This object carries the IP address, either IPv4 or IPv6, associated with the reported event; it uses OCTET STRING syntax specifically so it can hold either address family in the same field. An admin uses this address to cross-reference the affected device against DHCP leases or IPAM records when the MAC address alone isn't enough to locate it on the network. For example, this field might carry 192.168.10.55 identifying the AP or client's current network address at the time of the event.