Enriching an internal IP address will depend on what SOAR integrations you have available. If you don't have an integration available that can enrich an internal IP address, then you can create a custom integration that could lookup the host information.

@dlove40 

Thank you for the reply, I am new to the SOAR and not sure how to build custom integration.

If there is any in build tools or integration which can ping or do an nslookup or run command through terminal please share some information or documentation on it.

Are there any repo avaiable for custom integration which users has created and can share among others.

Regards,

Laxmikant

@Laxmikant_Nagar 

You can use action DNS Lookup from Tools Power Up from the Marketplace:

However, since it is internal IP, meaning you wouldn't have access to it from SOAR, you would need to use Remote Agent in the same network where you have DNS server and run action through Remote Agent.

Documentation links:

I do this with the CrowdStrike integration. But you should also be able to do it with the UDM, but without knowing what your logs sources are it is hard to say. 

If you can figure out the query in the SIEM with your log sources  to return the data that you want, it would be easy to use a playbook to pull that info in.