Additional Actions in EPO from SIEM events

[itgfcsys]

Integrating ESM and ePO/DLP there are two default actions in ePO, search by Source IP or Destination IP in ePO. Is there a way to add additionally provided or available actions or do these need to be custom built, for example examining incident in DLP from the event/alert in SIEM for additional context? other intrests in actions include email to user in event from SIEM, block or evaluate from SIEM i.e. false positive based upon event details/packet.

Any hel is appreciated and will be shared

Rick