I want to be able to generate a monthly report that shows the logon activity for a specific set of users. I have a list of the users and I am collecting logon events. is there any way I can do that within ESM or do I have to pull out the logon events and write some scripts to filter the list?
Look at putting the users in a Watchlist and then filtering the report based on the contents of that watchlist.
If the events are from different types of sources you may need to cope with the usernames for a single individual being in different formats and case sensitivity may also be something you have to cope with.