Below is a list of parameters that can be used to configure EW notifications:
{NEW_LINE} - new line
{AUDIT_TIME} - time the EW violation received and was sent to auditing
{MESSAGE_TYPE} - operation that was blocked: Chat, Audio, Video, FileSharing, Conference, PresentDesktop, etc.
{FROM_USER} - user that initiated the operation that was blocked
{TO_USER} - user/users that were the recipients of the blocked operation
{TEAM} - name of conversation that was received by Webhook. For Webex the value always will be “call”, for Teams the value will be the team name.
{POLICY} - name of violated EW policy