IP address, network context, and VPN or proxy indicators when supplied.
Each address is resolved to its address version, network classification, autonomous system, and network organisation, so analysts can see whether activity came from a public network and which provider carried it.