The following table describes token variables for customizing C&C Callback event notification messages.
Note:
For the list of standard token variables supported by all event notifications, see Standard Token Variables.
|
Variable |
Description |
|---|---|
|
%CALLBACK_ADDR% |
URL, IP address, or email address to which a compromised host attempts a callback |
|
%COMPR_HOST% |
Affected host or email address |
|
%CnC_LIST_SRC% |
Name of the list that contains the callback address |
|
%CALLBACK_NUM% |
Number of contacts made between callback addresses and compromised hosts |
|
%COMPR_HOST_NUM% |
Number of compromised hosts involved in the outbreak |
|
%CALLBACK_ADDR_NUM% |
Number of callback addresses involved in the outbreak |