Nicole,
Right now I have the following in this template:
System: $info
At $date
From: $DetectionIP
Source: $source
Destination: $dest
When the alert kicks of I'm getting the domain controller name from the $DetectionIP and from the $Source (same information). The destination information is usually blank. The $info does populate with the proper domain and account that was locked.
~Steve