Origin Hostname or IP

The hostname or IP from which activity originated (for example, attacker or client).

Data Type

• String

• IP

Aliases

Field Relationships

Common Applications

See IP Address (Origin) and Origin Hostname.

Use Case

See IP Address (Origin) and Origin Hostname.

MPE/Data Masking Manipulations

See IP Address (Origin) and Origin Hostname.

Usage Standards

• Use when a log can contain either an IP or a hostname in the same location.

• Must be wrapped in parenthesis to function (<sipn>).

• Do not overload or override.

Examples

• Windows Event Log

  • <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Time-Service' Guid='{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}'/><EventID>37</EventID><Version>0</Version><Level>Information</Level><Task>None</Task><Opcode>Info</Opcode><Keywords></Keywords><TimeCreated SystemTime='2016-08-02T19:21:10.521541000Z'/><EventRecordID>5823536</EventRecordID><Correlation/><Execution ProcessID='968' ThreadID='6580'/><Channel>System</Channel><Computer> USABLDRRECFLOW01</Computer><Security UserID='NT AUTHORITY\LOCAL SERVICE'/></System><EventData Name='TMP_EVENT_TIME_SOURCE_REACHABLE'><Data Name='TimeSource'> USABLDRRECFLOW01 (ntp.d|1.1.1.1:123->1.1.1.1:123)</Data></EventData></Event>

  • <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Time-Service' Guid='{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}'/><EventID>37</EventID><Version>0</Version><Level>Information</Level><Task>None</Task><Opcode>Info</Opcode><Keywords></Keywords><TimeCreated SystemTime='2016-09-10T02:47:47.934071900Z'/><EventRecordID>534913</EventRecordID><Correlation/><Execution ProcessID='1008' ThreadID='7908'/><Channel>System</Channel><Computer> USABLDRRECFLOW01</Computer><Security UserID='NT AUTHORITY\LOCAL SERVICE'/></System><EventData Name='TMP_EVENT_TIME_SOURCE_REACHABLE'><Data Name='TimeSource'>1.1.1.1,0x8 (ntp.m|0x8|1.1.1.1:123->1.1.1.1:123)</Data></EventData></Event>