Hi Peter,

It probably would be easier to use 'first access'. Because site log only shows the actions that users do. Enrollment can happen through cron and in this case there will be no 'course enrol' action in site logs.

Yuliya