Sagan feature : Store data from after.

[quadrantsec]

When a user hits an "after", store call events or maybe just normalization data (?). This way when the SOC gets a request of "what usernames are bring brute forces", a list can be provides.