@atom have you tried looking at the user_events table? it really depends on the type of logon versus what info you get, but I’ve been able to build alerts from stuff in the user_events table around several logon types.