Variables

What Is Variables?

Variables are the variables offered in the Variable name list of the Add variable window. In the list every row appears in the form group name - variable name (e.g. Connection info - Client IP address); the headings below are the same as these group names and in the same order as in the list. In the interface 193 variables are offered: 192 of them in 14 groups and one (Response source) without a group.

For the use of the window and how the variable is placed in the field, see Smart Variables.

On which screens and in which fields the variable is offered is explained in the Usage Locations section, and its use on the real screens on the Example Use Scenarios page.

Usage Locations

The variables are not offered in every field in the interface; they are present only in the fields whose value is calculated while the request is being processed. A variable is added to these fields in four separate ways:

Entry path	How it appears in the field	Where
A text field with an fx button	When the fx button on the right of the field is clicked, the Add variable window opens; the variable selected is placed inside the text as a badge. When the badge is clicked, the window opens again with the Edit variable title	The redirect location, the header content, the SNI, the AGS fields, the report column, the manual log line
A key list	There is no fx button; every row added to the list is a variable and it is changed by clicking the badge. The same key is not added to the list twice	The tracking, quarantine, cache, bandwidth, sampling and session keys, the manual log entries
A content editor	It is added inside the text with the Add TR7 variable button in the toolbar; when the badge in the text is clicked, the window opens again. The button is present only in the Visual editor mode; in the HTML source mode the field is a plain text box	The content pages, the WAF blocking page
A condition field	The value that the condition compares is produced with a variable	Only in the Dynamic condition, Dynamic list and AGS condition condition types

Load Balancer

Screen	Visibility condition	Field	Entry path
vService	Persistence: Hash based	Hash key	A key list
vService	Persistence: Session Affinity Manager (SAM), Cookie source: TR7 Generates, Session ID format: Custom Format	Custom format format keys	A key list
vService	Debug on (HTTP only)	Entry value in the Custom debug log entries table	A key list
Backend Services · Backend Groups	SSL service checked	SNI	A text field with an fx button

The conditions:

Condition type	Field	Entry path
Dynamic Condition	Query key; as the comparison value Key to compare, Integer to compare, Range start and Range end	A text field with an fx button
Dynamic List	Key to search	A text field with an fx button
AGS Condition	Variable type	A variable picker

In the other condition types a variable is not used; they work with fixed values, with lists or with regular expressions.

The actions:

Action	Visibility condition	Field	Entry path
Location Redirection	-	Redirect location	A text field with an fx button
Redirect for Traffic Manager Errors	-	Redirect location	A text field with an fx button
Redirect for Backend Service Errors	-	Redirect location	A text field with an fx button
Add HTTP Header · Set HTTP Header	-	Header content	A text field with an fx button
Create Traffic Variable	-	Variable value in the Variable assignments table	A text field with an fx button
Set Path · Set Path + Query	-	New path info	A text field with an fx button
Advanced Traffic Inspection	-	Fields to track	A key list
Bandwidth Limitation	Limit type: Dynamic	Key	A key list
Traffic Mirroring	Sampling on	Sampling key	A key list
Quarantine	Tracking key: Manual	Quarantine keys to track	A key list
Quarantine	The quarantine action: Redirect	Redirect location	A text field with an fx button
Advanced Captcha	The quarantine on, Tracking type: Manual	Quarantine tracking keys	A key list
Advanced Captcha	The quarantine action: Redirect	Redirect location	A text field with an fx button

In the other actions such as removing a header, changing a header, CORS and URL normalization there is no variable field.

The profiles:

Profile	Visibility condition	Field	Entry path
Logs	Line format: Manual Log Line Format	Manual Log Line Format	A text field with an fx button
Logs	Line format: Manual JSON Format or Manual CEF Format	Value in the Manual log entries table	A key list
Caching	Dynamic caching on	Key	A key list
Reports	A report section table	Column content in the Table columns table	A text field with an fx button
Content Pages	-	Content	A content editor

WAF - WAAP

Screen	Visibility condition	Field	Entry path
Blocking Page	The blocking page source: Manual content, the content type text/html	Blocking page	A content editor

If the content type is not text/html, the field turns into a plain text box and the Add TR7 variable button is not displayed. In this field the variables of the request stage are offered; the variables that belong to the response are not listed.

In the rule, learning and log screens of WAF there is no variable field.

Bot/DDoS

Screen	Visibility condition	Field	Entry path
L7 DDoS Protection	The action of the protection block: Redirect	Redirect location	A text field with an fx button
Bot Protection · IP Reputation Protection	The action of the rule row: Redirect	Redirect location	A text field with an fx button
Quarantine	Tracking type: Manual	Quarantine tracking keys	A key list
Quarantine	The quarantine action: Redirect	Redirect location	A text field with an fx button
Captcha	The quarantine on, Tracking type: Manual	Quarantine tracking keys	A key list

On the Waiting Room card there is no variable field; the content of the waiting room page is prepared in the Content Pages profile and the variables of the place in the queue, the demand level and the estimated waiting period are added there. In the condition fields of the card, on the other hand, a variable is used over Dynamic Condition.

AGS - AAM

In the AGS fields the variables of the request stage are offered.

Screen	Field	Entry path
Authentication Providers	LDAP: Username, Password, Service account DN, Custom search filter, Custom bind pattern, Group filter · RADIUS: RADIUS username, RADIUS password, the additional attribute values · HTTP: the header, query and body parameter values, Raw body, Expected redirect URL · Web Form: Login form URL, the form field values, Expected redirect URL · Local Database: Username, Password	A text field with an fx button
Multi-Factor Authentication (MFA)	TOTP: TOTP issuer name · OTP: Phone source, Email source, HTTP URL, the header, query and body parameter values, Raw body, Expected redirect URL	A text field with an fx button
Authentication Servers	The LDAP action profile: Search filter, Username, Password · The HTTP action profile: Path, the header, query and body parameter values, Manual HTTP body	A text field with an fx button
Account Lockout Policies	Policy components when Policy scope: composite is selected	A key list
Bot Protection Policies	Scope components when Policy scope: composite is selected	A key list
Session Protection Policies	Session binding components when Session binding type: composite is selected	A key list
Backend SSO Configurations	Header value, Username source, Password source, Bearer token, Cookie value, Redirect after logout	A text field with an fx button
Login Forms · Page Templates	The title, description, label, placeholder and button texts whose text type is selected as Static	A text field with an fx button
Dictionaries (Multilingual)	The translation texts	A text field with an fx button
Flowchart	The attribute content in the Assign user attributes step · the client-side script in the Allow step · the page title and message in the Deny step · the value compared in the Switch step	A text field with an fx button

The four variables that belong to the OTP message (AGS OTP code, AGS OTP message, AGS OTP message (detailed), AGS OTP recipient) are listed only in the OTP sending fields; they are not present in the other fields.

The Sections That Do Not Have a Variable Field

In none of the screens of the GTM (Global Traffic Manager), Network, Settings and Certificates & PKI sections is there a variable field.

Which Variables a Field Lists

Every field lists only the variables that can be calculated in that field; the Where it can be used column in the tables explains this restriction:

The moment at which the field works	The variables listed
While an HTTP request is being processed (the redirection, the header, the tracking key, the AGS fields)	All the variables that belong to the request; the ones that belong to the response are not present
While an HTTP response is being processed (the response header, the Backend Service error redirection, the report column)	The variables that belong to the request and to the response
In the L7 TCP vService fields	Only the variables that are resolved at the connection level; the ones specific to HTTP are not present
In the log line	All the variables; the period and outcome values that are known only when the request is completed are also present here
In the content pages	The variables that belong to the request and to the response
In the WAF blocking page	Only the variables that belong to the request

In addition to this, the variables for which Outside the key fields is written in the tables are not offered in the cache, bandwidth, sampling, tracking and persistence key lists, in the conditions, in the AGS fields and in the report columns; they are offered in the content, redirection (Redirect location), header (Header content), SNI, New path info, Variable value and log fields.

Reading the Tables

Column	Content
Variable	The name that appears in the Variable name list
Shown in the field	The short name that appears on the badge after the variable has been placed in the field. If it is -, the name in the list appears in the field. In the variables with an argument, the value entered is written instead of the argument label
Argument	The label of the field that appears below when the variable is selected
Where it can be used	In which fields the variable is listed

The values of the where it can be used column:

Value	Meaning
Everywhere	In all the fields of the HTTP and TCP vServices
HTTP	In the fields of the HTTP vServices
HTTP · response	In the fields that work while the response is being processed on HTTP vServices; also in the log and content fields
TCP	In the fields of the TCP vServices
Log only	Only in the line and entry fields of the log profiles
Outside the key fields	They are not offered in the cache, bandwidth, sampling, tracking and persistence key lists, in the conditions, in the AGS fields and in the report columns; they are offered in the content, redirection, header, SNI, path and variable value fields and in the log fields

Connection info

The values that say from whom the connection comes and where it goes. When a source needs to be identified (the tracking key, the quarantine key, the bandwidth key, the server persistence), this is the first group to look at.

Variable	Shown in the field	Argument	Where it can be used
Client IP address	↓IP	-	Everywhere
Real client IP (trusted proxy)	-	-	Everywhere
Client port number	↓Port	-	Everywhere
Destination IP address	↑IP	-	Everywhere
Destination port number	↑Port	-	Everywhere
Backend service IP address	↑Backend.IP	-	Everywhere
Backend service port number	↑Backend.port	-	HTTP · response
HTTP termination state	-	-	Log only
TCP termination state	-	-	Log only
Connection error code	-	-	Log only
Connection error text	-	-	Log only
RDP cookie	↓RDP(RDP cookie name)	RDP cookie name	TCP

Time info

The timestamps, the period measurements and the calendar fields. Since the values that measure a period are known only after the request has been completed, they are produced only in the log line; the calendar fields can be used everywhere.

Variable	Shown in the field	Argument	Where it can be used
Time	-	-	HTTP · outside the key fields
Request time	-	-	Log only
Queue time for request	-	-	Log only
Connection time to the backend service	-	-	Log only
Response time of the backend service	-	-	Log only
Total connection time	-	-	Log only
GMT time	-	-	Outside the key fields
Time from the request to response	-	-	Log only
Current time (ms)	-	-	Everywhere
Second	↓Second	-	Everywhere
Minute	↓Minute	-	Everywhere
Hour	↓Hour	-	Everywhere
Day of month	↓Month.day	-	Everywhere
Day of week	↓Week.day	-	Everywhere
Month	↓Month	-	Everywhere
Year	↓Year	-	Everywhere
Date format	↓Date(Format)	Format	Everywhere
Total active connections	-	-	Outside the key fields

Request info

The values read from the first line of the request: to which address, with which method and with which version it has come. They are used in the conditions in which a decision is made according to the path or the method and in the redirect locations. They are offered only on HTTP vServices.

Variable	Shown in the field	Argument	Where it can be used
Path/page of the request [URI]	↓Path	-	HTTP
Path + query of the request	↓PathQ	-	HTTP
Request query	↓Query	-	HTTP
Frontend HTTP version	↓HTTP.V	-	HTTP
HTTP method	↓Method	-	HTTP
URL	↓URL	-	HTTP
Query parameter	?Parameter	Parameter	HTTP
HTTP request line	-	-	HTTP · outside the key fields

Stats

The connection and request counters, the amounts of data transferred and the waiting room indicators. They are used to write a measurement in the log lines and to show the queue information on the waiting room pages.

Variable	Shown in the field	Argument	Where it can be used
Number of connections	-	-	Outside the key fields
HTTP requests per second	-	-	HTTP · outside the key fields
Sessions per second	-	-	Outside the key fields
Bytes uploaded by client (bytes)	-	-	Outside the key fields
Total data size returned to client (bytes)	-	-	HTTP · response · outside the key fields
Request size	↓Size	-	HTTP
Response size	↑Size	-	HTTP · response
People ahead in queue	-	-	HTTP
Demand level (%)	-	-	HTTP
Estimated wait (seconds)	-	-	HTTP
Page refresh interval (seconds)	-	-	HTTP

HTTP header info

The request and response headers and the cookies. If a single header or cookie is to be read, its name is written as the argument; they are used in jobs such as tracking according to the session cookie, a condition according to a header and carrying a header.

Variable	Shown in the field	Argument	Where it can be used
Request HTTP header content	↓Header name	Header name	HTTP
All request HTTP headers	-	-	HTTP · outside the key fields
Request cookie content	↓C(Cookie name)	Cookie name	HTTP
Response HTTP header content	↑Header name	Header name	HTTP · response
All response HTTP headers	-	-	HTTP · response · outside the key fields
Response cookie content	↑C(Cookie name)	Cookie name	HTTP · response

Others

The cache and compression result, the random number and the manual variables.

Variable	Shown in the field	Argument	Where it can be used
Cache hit	-	-	HTTP · response
Cache name	-	-	HTTP · response
TR7 compression	-	-	HTTP · response
TR7 compression algorithm	-	-	HTTP · response
Random number	Random(0-Random max.)	Random max.	Everywhere
Manual request variable	Manual request variable	Manual variable	Everywhere
Manual response variable	Manual response variable	Manual variable	HTTP · response

Body info

The values read from the request and response body. They read the body not completely but up to the byte limit stated; they are used together with the functions in order to extract a value from JSON or XML.

Variable	Shown in the field	Argument	Where it can be used
Request body	↓Body	Size(bytes)	HTTP
Response body	↑Body	Size(bytes)	HTTP · response
Request form parameter	Form.param(Parameter)	Parameter	HTTP
Request payload	Off request payload	Off	Everywhere
Response payload	Off response payload	Off	HTTP · response

The Response Line (the group without a label)

The two values read from the first line of the response. Since this group does not have a label in the interface dictionary, [[_lb._smartVars.resLine]] is displayed in the list instead of the group name (e.g. [[_lb._smartVars.resLine]] - Status). They are mostly used in the log line and in the fields in which content is produced according to the response.

Variable	Shown in the field	Argument	Where it can be used
Response HTTP version	-	-	HTTP · response
Status	↑Code	-	HTTP · response

WAF

The result that the WAF check has given for that request. It is used to produce content or to keep a log according to whether an attack has been caught or not.

Variable	Shown in the field	Argument	Where it can be used
WAF attack detail	-	-	HTTP
WAF attack state	-	-	HTTP
WAF blocking state	-	-	HTTP
WAF score	-	-	HTTP

Client info

The values that tell who the client is: its country, its browser, its operating system, its bot classification, its IP reputation and its network type. They are used to make a distinction in the conditions and to identify the client in the log line.

Variable	Shown in the field	Argument	Where it can be used
Client country	↓Country	-	Everywhere
Client browser name	↓Browser	-	HTTP
%OS	↓OS	-	HTTP
Mobile platform	↓Mobile	-	HTTP
Bot type	↓Bot	-	HTTP
Bot score	-	-	HTTP
Bot class	-	-	HTTP
Bot factors	-	-	Everywhere
IP reputation category	-	-	Everywhere
Threat protection pillar	-	-	Everywhere
Threat protection action	-	-	Everywhere
Bot/DDoS protection detail	-	-	Log only
Network type group	-	-	Everywhere
Network type category	-	-	Everywhere
ASN	↓ASN	-	Everywhere
Unique ID	Request.ID	-	Outside the key fields

Bot/DDoS protection detail (%THREAT_INFO) writes what the Bot/DDoS protection did to the request into the log line as a single JSON object: the verdict given, the protection that triggered, the bot score and class, the IP reputation category and the exemption information. It is used only in HTTP log profiles; its use for transfer to SIEM systems is described on the SIEM Integration page.

SSL info

The values that belong to the TLS connection and to the certificates. There are separate values for three separate sides: the certificate that the client presents, the certificate on the vService and the connection established with the backend service.

The client certificate

The values read from the certificate that the client presents. They are meaningful on the vServices on which mutual authentication (mTLS) is used; if there is no certificate, they return empty.

Variable	Shown in the field	Argument	Where it can be used
Does Client Have a Certificate	Client.TLS.Status	-	Everywhere
Status Code of Client Certificate Verification	Client.TLS.Verify.Code	-	Everywhere
Description of Client Certificate Verification Status	Client.TLS.Verify.Desc	-	Everywhere
DN Info of Client Certificate	Client.TLS.DN	-	Everywhere
CN Info of Client Certificate	Client.TLS.CN	-	Everywhere
Issuer Info of Client Certificate	Client.TLS.Issuer	-	Everywhere
Validity Start of Client Certificate	Client.TLS.Validity.Start	-	Everywhere
Validity Expiry of Client Certificate	Client.TLS.Validity.End	-	Everywhere
Serial Number of Client Certificate	Client.TLS.Serial	-	Everywhere
SHA-1 Fingerprint of Client Certificate	Client.TLS.SHA1	-	Everywhere
Version of Client Certificate	Client.TLS.Version	-	Everywhere
Signature Algorithm of Client Certificate	Client.TLS.Sign.Algorithm	-	Everywhere
Public Key Algorithm of Client Certificate	Client.TLS.Key.Algorithm	-	Everywhere
Client Certificate in DER Format (Base64)	Client.TLS.DER	-	Everywhere
Client Certificate Chain	Client.TLS.Chain	-	Everywhere
Client Certificate Usage Status	Client.TLS.Used	-	Everywhere
CA Verification Error Code	Client.TLS.CA.Error	-	Everywhere
CA Verification Error Depth	Client.TLS.CA.Error.Depth	-	Everywhere
Email Address from Client Certificate	Client.TLS.Email	-	Everywhere
Organizational Unit from Client Certificate	Client.TLS.OU	-	Everywhere
Organization from Client Certificate	Client.TLS.Organization	-	Everywhere
Country from Client Certificate	Client.TLS.Country	-	Everywhere
State/Province from Client Certificate	Client.TLS.State	-	Everywhere
Locality from Client Certificate	Client.TLS.Locality	-	Everywhere
Subject Alternative Names from Client Certificate	Client.TLS.SAN	-	Everywhere
Root CA DN of Client Certificate	Client.TLS.Root.DN	-	Everywhere
Root CA CN of Client Certificate	Client.TLS.Root.CN	-	Everywhere
Client Certificate Error at Depth 0	Client.TLS.Error	-	Everywhere
Client Certificate DN in RFC2253 Format	Client.TLS.DN.RFC2253	-	Everywhere
Client Certificate Issuer DN in RFC2253 Format	Client.TLS.Issuer.DN.RFC2253	-	Everywhere
Client Certificate Root DN in RFC2253 Format	Client.TLS.Root.DN.RFC2253	-	Everywhere

The TLS information on the vService side

The values that belong to the TLS connection that the client establishes with TR7 and to the certificate on the vService.

Variable	Shown in the field	Argument	Where it can be used
Issuer Info of vService Certificate	Frontend.TLS.Issuer	-	Everywhere
DN Info of vService Certificate	Frontend.TLS.DN	-	Everywhere
CN Info of vService Certificate	Frontend.TLS.CN	-	Everywhere
Validity Start of vService Certificate	Frontend.TLS.Validity.Start	-	Everywhere
Validity Expiry of vService Certificate	Frontend.TLS.Validity.End	-	Everywhere
Cipher Info Used in vService Certificate	Frontend.TLS.Cipher	-	Everywhere
Cipher List of vService Certificate	Frontend.TLS.Cipher.List	-	Everywhere
SSL Connection Error Code of vService	Frontend.TLS.Err.Code	-	Everywhere
SSL Connection Error Description of vService	Frontend.TLS.Err.Desc	-	Everywhere
Status of Passing SNI Info in TLS in Incoming Connection	Frontend.TLS.SNI.Status	-	Everywhere
SSL Key Length in Incoming Connection	Frontend.TLS.Key.Size	-	Everywhere
TLS Protocol Info in Incoming Connection (e.g., TLSv1)	Frontend.TLS.Protocol	-	Everywhere
NPN Info of TLS Communication in Incoming Connection	Frontend.TLS.NPN	-	Everywhere
ALPN Info of TLS Communication with Frontend	Frontend.TLS.ALPN	-	Everywhere
Key Algorithm of vService Certificate	Frontend.TLS.Key.Algorithm	-	Everywhere
Signature Algorithm of vService Certificate	Frontend.TLS.Sign.Algorithm	-	Everywhere
Version Number of vService Certificate	Frontend.TLS.Version	-	Everywhere
TLS Session ID of Frontend Connection	-	-	Everywhere
Frontend TLS Session Resumed Status	-	-	Everywhere
Elliptic Curve Used in Frontend TLS Connection	-	-	Everywhere
SNI Received from Client	-	-	Everywhere

The TLS information on the backend service side

The values that belong to the TLS connection that TR7 establishes with the backend service and to the certificate on that side. They are known at the response stage.

Variable	Shown in the field	Argument	Where it can be used
Is SSL Terminated at Backend Service	Backend.TLS.Status	-	HTTP · response
SSL Cipher Info Used in Communication with Backend Service	Backend.TLS.Cipher	-	HTTP · response
SSL Key Info Used in Communication with Backend Service	Backend.TLS.Key.Size	-	HTTP · response
Protocol Used in Communication with Backend Service	Backend.TLS.Protocol	-	HTTP · response
NPN Info of TLS Communication with Backend	Backend.TLS.NPN	-	HTTP · response
ALPN Info in TLS Communication with Backend	Backend.TLS.ALPN	-	HTTP · response
Key Algorithm of Backend Service Certificate	Backend.TLS.Key.Algorithm	-	HTTP · response
Signature Algorithm of Backend Service Certificate	Backend.TLS.Sign.Algorithm	-	HTTP · response
Version Number of Backend Service Certificate	Backend.TLS.Version	-	HTTP · response
Validity Start of Backend Service Certificate	Backend.TLS.Validity.Start	-	HTTP · response
Validity Expiry of Backend Service Certificate	Backend.TLS.Validity.End	-	HTTP · response
Issuer Info of Backend Service Certificate	Backend.TLS.Issuer	-	HTTP · response
DN Info of Backend Service Certificate	Backend.TLS.DN	-	HTTP · response
CN Info of Backend Service Certificate	Backend.TLS.CN	-	HTTP · response
TLS Session ID of Backend Connection	-	-	HTTP · response
Backend TLS Session Resumed Status	-	-	HTTP · response
Elliptic Curve Used in Backend TLS Connection	-	-	HTTP · response
SNI Sent to Backend Service	-	-	HTTP · response
Backend SSL Connection Error Code	-	-	HTTP · response
Backend SSL Connection Error Description	-	-	HTTP · response
Serial Number of Backend Service Certificate	-	-	HTTP · response
SHA-1 Fingerprint of Backend Service Certificate	-	-	HTTP · response
Backend Service Certificate in DER Format (Base64)	-	-	HTTP · response
Backend Service Certificate Chain (Base64)	-	-	HTTP · response

The general TLS information

The encryption information of the connection and the TLS fingerprints.

Variable	Shown in the field	Argument	Where it can be used
SSL ciphers	-	-	Everywhere
SSL version	-	-	Everywhere
%JA3_FINGERPRINT	↓JA3	-	Everywhere
JA4 TLS fingerprint	-	-	Everywhere
SSL session ID	-	-	Outside the key fields
Request SSL SNI info	-	-	Everywhere

Response source

The value that gives where the response comes from (the Backend Service, the cache or TR7 itself). This variable is not bound to a group; in the list it appears on its own, without a group name, after the SSL info group, and it is offered only in the HTTP log fields.

Variable	Shown in the field	Argument	Where it can be used
Response source	-	-	Log only

Tracking info

The counters in the tracking tables. They read the instantaneous number of connections of a source and the number of connections, requests and the amount of data within the tracking period; they are used in the conditions that take an action when the threshold is exceeded. From which table it will be read is written as the argument.

Variable	Shown in the field	Argument	Where it can be used
Current connections	↓Connection.current(Table name)	Table name	Everywhere
Connections during tracking period	↓Connection(Table name)	Table name	Everywhere
HTTP requests during tracking period	↓Request(Table name)	Table name	HTTP
HTTP errors during tracking period	↓Request.err(Table name)	Table name	HTTP
Incoming data during tracking period (B)	↓Data(Table name)	Table name	Everywhere
Outgoing data during tracking period (B)	↑Data(Table name)	Table name	Everywhere

Create variable

It produces a new value by combining more than one value. It is used in the places where a single variable is not enough (e.g. if the IP and the port are to be made a key together).

Variable	Shown in the field	Argument	Where it can be used
Build request variable		Variable content	Everywhere
Build response variable		Variable content	HTTP · response
Traffic variable content	Traffic variable (Variable name)	Variable name	Everywhere

AGS variables

The values that belong to the AGS session and to the authenticated user. They are used to set up a condition according to the user name, to carry the user information to the backend service and to prepare the OTP message.

Variable	Shown in the field	Argument	Where it can be used
AGS - is authenticated user	-	-	HTTP
AGS session ID	-	-	HTTP
AGS user input	AGS input (AGS input variable)	AGS input variable	HTTP
AGS user ID	-	-	HTTP
AGS username	-	-	HTTP
AGS user e-mail address	-	-	HTTP
AGS user phone number	-	-	HTTP
AGS user groups	-	-	HTTP
AGS user attribute	AGS user attribute (Attribute name)	Attribute name	HTTP
AGS OTP code	-	-	HTTP
AGS OTP message	-	-	HTTP
AGS OTP message (detailed)	-	-	HTTP
AGS OTP recipient	-	-	HTTP

Notes

• In a field only the variables that can be produced in that field are listed. The same variable can appear in the field of an HTTP vService while it does not appear in the field of a TCP vService.
• The variables that require an argument appear in the list with a single name; which header, cookie or table they will read is written after the selection.
• In the short name of the Request HTTP header content and Response HTTP header content variables the header name is shortened to its initials; e.g. the user-agent header appears as ↓UA.
• The period variables that are produced only in the log line are as follows: Request time, Queue time for request, Connection time to the backend service, Response time of the backend service, Total connection time and Time from the request to response. These values are known when the request is completed. Time and GMT time, on the other hand, are not a period but a timestamp and are offered in the fields other than the log as well.
• The name of the variable read with Traffic variable content can be at most 32 characters long; it contains letters, digits and an underscore.
• The AGS OTP variables are listed only in the OTP sending fields and in these variables the Add functions row is not displayed.
• Since the %OS and %JA3_FINGERPRINT variables do not have a label in the interface dictionary, they appear in the list with these keys. The RDP çerezi label appears in Turkish in the English interface as well.
• A part of the variable definitions is hidden in the interface and is not offered in the list; this page covers only the ones that are offered.
• In the text written into the argument field, the space, comma, parenthesis, percent, quotation mark and line-end characters are converted to other characters while they are being saved and are converted back while they are being shown in the field; their meaning does not change.