Identifying the attacking hosts during an incident can be important for a number of reasons, except for:
a. Aid in enterprise-wide searches for indicators of compromise associated with the identified attacking hosts.
b. Help incident responders pivot the investigation based on identified attacking hosts.
c. Allows defenders to block external attacking hosts on the companies attack surface, or isolate internal hosts.
d. Updating the company's network diagrams.