/Bn

Boolean: The event was blocked with a notification message.

/Bq

Boolean: The event was blocked quietly.

/Ws

Boolean: The event provoked a warning dialog, which the user heeded.

/Wps

Boolean: A server side event provoked a warning which the user heeded. But before the event could be reanalyzed against policy, policy changed.

/Wc

Boolean: The event provoked a warning dialog, which the user ignored.

/Wa

Boolean: The event provoked a warning dialog that the user had previously ignored on the same site, and this dialog was therefore not shown.

/Is

Boolean: The event provoked an inform dialog, which the user heeded.

/Ips

Boolean: A server side event provoked an inform dialog. But before the event could be reanalyzed against policy, policy changed.

/Ic

Boolean: The event provoked an inform dialog, which the user ignored.

/Ia

Boolean: The event provoked an inform dialog that the user had previously ignored on the same site, and this dialog was therefore not shown.

/Qn

Boolean: The event was quarantined with a notification message.

/Qq

Boolean: The event was quarantined quietly.

/PE

Boolean: The event was designated 'Personal' by the user.

/CS

Boolean: The event provoked a silent control (for example, user input was not requested and the event was not blocked).

/NA

Boolean: Action processing was halted by a 'No further actions' action

/RD

Boolean: The event was redirected.

/RP

Boolean: The event generated an automatic reply.

/SC

Boolean: The event used security (digitally signed or encrypted).

/SG

Boolean: The event was digitally signed.

/EN

Boolean: The event was encrypted.

/DR

Boolean: The event was protected by Digital Rights Management.

/TR

Boolean: The event has an associated partial transaction record.

/NT

Boolean: There are no triggers on this event.

/SPi

Boolean: The event has internal scope - ie, exclusively sent to, or received from locations matching the policy definition of 'Internal Email' (email events) or 'Intranet Sites' (web events).

/SPe

Boolean: The event has external scope - ie, exclusively sent to, or received from locations NOT matching the policy definition of 'Internal Email' (email events) or 'Intranet Sites' (web events).

/SPm

Boolean: The event has mixed scope - ie, NOT exclusively sent to, or received from locations matching the policy definition of 'Internal Email' (email events) or 'Intranet Sites' (web events).

/SId

String: Security ID. Used enforce custom row-level-security.

/ST

Boolean: The event was ultimately blocked, either directly by policy, or because the user heeded a warning.

/HRe

Boolean: All external recipients in the original TO/CC lists were moved to the BCC list.

/HRa

Boolean: All recipients in the original TO/CC lists were moved to the BCC list.

/DS

Boolean: The file was deleted quietly.

/RS

Boolean: The file's contents were replaced quietly.

/DSs

Boolean: The file's contents were securely obliterated and deleted quietly

/RSs

Boolean: The file's contents were securely obliterated and replaced quietly.

/HT

String: The type of the file hash (stored in the ExternalID field)

/LHa

Boolean: The email contained a legal hold notification, which the user accepted

/LHr

Boolean: The email contained a legal hold notification, which the user rejected

/CA

Boolean: The event was categorized automatically

/CM

Boolean: The event was categorized manually by the user

/SV

32 bit Integer: The severity score of the trigger