Access policy branch for Subdomain?

It's by no means exhaustive, but this is a good start: https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-config-11-4-0/apm_config_sessionvars.html

It also doesn't include session.service.network.name. Typically the best thing to do is to allow traffic to flow once or twice to set up an active session, then go to access session reports and look at the list of populated session variables there.