Knowing who tripped an alarm

Alarming is fundamentally tied to tags, not client sessions. Which is why the auditing system is so useful when backtracking from alarms to potential user causes. Perhaps you should make a feature request, with specific details on how you would like it to work.

Related: