Source filters for user names

[jjxtra]

Any possible way to blacklist/whitelist specific usernames for specific services? in the Blacklist if I could, say, match a username (or IP) with a Source, that'd be helpful to ignore some usernames that I need for some things internally but will never be used for a specific source (ex. RRAS / RDP, etc.) so if I could, say, use something like

<add key="Blacklist" value="source=RRAS(administrator, guest, root), source=RDP(admin, administrator, guest, root), source=SSH(administrator, admin, guest, root)"/>

Need to figure out the best way to do this. Would log file entries or event viewer entries be a better home?