The attacker MAC address is not included in the logs generated from Screen Options.

The request is getting the MAC address of the attacker in the logs from Screen Options, this is with the purpose to detect the attacker in case of any spoofing attack.

The MAC address is not part of the fields in the logs from Screen Options, neither this is part of the fields from the Security Logs.

Information Provided in Session Log Entries for SRX Series Services Gateways

https://www.juniper.net/documentation/us/en/software/junos/flow-packet-processing/topics/topic-map/security-flow-session-and-error-handling.html#id-information-provided-in-session-log-entries-for-srx-series-services-gateways

You can refer to the outputs from an SRX4200 saving the logs locally with ICMP Screen Options.

root@SRX4200-lab> show log traffic-screens

Jul 3 12:11:32 SRX4200-lab RT_IDS: RT_SCREEN_ICMP: ICMP flood! source: 172.2.2.1, destination: 172.2.2.2, zone name: PORT-6, interface name: xe-0/0/6.0, action: drop

Jul 3 12:11:33 SRX4200-lab RT_IDS: RT_SCREEN_ICMP: ICMP flood! source: 172.2.2.1, destination: 172.2.2.2, zone name: PORT-6, interface name: xe-0/0/6.0, action: drop

root@SRX4200-lab> help syslog RT_SCREEN_IP

Name:     RT_SCREEN_IP

Message:    <attack-name> source: <source-address>, destination:

        <destination-address>, protocol-id: <protocol-id>, zone name:

        <source-zone-name>, interface name: <interface-name>, action:

        <action>

Help:     IP attack

Description:  IP attack category

Type:     Event: This message reports an event, not an error

Severity:   error

Facility:   LOG_USER