Understanding message personalization options

While creating and updating notifications, you can insert (Message Personalization) variables to the body of the notifications.

Personalization Tag Description Access Session API
Application App user was trying to login to X X X
Batch table Renders a Related Files table in the EMAIL BODY with columns: FILE NAME, LABEL, and TIMESTAMP (UTC). Only comma-separated column name tokens are supported in the email body when using this tag. To render file names as hyperlinks, include FILE_LINK and SUBJECT_HEADER together with BATCH_TABLE.     X
Condition
Comma separated text for the following conditions in rule that matched:
  • Consecutive Login Failures - "<N> login failures."
  • <N> will be replaced with number of failures that triggered match
  • Simultaneous Login Distance - "Simultaneous logins from geographically distant locations (<N> miles in <M> minutes)."
  • <N> will be replaced with number of miles between associated log events
  • <M> will be replaced with number of minutes between associated log events
  • New User-Agent+Location Detected - "Login detected from new device."
 X
Device Match The Device type that matched the policy line X
Direction The direction of traffic flow when watermark was applied (Uploaded or Downloaded) X
Email Address User account Company Email attribute X X X
File link Renders the file name as a hyperlink to the file in Google Drive. Use together with SUBJECT_HEADER and BATCH_TABLE to render clickable file names in the Related Files table.     X
First Name User account First Name attribute X X X
IP Address Users IP address when watermark event occurred X X
Label The classification label value that triggered the policy.     X
Last Name User account Last Name attribute X X X
Location Associated log location (reverse IP or browser lookup) X X
Logout All Sessions Link A link that allows the user to logout all of their sessions across all devices. X X X
OS OS extracted from associated log User Agent X X
Password Change Link Link to allow the user to change their password (if Forcepoint Data Security Cloud | App Security is the IdP). X X X
Pattern_Name The name of the DLP pattern that was matched on the policy X
RDNS of IP Address Reverse-DNS lookup to find the domain associated with an IP address. X X
Region Match The region/location of the user at time of matching the policy line X X
Subject header The subject header of the batch notification email. Use together with FILE_LINK and BATCH_TABLE to render file names as hyperlinks in the Related Files table.     X
Timestamp Timestamp of the event in YYYY-MM-DD HH:MM GMT format. For API Google Badge Labels batch notifications, the timestamp is rendered in ISO 8601 UTC format (for example, 2026-05-14T04:14:00). X X X
Transaction ID Watermark event transaction ID X X