I wanted to ask how to add the original sender email address to the report list, currently I have this :
<FONT color=#ff0000>McAfee GroupShield™ Alert</FONT>
<P>McAfee GroupShield discovered a problem with the following email. See your system administrator for further information. </P>
Date/Time sent: %dts%<br>
Subject line: %sbj%<br>
Action taken: %res%<br>
Rule Group: %rul%<br>
Ticket Number: %tik%<br>
To elaborate : I just updated new rules to block emails with certain words in it and delete them.
But I also wanted to manually block all email addresses that already had send emails, just as a sort of insurance
When users send these emails to me, they will get blocked (like they should be), but I will not get the original sender in the report list.
What do I need to put into these text to add it to the report list ?
Thanks in advance and sorry for any bad english grammer
you wont be able to get the original email address in the notification when they are forwarded to you. msme is only looking at the header info for the current email when it gets the to/from addresses. the only way to get the original email addresses would be to have the email quarantined, then go into the detected items view and find that email, download it and then open with notepad or outlook 2010 to see what addresses where originally used.