Shared user account (Break Glass Account)

[aponjos613]

I would like to figure out a way to get an email when certain user logs in into Trellix ePolicy Orchestrator 

In our organization every administrator has his own account using certificate-based authentication. The admin account still enabled and is used for any break glass situation.

[cdinet]

The only automatic response available for logins are failed ones.  You could create a query for audit log events and filter it for any logon attempt for any specific user or users you want to monitor, then create a server task to email you that report daily.  It wouldn't be something that would alert you the moment that user logs in, but it would show if there was a login or not by that account.