This OCTET STRING is the fifteenth and last of the event-specific variable slots on a Windows event trap, the final position in the extended set that the MIB says only fuller event variants like Windows Server 2003's 16-variable logon-failure event populate, while XP's shorter 11-variable version leaves it unused. It marks the outer limit of how much event-specific data a single evntagent trap can carry. On a Server 2003 logon-failure trap this field might hold the source network address of the failed logon attempt.