I had the same problem when first setting up email alerts.
In the Rule, under the email template, there are boxes next to the variables. You need to go to the Events or Event Groups and the drag the field you want to use for the variable.
For example, if you wanted to know the $User that failed to login, you could drag the UserLogonFailure.DestinationAccount over to the variable window.
Save and activate the rule.