Advanced Threat Activity Token Variables

%hostIP%

Depending on the traffic direction, %hostIP% is IP address determined by Deep Discovery Inspector:

• Outbound traffic (internal traffic going to an external network): %hostIP% is the IP address of the endpoint in the network (source)

• Traffic within the network: %hostIP% is the IP address of the endpoint in the network

• External traffic to an endpoint in a network: %hostIP% is the IP address of the endpoint in the network

• Traffic outside the network: %hostIP% is the IP address of the endpoint outside the network

%group%

The name of the subnetwork

%START_TIME%

The start date and time of the detection period

%END_TIME%

The end date and time of the detection period

The start and end times define the time range interval. When logs are received during a certain interval, Apex Central calculates those logs. If the alert criteria is met, Apex Central counts the logs. %START_TIME% is the start time of the interval and %END_TIME% is the end time of the interval. The length of the interval is determined by the period threshold in the alert settings.

%detections%

The number of detections

For example:

Event: High risk Virtual Analyzer detections

IP address: %hostIP%

Host name: %computer%

Group: %group%

Time range: %START_TIME% - %END_TIME%

Detections: %detections%