diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/message_variables.test.ts b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/message_variables.test.ts
index 3fa9c7342c507..fdf17f1814127 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/message_variables.test.ts
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/message_variables.test.ts
@@ -15,49 +15,82 @@ describe('getMessageVariables', () => {
   it('should return `context.attack.alertIds` action variable', () => {
     const variables = getMessageVariables().context;
     expect(variables).toEqual(
-      expect.arrayContaining([expect.objectContaining({ name: 'attack.alertIds' })])
+      expect.arrayContaining([{ description: expect.anything(), name: 'attack.alertIds' }])
     );
   });
 
   it('should return `context.attack.detailsMarkdown` action variable', () => {
     const variables = getMessageVariables().context;
     expect(variables).toEqual(
-      expect.arrayContaining([expect.objectContaining({ name: 'attack.detailsMarkdown' })])
+      expect.arrayContaining([
+        {
+          description: expect.anything(),
+          name: 'attack.detailsMarkdown',
+          useWithTripleBracesInTemplates: true,
+        },
+      ])
     );
   });
 
   it('should return `context.attack.summaryMarkdown` action variable', () => {
     const variables = getMessageVariables().context;
     expect(variables).toEqual(
-      expect.arrayContaining([expect.objectContaining({ name: 'attack.summaryMarkdown' })])
+      expect.arrayContaining([
+        {
+          description: expect.anything(),
+          name: 'attack.summaryMarkdown',
+          useWithTripleBracesInTemplates: true,
+        },
+      ])
     );
   });
 
   it('should return `context.attack.title` action variable', () => {
     const variables = getMessageVariables().context;
     expect(variables).toEqual(
-      expect.arrayContaining([expect.objectContaining({ name: 'attack.title' })])
+      expect.arrayContaining([{ description: expect.anything(), name: 'attack.title' }])
     );
   });
 
   it('should return `context.attack.timestamp` action variable', () => {
     const variables = getMessageVariables().context;
     expect(variables).toEqual(
-      expect.arrayContaining([expect.objectContaining({ name: 'attack.timestamp' })])
+      expect.arrayContaining([{ description: expect.anything(), name: 'attack.timestamp' }])
     );
   });
 
   it('should return `context.attack.entitySummaryMarkdown` action variable', () => {
     const variables = getMessageVariables().context;
     expect(variables).toEqual(
-      expect.arrayContaining([expect.objectContaining({ name: 'attack.entitySummaryMarkdown' })])
+      expect.arrayContaining([
+        {
+          description: expect.anything(),
+          name: 'attack.entitySummaryMarkdown',
+          useWithTripleBracesInTemplates: true,
+        },
+      ])
     );
   });
 
   it('should return `context.attack.mitreAttackTactics` action variable', () => {
     const variables = getMessageVariables().context;
     expect(variables).toEqual(
-      expect.arrayContaining([expect.objectContaining({ name: 'attack.mitreAttackTactics' })])
+      expect.arrayContaining([
+        { description: expect.anything(), name: 'attack.mitreAttackTactics' },
+      ])
+    );
+  });
+
+  it('should return `context.attack.detailsUrl` action variable', () => {
+    const variables = getMessageVariables().context;
+    expect(variables).toEqual(
+      expect.arrayContaining([
+        {
+          description: expect.anything(),
+          name: 'attack.detailsUrl',
+          useWithTripleBracesInTemplates: true,
+        },
+      ])
     );
   });
 });
diff --git a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/message_variables.ts b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/message_variables.ts
index 5da682eb5dd24..6b6bef736ed97 100644
--- a/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/message_variables.ts
+++ b/x-pack/solutions/security/plugins/security_solution/public/attack_discovery/pages/settings_flyout/schedule/edit_form/message_variables.ts
@@ -31,6 +31,7 @@ export const getMessageVariables = (): ActionVariables => {
               'Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data',
           }
         ),
+        useWithTripleBracesInTemplates: true,
       },
       {
         name: 'attack.summaryMarkdown',
@@ -40,6 +41,7 @@ export const getMessageVariables = (): ActionVariables => {
             defaultMessage: 'A markdown summary of attack discovery, using the same syntax',
           }
         ),
+        useWithTripleBracesInTemplates: true,
       },
       {
         name: 'attack.title',
@@ -68,6 +70,7 @@ export const getMessageVariables = (): ActionVariables => {
               'A short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax',
           }
         ),
+        useWithTripleBracesInTemplates: true,
       },
       {
         name: 'attack.mitreAttackTactics',
@@ -86,6 +89,7 @@ export const getMessageVariables = (): ActionVariables => {
             defaultMessage: 'A link to the attack discovery details',
           }
         ),
+        useWithTripleBracesInTemplates: true,
       },
     ],
   };