Variable name

Variable value

%ACTION%

The application's action on the object.

%AUTHOR%

Name of the user who is the file author. If the user cannot be recognized (e.g., during an on-demand scan), the variable takes on the value n/a.

%BACKUP_RESULT%

Object backup result.

%FARM_NAME%

Name of the server farm associated with the event.

%FILE_NAME%

Name of the object scanned by the application.

%FILE_URL%

Path to the object on SharePoint.

%FILE_VERSION%

Version of the file scanned by the application. This variable can only be used in notifications about events of an on-demand scan.

%INCIDENT_ID%

Unique ID of the incident. The ID allows finding information about the event in the application event log and Backup.

%LAST_MODIFIER%

Name of the user who has been the last to make any changes to the file. If the user cannot be recognized (e.g., during an on-demand scan), the variable takes on the value n/a.

%ODS_TASK_NAME%

Name of an on-demand scan task. This variable can only be used in notifications about events of an on-demand scan.

%OPERATION_TYPE%

The user's action on the object (e.g., downloading the file from a SharePoint website to the user's computer). This variable can only be used in notifications about events of an on-access scan.

%SERVER_LOCAL_DATETIME%

Date and time the malicious object or unwanted content was detected on the server. The variable takes on the value of the local time of the server.

%SERVER_NAME%

Name of the server associated with the event.

%THREAT_DESCRITION%

Name of the virus or category of unwanted words and phrases.

%USER%

Name of the user associated with the event. This variable can only be used in notifications about events of an on-access scan.

%UTC_OFFSET%

Time shift regarding UTC (Coordinated Universal Time).