Skip to main content
Skip table of contents

DIP/DestinationIP/Impacted IP

The host IP that was affected by the activity (for example, target or server). Destination IP in IPv4 or IPv6 format.

Data Type




Client Console Full Name

Host (Impacted)

Client Console Short Name

Not applicable

Web Console Tab/Name

Host (Impacted)

Elasticsearch Field Name


Rule Builder Column Name


Regex Pattern


NetMon Name

Not applicable

Field Relationships

  • SIP
  • SIPv4
  • SIPv6
  • SIPv6E
  • Origin Hostname
  • Origin Hostname or IP
  • Origin NAT IP
  • DIPv4
  • DIPv6
  • DIPv6E
  • Impacted Hostname
  • Impacted Hostname or IP
  • Impacted NAT IP
  • Origin Port
  • Origin NAT Port
  • Impacted Port
  • Impacted NAT Port
  • Origin MAC Address
  • Impacted MAC Address
  • Origin Interface
  • Impacted Interface
  • Origin Domain
  • Impacted Domain
  • Origin Login
  • Impacted Account
  • IANA Protocol Number
  • IANA Protocol Name

Common Applications

Networked equipment

Use Case

Host context

MPE/Data Masking Manipulations

Polyfield – Impacted Host

Usage Standards

  • Do not override/overload, use <dip> not (?<dip>.*?).
  • Impacted is server (In Client-Server Model).
  • Impacted is Target (In Attacker-Target Model).
  • Use when you see an Impacted IP address IPv4 or IPv6, unless it is an IPv4 address mapped to IPv6, in which case use <dipv6e>.


  • FireEye Web MPS

02 01 2016 17:13:19 <LOC4:WARN> fenotify-609081.warning: CEF:0|FireEye|MPS||IM|infection-match|1|rt=Feb 01 2016 23:13:10 UTC src= cn3Label=cncPort cn3=80 cn2Label=sid cn2=84575103 shost= USABLDRRECFLOW01proto=tcp spt=51997 dst= cs5Label=cncHost cs5= dvchost=romaslcmp01 dvc= smac=00:00:00:00:00:00 cn1Label=vlan cn1=0 dpt=80 externalId=609081 cs4Label=link cs4=THINGS dmac=00:00:00:00:00:00 cs1Label=sname cs1=Exploit.Kit.AnglerDIPv4

Src= in this instance is the host IP impacted by the infection match described in the log. (Attacker-Target). Dst= is the command and control server and therefore the closest Origin (attacker) to be inferred from the log.

  • Brocade Switch

03 01 2017 02:08:41 <LOC6:NOTE> Mar  1 02:08:38 USABLDRRECFLOW01dataplane[2287]: fw rule INTERNAL-IN:10000 block udp(17) src= USABLDRRECFLOW01/0:00:00:0a:ea:e8/fe80::e0c0:f0f0:e00c:2029(546) dst=/22:22:2:1:0:2/ff22::2:2(547) len=159 hoplimit=1 len=119

Dst= IPv6 address following the MAC ID. Network context showing direction src->dst.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.