Origin Hostname or IP
The hostname or IP from which activity originated (for example, attacker or client).
Data Type
- String
- IP
Aliases
| Use | Alias |
|---|---|
Client Console Full Name | Host (Origin) |
Client Console Short Name | Not applicable |
Web Console Tab/Name | Host (Origin) |
Elasticsearch Field Name | originName, originIp |
Rule Builder Column Name | SIP, SName |
Regex Pattern | (<sipn>) |
NetMon Name | Not applicable |
Field Relationships
- SIP
- SIPv4
- SIPv6
- SIPv6E
- Origin Hostname
- Origin NAT IP
- DIP
- DIPv4
- DIPv6
- DIPv6E
- Impacted Hostname
- Impacted Hostname or IP
- Impacted NAT IP
- Origin Port
- Origin NAT Port
- Impacted Port
- Impacted NAT Port
- Origin MAC Address
- Impacted MAC Address
- Origin Interface
- Impacted Interface
- Origin Domain
- Impacted Domain
- Origin Login
- Impacted Account
- IANA Protocol Number
- IANA Protocol Name
Common Applications
See IP Address (Origin) and Origin Hostname.
Use Case
See IP Address (Origin) and Origin Hostname.
MPE/Data Masking Manipulations
See IP Address (Origin) and Origin Hostname.
Usage Standards
- Use when a log can contain either an IP or a hostname in the same location.
- Must be wrapped in parenthesis to function (<sipn>).
- Do not overload or override.
Examples
- Windows Event Log
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Time-Service' Guid='{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}'/><EventID>37</EventID><Version>0</Version><Level>Information</Level><Task>None</Task><Opcode>Info</Opcode><Keywords></Keywords><TimeCreated SystemTime='2016-08-02T19:21:10.521541000Z'/><EventRecordID>5823536</EventRecordID><Correlation/><Execution ProcessID='968' ThreadID='6580'/><Channel>System</Channel><Computer> USABLDRRECFLOW01</Computer><Security UserID='NT AUTHORITY\LOCAL SERVICE'/></System><EventData Name='TMP_EVENT_TIME_SOURCE_REACHABLE'><Data Name='TimeSource'> USABLDRRECFLOW01 (ntp.d|1.1.1.1:123->1.1.1.1:123)</Data></EventData></Event><Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Time-Service' Guid='{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}'/><EventID>37</EventID><Version>0</Version><Level>Information</Level><Task>None</Task><Opcode>Info</Opcode><Keywords></Keywords><TimeCreated SystemTime='2016-09-10T02:47:47.934071900Z'/><EventRecordID>534913</EventRecordID><Correlation/><Execution ProcessID='1008' ThreadID='7908'/><Channel>System</Channel><Computer> USABLDRRECFLOW01</Computer><Security UserID='NT AUTHORITY\LOCAL SERVICE'/></System><EventData Name='TMP_EVENT_TIME_SOURCE_REACHABLE'><Data Name='TimeSource'>1.1.1.1,0x8 (ntp.m|0x8|1.1.1.1:123->1.1.1.1:123)</Data></EventData></Event>
TimeSource can either be an IP or a hostname in these examples.