I have created an alert that monitors what SSHs into our Linux machines and then where they su to. I have a watch list that I created to monitor certain ids and this is working perfectly. When I try to create a report so I can see everything that has connected and had successful su...it uses different tables. I am not able to get past this point. There are two seperate reports that are canned that show this but I need one that has both together so I can see the progression on what the user is doing. Any suggestions?