Video Screencast Help

Unknown variables in e-mail notifications

Created: 16 Apr 2013 | 2 comments

Was this message blocked?  $Blocked$

Subject $Subject$

Number of Matches $Match Count$

Incident ID $Incident ID$
Endpoint machine $ENDPOINT_MACHINE$

I'm getting "unknown variable" for most things instead of the information.

How is this fixed?


Was this message blocked? [UNKNOWN VARIABLE: Blocked]

Subject [UNKNOWN VARIABLE: Subject]

Number of Matches [UNKNOWN VARIABLE: Match Count]

Incident ID [UNKNOWN VARIABLE: Incident ID]
Endpoint machine N/A

Operating Systems:

Comments 2 CommentsJump to latest comment

Jsneed's picture

Put the variable names in all CAPS. The one that works for you (endpoint_machine) is in all caps.


DLP Solutions2's picture

Net User,

All of the canned response rules that are in the console need to have the variables updated. They are not correct and will give you the Unkown Variable. So edit them and click on the links on the side that will then show you the right names of the variables.

They are usually $POLICY$ or $DATA_OWNER$

So they are ALL CAPS and have an underscore between names.

If this answers your question, please call solved

Here is a list of the right Variables that are available.

Data Owner
Data Owner Email
Device Instance ID
Endpoint Machine
File Full Path
File Name
File Parent Directory Path
Incident ID
Incident Snapshot
Match Count
Policy Name
Policy Rules
Protocol / Device Type / Target Type
Quarantine Parent Directory Path
Scan Date

Please make sure to mark this as a solution

to your problem, when possible.