groups:
  - id: source
    prefix: source
    type: attribute_group
    brief: These attributes may be used to describe the sender of a network exchange/packet. These should be used
      when there is no client/server relationship between the two sides, or when that relationship is unknown.
      This covers low-level network interactions (e.g. packet tracing) where you don't know if
      there was a connection or which side initiated it.
      This also covers unidirectional UDP flows and peer-to-peer communication where the
      "user-facing" surface of the protocol / API does not expose a clear notion of client and server.
    attributes:
      - id: domain
        type: string
        brief: The domain name of the source system.
        examples: ['foo.example.com']
        note: This value may be a host name, a fully qualified domain name, or another host naming format.
      - id: address
        type: string
        brief: 'Source address, for example IP address or Unix socket name.'
        examples: ['10.5.3.2']
      - id: port
        type: int
        brief: 'Source port number'
        examples: [3389, 2888]