Currently we give an alert in case we find expensive extended events being collected on SQL, like statement level events, wait_info etc. We are giving this warning even for Microsoft owned system events, like the system_health.

We could add an exclusion for system extended events or add a column indicating this is a system session, not one created by the user