I might be able to answer my own question if I can find a SQL Audit filter predicate list. So I can do something like WHERE server_principal_name like etc.. Can anyone post a link? I've been googling for hours and not found a predicate list that can be used in SQL Audits.