Check out the optional Identity Awareness Agent software that can be loaded on problematic systems in your network that are roaming around or have local user switching situations, there is no way to detect these types of events purely from the network and software is required on the workstation to help out:
sk63920: Identity Awareness Agent for Mac OS X
sk107415: Check Point Identity Agent for Microsoft Windows 10
sk88520: Best Practices - Identity Awareness Large Scale Deployment
--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com
Attend my 60-minute "Be your Own TAC: Part Deux" Presentation
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm