The "$CONTENT_NAME$" response rule variable for Endpoint Prevent for Web returns the URL of the site the file is being uploaded to.
That variable should return the name of the file being uploaded to the web.
Endpoint Prevent for Web
This is how the content name variable works and has worked since it was introduced.
A feature request has been submitted to change the variable to return the name of the file being uploaded.
If you want to be added to that feature request, open a support case requesting to be added to the FR and give the case owner this KB number.