Message Parts  
Subject The message's "Subject" header.
To The message's "To" header.
From The message's "From" header.
Envelope-To The recipient addresses, as interpreted from the SMTP "RCPT TO" command; the actual delivery address, as opposed to the message's "To" header.
Envelope-From The sender's address, as interpreted from the SMTP "MAIL FROM" command.
BODY Consecutive chunks of the message's body content (i.e., paragraphs); HTML parts are stripped of markup tags. Useful for matching words obfuscated by HTML tags.
RAWBODY Consecutive chunks of the message's body content (i.e., paragraphs); markup tags in HTML parts are left intact. Useful for matching HTML markup characteristics.
URI URI strings found in the body of the message.
EOB The entire message body; HTML parts are stripped of markup tags. EOB is resource-intensive, as the entire message must be loaded at once. Use "BODY" if possible.
RAWEOB The entire message body; markup tags in HTML parts are left intact. RAWEOB is resource-intensive, as the entire message must be loaded at once. Use "RAWBODY" if possible.
EOH All of the message's headers, concatenated into a single string.
Full The entire message, including headers.
any message header The name of any message header.

Close Window