Novell SENTINEL 6.1 SP2 - REFERENCE GUIDE 02-2010 Reference Manual page 20

Figure 2-3
When you type the label or short tag for a field to be used in an action, the name can be enclosed in
percent signs (%tag%) or dollar signs ($tag$). For example:
%sun% in a correlation action refers to the value of InitUser in the correlated event

$sun$ in a correlation action refers to the value of InitUser in the current, "trigger" event (the

final event that caused the correlation rule to fire)
NOTE: In a right-click menu event operating on a single event, there is no functional
difference between %sun% and $sun$.
For example, to pass the Initiator User Name to a command line action to look up information from
a database about that user, you could use %InitUserName% or %sun%. For more information about
Actions, see "Actions and Integrators" section in
20 Sentinel 6.1 Reference Guide
Configuration Action - Select Event Attributes window
Sentinel 6.1 User Guide.