In order to comply with new auditing standards, a security administrator must be able to correlate system security alert logs directly with the employee who triggers the alert.

Which of the following should the security administrator implement in order to meet this requirement?