We have some UIM alarms that are listed with the hostname as the source and other are listed as IP.
Version: DX UIM version 20.4 or higher
Only mcs related or rather, alarms that are part of an Alarm Policy would be listed with the hostname in the source.
Alarms that come natively from a probe will be listed with the IP as the source.
For instance, a boot alarm is an alarm that comes from the cdm probe directly and is not part of an alarm policy, so that alarm will be listed with IP as the source, regardless of if you are using mcs profiles for cdm on that same system.