The present disclosure is directed to a system, method, and computer program for tracking user activity during a logon session, including tracking device access and any user account switches during the logon session. In response to receiving an event log for an IT event in the network, the system determines whether to filter the event, associate the event with an existing user logon session, or associate the event with a new user logon session. The system executes one or more rules to determine whether an event represents a user account switch or the continued use of an account by a user currently logged onto the network. If so, the event is associated with an existing logon session. If not, the system determines whether the event satisfies criteria for a new user logon session.