Identifying originator of malicious traffic?

We are seeing undesirable traffic passing through our FirePass, how can we identify the client responsible for the traffic?