Machine IP and Username Values from Endpoint Incident to SYSLOG
I have been looking around and do not see a way to send some important information from an endpoint incident via a syslog action in a response rule, namely the "Machine IP" and "User" fields. There are a number of correlations I would like to setup in my SIEM based on these values, but I cannot find how to get them as part of the syslog message.
My current syslog message looks like this:
ENDPOINT $BLOCKED$, ENDPOINTMACHINE=$ENDPOINT_MACHINE$, FILENAME=$FILE_NAME$, FULLFILEPATH=$PATH$, INCIDENTID=$INCIDENT_ID$, MATCHCOUNT=$MATCH_COUNT$, POLICYNAME=$RULES$,
Does anyone have any idea's how this can be accomplished?