This is frustrating and comes from the overall login failure rule logic. If you open a specific offense, then on top menu choose Display, then Rules it will show what rules were part of the office. You may find other events from other rules, but these are the prime ones. Even for Chained offenses, it is best to start with the original offense. You are being distracted by the event that is generated when the rule fires. Those are often needed, for additional logic, reports, etc. But they have little bearing on the offense itself (unless added to the logic).
Use Case Manager great, but the old fashioned interface to the offense works better for this.