Well put. I think that anything I personally do while logged into a database when viewed from any higher level going to look anomalous.

That said, I wonder if what’s going on here is that the admin account was never supposed to be used directly, so that’s why the alert triggered.