This is the specific MAC address that triggered a MAC-security trap, such as exceeding a port's learning limit or appearing on an unauthorized port. An admin uses this value to identify exactly which device caused the security event, for example to track down a rogue device or a misconfigured static MAC binding. For example, this field might report the MAC of a laptop that was detected on a locked port where it isn't statically authorized.