It would also be cool to be able to monitor if particular tracking codes in URLs have been accessed.

Generally this is useful for sales & marketing, more than security IMO.

I'm not sure what "Also add them to a watch list for admin review" means. What are 'review' and 'watch list' exactly?

I was thinking having a button to add the offending IP to a watch list or banned list maybe to be incorporated into a side box showing that they are being banned or watched much like the Users Online does? Seems as I run Composr as a semi closed site where only people I invite are made members, UK/Russia/China are trying to log in using fake names and trying to bring up the guest book mod to post URLs which I don't have active. When looking at the referrers they all point to russian sites and porn. AKA being able to quickly ban them after review would be sweet however some are legit so the option to track a set of specific IPs in a list makes security watch more efficient.

"Review or Watch list" a list of actions performed for both admins and staff to see and a foot note of who placed the watch and why to let staff know what they need to monitor. A email could be sent when the IP on the list is present and when its seen entering the site so admins/staff no to go to the site for quick action. Since email gets sms to my cell I could remotely get into the site , review and ban immediately upon notice. Without losing valuable time research all the logs.