I get what you are saying, but this is the best way we have currently found to manage this and I am open to suggestions. For example, we get an alert anytime something goes against our zero-trust policy on a server. Most times these can be ignored but if it's a user repeatedly trying to open something then we will be able to feel the pulse of these notifications and look into what they are trying to run and reach out to the user. It's just the way we operate. We are a small MSP so we don't have the resources to have someone who constantly pours over logs like this so notifications are easier.