You can use the following variables in user message templates or administrator message templates:
%RULE%.Name of the rule that blocked the execution of a file.
%DATE%.Date when the execution of the file was blocked in the DD.MM.YYYY format.
%TIME%.Time when file execution was blocked in the HH:MM format.
%USER_NAME%.Name of the current user account on the computer on which file execution was blocked, in the <device name>\<user alias> format (for example, DESKTOP-123\John.Smith).
%COMPUTER_NAME%.Name of the computer on which file execution was blocked.
%FILE_NAME%.Name of the executable file of the blocked application.
%KL_CAT%.KL category to which the blocked application belongs (for example, Browsers).
%FILE_PATH%.Full path to the executable file of the blocked application.
%FILE_VERSION%.Version of the executable file of the blocked application.
%ORIGINAL_FILE_NAME%.Original name of the executable file of the blocked application. The file name is specified in the properties of the executable file of the application.
%FILE_PUBLISHER%.Vendor of the blocked application.
%FILE_PRODUCT_NAME%.Name of the blocked application.
%PRODUCT_VERSION%.Version of the blocked application.
%FILE_HASH%.Hash of the executable file of the blocked application.
%CERT_ISSUER%.Issuer of the certificate that the executable file is signed with.
%CERT_SUBJECT%.Subject of the certificate that the executable file is signed with.
%CERT_THUMBPRINT%.Thumbprint of the certificate that the executable file is signed with.