Access monitoring (login events, suspicious activity detection)

[OrezBodajoy]

I want to monitor access to my cloudron instance: login events and things like that.
I also want to sometimes clean up all the currently valid credentials and check that there are no unexpected logons after that.

I know that the event log has some lines in the ui related to logons but that's not practical enough for this use case.

Any suggestions?