Common problem is a single user behind a NAT'ed IP in an office environment doing something wrong, and getting the IP banned-- which inadvertently blocks everyone in the office. Usually it's just something stupid, like an old password in Outlook, or similar.
I'm not finding any IDS related logs to show specifically what user account triggered an IDS block. Being able to look up the banned IP, and see specifically which user triggered it, would REALLY help in tracking down the (usually oblivious) offender. Especially when there are 50+ users behind the IP, and nobody has a clue.
I know this was requested in the past, but don't know if it ever happened, and maybe I'm just missing it.