I'm not a CIM expert, but it seems like CIM doc defines Web.dest field as
The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.
This IMO allows mapping dest_ip as dest (which is what Stream TA does), although to your point for http traffic the FQDN seems like a better alternative. I believe you can easily tune it by dropping a couple of props/transforms.conf stanzas that alias stream's http site field as dest on your SH.
... View more