Just thinking out loud here, but if you have rogue system detection extension installed then all systems would show up in those tables.
So you could create an automatic response of type "detected System events/system detection" and use that.
Sorry it's late. But THANK YOU. That is exactly what I wanted.@