I'm very interested in your request, and would love it if you could you elaborate more.
In the meantime, let me outline what our goals were/are in the ISE 2.2 release: I beleive you already understand the goal is to share identities from ISE (passive or active), and passive identities only with ISE-PIC. That means the username and ip address are the key items to share, but also reaching into the ID Source and grabbing other important attributes like UPN, Group Membership, GUID, etc.
Syslog sources are there to provide those username & IP-Mappings. IP address management (IPAM) syslogs are a little special. We use the IPAM syslogs to learn MAC addresses for L2/L3 binding. We also use it to ensure fidelity of the information in the session directory. If a DHCP lease has expired, clean up the session. If the IP Address is assigned to a new host, clean up the session, etc. etc.
The only information from a Syslog that gets merged into the pxGrid topic that SteathWatch is consuming is the username, mac address & ip address. Hostname was never one of the items identified for passive ID sharing; unless that was the credential used (ie.: machine auth). In which case we will be sending a flag "WasMachineAuthenticated" to show that it is a machines (a computer) credential. The BETA version does not include that yet, it is still to be released, but will ship before FCS.
Sharing contextual information, like 'hostname' is something we do share with full ISE. I.e.: Plus licensing w/ profiling, etc.. That's because it would fall under a heading of "context", and not passive Identity. However, I'm not sure yet which fields are consumed by SW - exactly - and I will check on that. With that said, here's another caveat, we aren't consuming hostname from Syslogs, we consume it via DHCP SPAN, DNS probe, even the Active Directory Probe.
Looking forward to learning more about your use case.
-Aaron
