Defender audit logging and IP lockouts for multisite

When my multisite get IP lockouts or while checking audit loggins it doesn't show on which sites in the multiste these actions happen. Can you improve this information with more info for multisite?