The simplest approach I can think of is forwarding the alert as syslog
to a decoder and including, for example, the username, ip.source and
device.id in the syslog template.You will then be able to report on the
alert meta while including the usernam...
