MDI Alert Correlation with MDE

I get a lot of SAM-R Alerts on from my Quires on my Honeytoken from Devices. I can't tell what application is making the query from the devices. This might be expected but how do I get the details from MSD4End that I can correlate with the MD4I alert? Are there any ways to get visibility into this endpoint?