This would have been nice to know last year when we first started hosting Zimbra!
krav_maga, you might find this particular thread helpful:
need per-user AV SPAM PHISH configs (some need no filtering)
Specifically, the list of available amavis attributes is in:
/opt/zimbra/conf/attrs/amavisd-new-attrs.xml
In any case, it isn't accessible to the end user, except for the whitelist/blacklist in 6.0, so writing the Zimlet and replacing the line in amavisd.conf.in after upgrades was well worth it. Now that I know these attributes are available via SOAP we may have to consider moving away from the MySQL version.