> For the complete documentation index, see [llms.txt](https://docs.lithnet.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lithnet.io/ams/v2.1/help-and-support/advanced-help-topics/audit-variables.md). # Variables available in audit notification channels Access Manager provides a comprehensive set of variables you can use in your audit notifications. See the guides on [PowerShell auditing scripts](/ams/v2.1/help-and-support/advanced-help-topics/audit-scripts.md) and [HTML and JSON audit templates](/ams/v2.1/help-and-support/advanced-help-topics/audit-templates.md) to learn how to use these variables in your audit scripts and templates. ## Global properties | Property | Format/Type | Description | | ------------- | ----------- | ----------------------------------------------- | | `DateTime` | string | The current date and time, in local server time | | `DateTimeUtc` | string | The current date and time, in UTC time | ## Request element This group of attributes represents the incoming request | Property | Format/Type | Description | | --------------------------- | --------------------------- | ------------------------------------------------------------------- | | `Request.Target` | string | The name of the target that the user requested access to | | `Request.TargetType` | `Computer` or `Role` | The type of resource the user requested access to | | `Request.Reason` | string | The reason that the user provided when requesting access | | `Request.IPAddress` | IPv4 or IPv6 address string | The IP address of requestor | | `Request.HostName` | string | The host name of the requestor, if available via reverse DNS lookup | | `Request.RequestedDuration` | TimeSpan | The requested duration of access | ## Response element This group of attributes represents the result of the access evaluation | Property | Format/Type | Description | | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | `Response.Target` | string | The name of the target that the access request was evaluated against | | `Response.TargetType` | `Computer` or `Role` | The type of resource that was evaluated | | `Response.IsSuccess` | `true` or `false` | Indicates if access was granted to the resource | | `Response.IsFailure` | `true` or `false` | Indicates if access was denied to the resource | | `Response.NotificationChannels` | string | A comma-separated list of audit channels IDs that apply to this access response | | `Response.MatchedRule` | string | The ID of the authorization rule that was used to make the access decision | | `Response.MatchedRuleDescription` | string | The 'description' field from the authorization rule that was used to make the access decision | | `Response.ExpireAfter` | TimeSpan | The duration of time that access was granted for | | `Response.Code` | `Success`, `NoMatchingRuleForTarget`, `NoMatchingRuleForUser`, `ExplicitlyDenied`, `UserRateLimitExceeded`, `IpRateLimitExceeded` | The result of the authorization decision. Codes other than `Success` represent an 'access denied' response. | | `Response.AccessType` | `None`, `LocalAdminPassword`, `LocalAdminPasswordHistory`, `Jit`, `Bitlocker` | The type of access that was granted | | `Response.AccessTypeDescription` | string | The friendly name of the type of access that was granted | | `Response.AccessExpiryDate` | DateTime | The date and time when the user's access will expire, expressed in local server time | | `Response.Message` | string | A user-friendly message describing the outcome of the access decision | ## User element This group of attributes represents the user who performed the access request | Property | Format/Type | Description | | ------------------------- | ----------- | -------------------------------------------------- | | `User.Username` | string | The `samAccountName` of the user requesting access | | `User.FullyQualifiedName` | string | The user's username in `domain\username` format | | `User.DisplayName` | string | The display name of the user | | `User.Sid` | string | The user's security identifier | | `User.EmailAddress` | string | The user's email address | ## Role element If the authorization request was for a role, then this property will be populated with information about the role authorization rule | Property | Format/Type | Description | | ----------------------------- | ----------- | ----------------------------------------------------------------------------------------------------- | | `Role.Name` | string | The name of the role | | `Role.Description` | string | The description of the role | | `Role.MaximumAllowedDuration` | TimeSpan | The maximum amount of time that the user can request for the role according to the authorization rule | ## Computer element If the authorization request for a computer, then this property will be populated with information about the computer | Property | Format/Type | Description | | ----------------------------- | ------------------------------------------------ | ---------------------------------------------------------------- | | `Computer.Name` | string | The short name of the computer | | `Computer.Description` | string | The description of the computer | | `Computer.FullyQualifiedName` | string | The name of the computer in `domain\computer` format | | `Computer.DnsHostName` | string | The computer's DNS host name, if known | | `Computer.DisplayName` | string | The computer's display name | | `Computer.ObjectId` | string | A unique identifier for the computer | | `Computer.Sid` | string | The computer's security identifier | | `Computer.AuthorityType` | `ActiveDirectory`, `AzureActiveDirectory`, `Ams` | The authoritative directory where this computer is located | | `Computer.AuthorityId` | string | The ID of the authority where the computer is located | | `Computer.AuthorityDeviceId` | string | The unique ID for the device, specific to the device's authority | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.lithnet.io/ams/v2.1/help-and-support/advanced-help-topics/audit-variables.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.