| $dest | The target destination's name (or IP Address if the IP didn't resolve to a name). This is different than $host because an alert might be attached to an intermediate hop, whose information is accessed via the $host variable(s). The final destination, though, is accessed via the $dest variable(s). |
| $destip | The destination IP address |
| $destname | The resolved DNS name for the destination |
| $host | Host name (or IP address, if no name exists). If used in an alert on a non-target hop, the alerting hop's information will be used. |
| $hostip | The host IP address |
| $hostdnsname | The resolved DNS name for the host |
| $date | Same as $year-$month-$day. |
| $time | The same as $hour$minute - note the absence of any punctuation - that's to make sure the file name is valid, if this mask is being used in a file name. |