We would like to see the ability to trigger at user login (or failed login attempt). This should include the external IP address that the user authenticated from, along with the user name. If there's anyway to pull in where the external IP originates from that's always helpful.
Being able to configure (separately) if you want a Login Successful / Login Failed / Accounted Locked Out on a user would be good to know if someone is accessing / trying to hack into the in-build Administrator account.
Or if the Service account for say ConnectWise Automate gets locked out which will break the integration etc.
Partner requests to be notified by email when a user logs in.