We’ve recently noticed that more interesting events are easily identifiable by their user/event ratio.
The alert would have to have some kind of temporal element.
Point is, when we have 70 users generating 4.2 million events, it almost always points to a very elusive problem, so it would be nice to have an alert for a specific ratio maintained over a specific time.