Hi,
I have read this a few times and trying to get the gist of what is being achieved. If you are placing the system name in the user defined group, this is what you are tracking. Is this source machine a host name of a device on your network, or a name which is resolved via a DNS lookup query?
Also you have the explore menu in nDepth, which allows you to attempt to trace the source machine. If the answer to the above is "yes", give the below a try.
