I set up the successful logon alert and immediately was being bombarded by alerts of SYSTEM accounts. Can we tune this to where we can specify of it's something like an Interactive login instead? Reason - We manage some servers where a corporation has access as well and we would like an audit of what actual USER is logging into the system, not when the SYSTEM or a remote file is being accessed. Why does no one implement this from the start?