Google Message Security for Google Apps Administration Guide - Manual (Page 407)

Interpreting Header Fields 407
X-pstn-neptune-rslt: pass
You may also see the following header field, which indicates that the message has
suspicious behavior and content and may be treated as a virus:
pstn-neptune-cave-rslt: virus
If a message triggers Early Detection for viruses, this field appears in the
message header:
X-pstn-neptune-cave-rslt: pbox
Industry Heuristics Header Fields
Industry Heuristics (optional feature) generates these header codes:
• LC : legal content
• FC : financial content
• LT : legal transport
• FT : financial transport
The transport codes only appear on the settings line; the content codes appear on
both the levels and settings lines.
If content or transport filtering is triggered, the code appears in uppercase letters
on the
x-pstn-settings line. If filtering isn’t triggered, the codes appear in
lowercase letters.
Content Header Field Example
In this header field example, Industry Heuristics for financial and legal content
were turned on.
X-pstn-levels: (S: 0.9403/ 9.86262 FC:95.5390 LC:95.5390
R:95.9108 P:95.9108 M:98.9607 C:66.2733 )
X-pstn-settings: 3 (1.0000:2.0000) fc lc r p m C
The scores for these categories appear on the levels line, FC:95.5390
LC:95.5390 . As with the other categories, filtering triggers when their scores drop
below 85. In this case, neither triggered, so they appear in lowercase on the
settings line.
In the next example, the organization had the Industry Heuristic legal content and
legal transport categories turned on.
X-pstn-levels: (S: 0.00000/ 4.76962 LC: 0.1839 R:95.9108
P:95.9108 M:81.1584 C:97.1311 )
X-pstn-settings: 3 (1.0000:0.0000) LC lt r p M c