So, LEM will present what's in the log data, and I think within LEM's syslog config the hostname resolution for syslog is off because it can create performance problems. It is a syslog-ng option, though, so if you syslogged to another syslog-ng host you could have it attempt to resolve the originating IP (as long as those DNS servers are there/able to resolve).
e.g.
<date> 192.168.1.1 <message>
could become
<date> firewall.internal <message>
if then you configured LEM to watch that log, it WOULD send firewall.internal as the DetectionIP instead of 192.168.1.1.
Also worth noting here is when you correlate activity within LEM rules, it does try to do DNS resolution, so if it sees an event from firewall.internal it would know it's the same as 192.168.1.1 (as long as that resolves in the DNS server LEM has configured). It's not common that you end up correlating based on DetectionIP, but it could happen.