Email Notifications

The Email Notification Templates feature allows administrators to create, customize, and manage email notifications sent to users when actions are taken on their content.

Template list

  • Search Bar: Allows users to find specific templates by name or subject.

  • Template Columns:

    • Template Name: The name assigned to the notification template.

    • Subject: The notification email subject.

  • Template Buttons:

    • Clone: Clone the selected template.

    • Delete: Delete the selected template.

  • Pagination Controls: Users can navigate through multiple pages of templates.

Editing an Email Notification Template

Clicking on a template from the list opens the Template Details page, where users can configure email notification content.

Template Settings

  • Email Template Name: The display name of the template.

  • Email Subject: The notification email subject.

  • Email Sender: Specifies the sender email address, for example: noreply@mycompany.com.

    • The sender field can also include both display name and email address as follows: "Display name" <noreply@mycompany.com>.

Email Content Customization

  • HTML Tab:

    • Provides a rich text editor for formatting email content.

    • Users can insert fields, format text, add tables, and customize the layout.

    • Example content: "Your email was blocked due to a security issue."

  • Plain Text Tab:

    • Used for text-based email clients.

Info

When editing HTML content, the plain text version is automatically updated, based on the content provided.

Email Content Preview

  • Shows a sample notification email with placeholders replaced by actual data.

Scripting Language

It is also possible to additionally customize templates using the Handlebars template scripting language. For more information see: https://handlebarsjs.com/guide/

Custom Fields

The following field can be inserted into email notification templates:

Category

Name

Description

Report

Date/Time Created

When the notification was generated. Apply a formatting helper to control how the date and time appear.

Item

Type

The kind of item the notification is about: email, message (Teams) or file.

Item

Date/Time Sent

When the item was sent or last changed — the date sent for email, the message timestamp for Teams, the date last modified for files. Apply a formatting helper.

Item

Size

Size of the item. Apply a formatting helper to show it in KB or MB.

Item

Message ID

Unique identifier of the message: the Message-ID header for email, or the Teams message ID. Useful when cross-referencing with mail logs. Not available for files.

Item

Thread URL

A direct link to the item — the email in the quarantine portal, the message in Teams, or the file in SharePoint or OneDrive.

Item

Verdict

The overall verdict for the item, combining the results of every engine that scanned it.

Item

Sender

Group heading. Select one of the sender fields below.

Item → Sender

Name

Display name of the sender.

Item → Sender

Address

Address of the sender: the SMTP address for email, the user principal name for Teams, or the file owner for SharePoint and OneDrive.

Item → Sender

Address

SMTP envelope sender address. This can differ from the visible From address, for example with mailing lists or forwarded mail. Email only.

Item

To:

Group heading. Recipients on the To: line, as a list — loop over it to show every recipient. Email only.

Item → To:

Name

Display name of a To: recipient.

Item → To:

Email Address

Email address of a To: recipient.

Item

Cc:

Group heading. Recipients on the Cc: line, as a list — loop over it to show every recipient. Email only.

Item → Cc:

Name

Display name of a Cc: recipient.

Item → Cc:

Email Address

Email address of a Cc: recipient.

Item

Subject

The email subject line, or the subject of a Teams channel post. Teams chat messages have no subject.

Item

Attachments

Group heading. Files carried by the item, as a list — loop over it to show every attachment. Covers email attachments and files shared in Teams.

Item → Attachments

Name

Filename of an attachment or shared file.

Item

Channel

Group heading. Details of the Teams conversation the message was posted in. Teams only.

Item → Channel

Name

Name of the conversation: the topic of a named group chat, or <team> / <channel> for a channel post. Empty for one-to-one chats and unnamed group chats.

Item → Channel

Type

Whether the message was posted in a Channel or a Chat.

Item → Scan

Engines

Group heading. Information about the engines that scanned the item.

Item → Scan → Engines

Count

How many engines scanned the item.

Item → Scan → Engines

Triggered

Group heading. The engines that returned the item's verdict.

Item → Scan → Engines → Triggered

Count

How many engines returned the item's verdict.

Item → Scan → Engines → Triggered

Engines

The engines that returned the verdict, as a list — loop over it to name each one.

Item → Scan → Engines → Triggered → Engine

Name

Name of a triggered engine.

Item → Scan

Verdict

Group heading. The verdict reached for the item.

Item → Scan → Verdict

Name

Verdict name, for example Malicious or Suspicious.

Item → Scan → Verdict

Description

A short explanation of what the verdict means.

Item → Scan

Threat

Group heading. Details of the threat found, when one was found.

Item → Scan → Threat

Name

Name of the threat detected.

Item → Scan → Threat

Description

A plain-language explanation of the threat and why it is a risk.

Item → Scan → Threat

Severity

How serious the threat is, on a scale of 1 to 10.

Item → Scan

Affected Files

Group heading. The files that caused the item to be blocked or sanitized, as a list — loop over it to show each one.

Item → Scan → Affected Files

Name

Name of the affected file.

Item → Scan → Affected Files

Type

The true file type, as identified during scanning. This can differ from the file extension.

Item → Scan → Affected Files

Verdict

The verdict for this individual file.

Item

Policy

Group heading. The policy that was applied to the item.

Item → Policy

Name

Name of the policy that was applied.

Item → Policy

Action

What the policy did: Blocked or Allowed.

Actions

URL

The link an end user follows to act on the item, for example to request its release