Origin Hostname or IP

The hostname or IP from which activity originated (for example, attacker or client).

Data Type

• String

• IP

Aliases

Field Relationships

• SIP

• SIPv4

• SIPv6

• SIPv6E

• Origin Hostname

• Origin NAT IP

• DIP

• DIPv4

• DIPv6

• DIPv6E

• Impacted Hostname

• Impacted Hostname or IP

• Impacted NAT IP

• Origin Port

• Origin NAT Port

• Impacted Port

• Impacted NAT Port

• Origin MAC Address

• Impacted MAC Address

• Origin Interface

• Impacted Interface

• Origin Domain

• Impacted Domain

• Origin Login

• Impacted Account

• IANA Protocol Number

• IANA Protocol Name

Common Applications

See IP Address (Origin) and Origin Hostname.

Use Case

See IP Address (Origin) and Origin Hostname.

MPE/Data Masking Manipulations

See IP Address (Origin) and Origin Hostname.

Usage Standards

• Use when a log can contain either an IP or a hostname in the same location.

• Must be wrapped in parenthesis to function (<sipn>).

• Do not overload or override.

Examples

• Windows Event Log

  • <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Time-Service' Guid='{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}'/><EventID>37</EventID><Version>0</Version><Level>Information</Level><Task>None</Task><Opcode>Info</Opcode><Keywords></Keywords><TimeCreated SystemTime='2016-08-02T19:21:10.521541000Z'/><EventRecordID>5823536</EventRecordID><Correlation/><Execution ProcessID='968' ThreadID='6580'/><Channel>System</Channel><Computer> USABLDRRECFLOW01</Computer><Security UserID='NT AUTHORITY\LOCAL SERVICE'/></System><EventData Name='TMP_EVENT_TIME_SOURCE_REACHABLE'><Data Name='TimeSource'> USABLDRRECFLOW01 (ntp.d|1.1.1.1:123->1.1.1.1:123)</Data></EventData></Event>

  • <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Time-Service' Guid='{06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb}'/><EventID>37</EventID><Version>0</Version><Level>Information</Level><Task>None</Task><Opcode>Info</Opcode><Keywords></Keywords><TimeCreated SystemTime='2016-09-10T02:47:47.934071900Z'/><EventRecordID>534913</EventRecordID><Correlation/><Execution ProcessID='1008' ThreadID='7908'/><Channel>System</Channel><Computer> USABLDRRECFLOW01</Computer><Security UserID='NT AUTHORITY\LOCAL SERVICE'/></System><EventData Name='TMP_EVENT_TIME_SOURCE_REACHABLE'><Data Name='TimeSource'>1.1.1.1,0x8 (ntp.m|0x8|1.1.1.1:123->1.1.1.1:123)</Data></EventData></Event>