I wouldn’t have been able to help you with this anyway, as the MAC address would not be accurate coming from outside your network. The only way using the ARP table would work is if these were PCs on your same subnet within your internal network where you are syslogging. From the sounds of it, you are referring to remote users who are connecting to your network, and at that point I’m curious exactly what you are syslogging from these users?
If it’s event logs, refer to my earlier comment about the hostname being included within the event messages, you should be able to do this with a simple rule and forget all about Mac Addresses, just use the hostname in the message text.
