Sanitizing environmental variables
Because Correlation Actions are often used with batch files, the values of environmental variables are made Windows Batch File Safe, by substituting or removing troublesome characters from the S_MESSAGE, and other variables. This behavior can be changed by setting Sanitize Environmental Variables = No on the Edit Correlation Action Screen (towards the bottom of the screen.)
By default, environmental variables are sanitized. However, if the user is executing another script interpreter (such as Python or Perl or PHP,) it is not necessary to sanitize the values. In this case, the Sanitize Environmental Variables setting can be set to No. However,
Related topic
Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*