when zone breaches occur, users are suspended or moved to other OU's.
Unfortunately there's no supported (documented) event for a zone breach yet.
are you sure its not in the new Logs API? this is probably gonna be part of the behaviour detection
It's not listed there yet, but I'll look out for it.
You won't be notified about changes to this idea.