Value,Description,Reference
client,Client computer.,[RFC7970]
client-enterprise,"Client computer on the enterprise
        network.",[RFC7970]
client-partner,Client computer on network of a partner.,[RFC7970]
client-remote,"Client computer remotely connected to the
        enterprise network.",[RFC7970]
client-kiosk,Client computer serving as a kiosk.,[RFC7970]
client-mobile,Mobile device.,[RFC7970]
server-internal,Server with internal services.,[RFC7970]
server-public,Server with public services.,[RFC7970]
www,WWW server.,[RFC7970]
mail,Mail server.,[RFC7970]
webmail,Web mail server.,[RFC7970]
messaging,"Messaging server (e.g., NNTP, IRC, IM).",[RFC7970]
streaming,Streaming-media server.,[RFC7970]
voice,"Voice server (e.g., SIP, H.323).",[RFC7970]
file,File server.,[RFC7970]
ftp,FTP server.,[RFC7970]
p2p,Peer-to-peer node.,[RFC7970]
name,"Name server (e.g., DNS, WINS).",[RFC7970]
directory,"Directory server (e.g., LDAP, finger, whois).",[RFC7970]
credential,"Credential server (e.g., domain controller,
        Kerberos).",[RFC7970]
print,Print server.,[RFC7970]
application,Application server.,[RFC7970]
database,Database server.,[RFC7970]
backup,Backup server.,[RFC7970]
dhcp,DHCP server.,[RFC7970]
assessment,"Assessment server (e.g., vulnerability scanner,
        endpoint assessment).",[RFC7970]
source-control,Source code control server.,[RFC7970]
config-management,Configuration management server.,[RFC7970]
monitoring,"Security monitoring server (e.g., IDS).",[RFC7970]
infra,"Infrastructure server (e.g., router, firewall, DHCP).",[RFC7970]
infra-firewall,Firewall.,[RFC7970]
infra-router,Router.,[RFC7970]
infra-switch,Switch.,[RFC7970]
camera,Camera and video system.,[RFC7970]
proxy,Proxy server.,[RFC7970]
remote-access,Remote access server.,[RFC7970]
log,"Log server (e.g., syslog).",[RFC7970]
virtualization,Server running virtual machines.,[RFC7970]
pos,Point-of-sale device.,[RFC7970]
scada,"Supervisory control and data acquisition (SCADA)
        system.",[RFC7970]
scada-supervisory,Supervisory system for a SCADA.,[RFC7970]
sinkhole,Traffic sinkhole destination.,[RFC7970]
honeypot,Honeypot server.,[RFC7970]
anonymization,"Anonymization server (e.g., Tor node).",[RFC7970]
c2-server,Malicious command and control server.,[RFC7970]
malware-distribution,Server that distributes malware.,[RFC7970]
drop-server,"Server to which exfiltrated content is
        uploaded.",[RFC7970]
hop-point,Intermediary server used to get to a victim.,[RFC7970]
reflector,A system used in a reflector attack.,[RFC7970]
phishing-site,Site hosting phishing content.,[RFC7970]
spear-phishing-site,Site hosting spear-phishing content.,[RFC7970]
recruiting-site,Site to recruit.,[RFC7970]
fraudulent-site,Fraudulent site.,[RFC7970]
ext-value,"A value used to indicate that this attribute is
        extended and the actual value is provided using the
        corresponding ext-* attribute.  See Section 5.1.1 of [RFC7970].",[RFC7970]