BLOCK_ALERT**>
	Allowed Tags	%%FILE%%	The name of the file that was blocked.
		%%PROTOCOL%%	The service for which the file was blocked.
		%%SOURCE_IP%%	The IP address from which the block file was
			received. For email this is the IP address of the
			email server that sent the email containing the
			blocked file. For HTTP this is the IP address of
			web page that sent the blocked file.
		%%DEST_IP%%	The IP address of the computer that would have
			received the blocked file. For email this is the IP
			address of the user’s computer that attempted to
			download the message from which the file ware
			removed.
		%%EMAIL_FROM%%	The email address of the sender of the message
			from which the file was removed.
		%%EMAIL_TO%%	The email address of the intended receiver of the
			message from which the file was removed.
	Critical event	Used for critical firewall event alert emails.
	Section Start	<**CRITICAL_EVENT**>
	Allowed Tags	%%CRITICAL_EVENT	The firewall critical event message
		%%
	Section End	<**/CRITICAL_EVENT**>

FortiGate-400 Installation and Configuration Guide 167