The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Understanding Email Headers with analysis status

Prev Next

After analyzing the email attachment/URL for threats, Intelligent Sandbox updates adds these headers of the respective emails with the observations, and sends the emails to the configured relay host.

Header

Values

X-ATD-FILENAMES

Lists the names of all attachments/URLs of the email separated by comma(,).

X-ATD-ALTFILENAMES

Lists the alternate names of scanned attachments that have the same hash value as determined during the earlier scans. For example, if after scanning a file (file1), another attachment with the same hash but a different file name (file2) is detected, the X-ATD-ALTFILENAMES header is added with the value file1, file 2.

X-ATD-FILEHASHES

Adds the hashes of all email attachments/URLs. For example, MD5 , SHA-256.

X-ATD-FILEVERDICTS

Adds the verdict for each email attachment/URL that was submitted for analysis.

  • 5 — Very high (risk)

  • 4 — Malicious

  • 3 — Likely to be malicious

  • 2 — Low activities

  • 1 — Very low activity

  • 0 — Informational

  • -1 — Clean

  • -2 — Failed to scan (because of unsupported file type)

  • -3 — Scan Timed out

  • -4 — Filtered by the File Type Configuration

  • -5 — Filtered by File Filtering Rules

X-ATD-VERDICT

Adds the overall verdict for an email.

  • 5 — Very high (risk)

  • 4 — Malicious

  • 3 — Likely to be malicious

  • 2 — Low activities

  • 1 — Very low activity

  • 0 — Informational

  • -1 — Clean

  • -2 — Failed to scan (because of unsupported file type)

  • -3 — Scan timed out

  • -6 — No file attachments were scanned

  • -7 — Silent Mode (When Intelligent Sandbox is set to disable file scanning, where the emails attachments are not scanned and only email count is incremented for every email)

  • -8 — Intelligent Sandbox is too busy to service new scanning requests. At least one attachment has not been scanned and does not have a cached result (see X-ATD-TOOBUSY)

  • -100 — Intelligent Sandbox failed to receive or deliver the emails

X-ATD-SILENTMODE

Adds the value of 1 if an email was scanned in silent mode. Otherwise this header is not added.

X-ATD-TOOBUSY

Adds this header to all messages that pass through Intelligent Sandbox while it is:

  • processing new attachments/URLs for scanning

  • configured in Email pass-through mode.