A list of custom properties for alert description and notification:
For event Rules:
EventDisplayNumber (Event ID): $Data/EventDisplayNumber$ EventDescription (Description): $Data/EventDescription$ Publisher Name (Event Source): $Data/PublisherName$
EventCategory: $Data/EventCategory$ LoggingComputer: $Data/LoggingComputer$
EventLevel: $Data/EventLevel$
Channel: $Data/Channel$ UserName: $Data/UserName$
EventNumber: $Data/EventNumber$
For event Monitors:
EventDisplayNumber (Event ID): $Data/Context/EventDisplayNumber$ EventDescription (Description): $Data/Context/EventDescription$ Publisher Name (Event Source): $Data/Context/PublisherName$
EventCategory: $Data/Context/EventCategory$ LoggingComputer: $Data/Context/LoggingComputer$
EventLevel: $Data/Context/EventLevel$
Channel: $Data/Context/Channel$ UserName: $Data/Context/UserName$
EventNumber: $Data/Context/EventNumber$
The full list here:
http://blogs.technet.com/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx
Unquoted – Combining vuln data with processes
10 months ago