[pragmacoders]

Alright - Bad example. Nice SQL query!

Can we then take that raw event data, like this query, and identify users with anomalous usage patterns, automatically alerting administrators of odd activity in a timely manner?

Your answer might be "Yes". If so, I applaud your ingenuity and Redshift's ability to process data in a timely manner. It's pretty awesome, I admit!

But I believe that the best way to answer these kind of questions is to track behavioral analytics in a format that is easier to think about and easy to analyze.

Events are too deep in the weeds, I think. I may be wrong about that - But the tools I build with this will either speak for themselves or fall by the wayside as a failed experiment in history!