The IntrusionProtection_SubnetReport object is the container that holds the SoftLayer_Container_Network_IntrusionProtection_Event objects for a particular subnet, or "All Subnets", whatever the case may be. Subnet, subnet mask, direction, and the individual events are returned by this object.
cidr for this report. If the subnetIpAddress is "All Subnets", this is set to 32 and should be ignored.
Direction of the attack, either 'Inbound' or 'Outbound'
The class SoftLayer_Container_Network_IntrusionProtection_Event objects on this report.
The "target" of this report, could be an IP address, a subnet's network identifier, or "All Subnets"