"wb.uf"

Name of file uploaded from web event. There may be multiple instances of this attribute per event.

"wb.ru"

URL that web event was redirected to.

"em.af"

Name of file attached to an email. There may be multiple instances of this attribute per event.

"em.ra"

Address that email was redirected to.

"em.qt"

Quarantine timeout. The presence of this value indicates that an event has been quarantined. Its value will always be zero, indicating that the default timeout applicable for the event will be applied.

"em.mc"

The 'message classification' of an email.

"am.kp"

Number of key presses captured in application monitoring event.

"am.mc"

Number of mouse clicks captured in application monitoring event.

"am.at"

Time in milliseconds that user was active in application monitoring event.

"am.dr"

Deactivation reason of application monitoring event. Possible values are 0 (ongoing event was updated), 1 (switched to another top level window), 2 (closed the top level window), 3 (top level window title changed) or 4 (application was shutdown).

"im.af"

Name of file attached to Instant Messaging chapter. There may be multiple instances of this attribute per event.

"im.nw"

Name of IM Network over which conversation is transported.

"fi.rl"

Location that file was copied to

"cl.fc"

Event classification

"tr.fc"

Trigger classification

"Extracted.<name>"

A value extracted from a web page or email by a classifier will start with "Extracted." followed by the name of the extracted value.

"SmartTag.<name>"

A SmartTag™ identified on a web page or email by a trigger will start with "SmartTag." followed by the name of the tag.

"sq.prim_ev"

Sequence attribute denoting the primary event (ie, the first event in the sequence with a capture module trigger). The value of this attribute takes the form "<SequenceIDM>.<SequenceID>:<EventIndex>" eg, "100.1:2". This attribute will always have an AttrIndex = -1.

"sq.trans_ev"

Sequence attribute denoting the transaction event. This event is the last event in the sequence which has a transaction module trigger, and the one to which the WgnTransaction record points. The value of this attribute uses the same syntax as the "sq.prim_ev" attribute. This attribute will always have an AttrIndex = -2.