Is there a way to get Password Spraying alert in InTrust to see devices instead of the domain controllers?

Trying to setup Password Spraying but it looks like it is only showing the IP of the Domain Controller.    Of course the domain controller is going to send this alert.  We want to catch computers trying to password spray not domain controller failed logins that feature has been available for years.