We have a similar issue looking for privileged logins when we have applications that login to the servers every time the user interacts with the application. In some cases the application manages the user login and an the application uses a master login to connect to the backend or database server, so we get thousands of login events for user accounts that we aren't interested in.
↧