Hi @schluckie you can check using a query like the one below and just change the ip address to match your conventions, or remove it entirely. SELECT event_time, user_identity.email, source_ip_address, action_name, response.status_code
FROM system.acc...
