We are evaluate you product in like it but there is one thing that is confusing us. In the Default Event Reports view under Top user failed logins the information is not correct. If i i look under Tops hosts with failed logons it shows something totally different. In the Top user failed logins, events with the exact same event id are not shown. Why is it like this?