Fortigate automation - adding a IPS attacker IP to a deny rule from IPS-Logs using X-Forwarded-for

Hi all,

Our infrastructure is not directly connected to internet and most of the web traffic is coming from the reverse proxy IP of our ISP.
We want to use Fortigate automation to create an address object of the attacker and put it into a group that will be denied in a policy rule. This based on IPS-Logs. 

With the ip address of the attacker, we also want to automate the creation of a custom ips signature based on the X-Forwarded-for field we are seeing in the IPS logs.
Working with %%srcip%% in the CLI script is working but of course, this gives us the IP of the reverse proxy, not the real IP of the attacker on the Internet. So not possible to block all traffic from the RP of our ISP.

Is it a way to use the x-forwarded-for IP in a CLI_script in Fortigate automation ?

Thanks in advance 
Regards

Frédéric