Connecting users to security events - thoughts?

Hi,

I'm building UserGlass (https://www.userglass.com/), and would love some feedback on the idea. It's a security platform that monitors malicious security events, and account login events. I found connecting malicious actors to accounts difficult, and UserGlass is here to solve that. You start using UserGlass by installing our package into your application, and sending us information when users try to login. Our middleware then checks all requests, and if they're malicious. Once malicious requests have been blocked, they're shipped off to us and we associate them to the respective accounts for you to investigate.

Compared to existing WAF solutions, we're taking a different approach to check user requests on your server. What are your thoughts on this?

Do you see this being valuable to your platform?

I'd appreciate any feedback!

Thanks