Novell SENTINEL RAPID DEPLOYMENT 6.1 - REFERENCE GUIDE 06-15-2009 Reference Manual page 14

Figure 1-3
When you type the label or short tag for a field to be used in an action, the name can be enclosed in
percent signs (%tag%) or dollar signs ($tag$). For example:
%sun% in a correlation action refers to the value of InitUser in the correlated event
$sun$ in a correlation action refers to the value of InitUser in the current, "trigger" event (the
final event that caused the correlation rule to fire)
NOTE: In a right-click menu event operating on a single event, there is no functional
difference between %sun% and $sun$.
For example, to pass the Initiator User Name to a command line action to look up information from
a database about that user, you could use %InitUserName% or %sun%. For more information about
Actions, see "Actions and Integrators" section in
14 Sentinel 6.1 Rapid Deployment Reference Guide
Configuration Action - Select Event Attributes window
Sentinel 6.1 Rapid Deployment User Guide.