Which Controller? Which Firmware?
How closely did you look at the AuditValue attribute? It can be configured to only look at "Online Edits" modifications, if you so wish.
The "ChangesToDetect" attribute was added in version 20 which allows you to configure the 64-bit Mask value for the AuditValue attribute. You can SSV or MSG a change to the Mask value, or you can "Configure" it on the "Security" tab under Controller properties.
Each bit, within the 64-bit Mask, is assigned to a particular event. Bit "1" is assigned to "Online edits modified controller program". Any bit value set to "1" in the Mask will have its corresponding event monitored for changes and update the AuditValue. Any bit value set to "2" in the Mask will ignore its event and not update the AuditValue.
If you only want to monitor Online Edits changes then you could just enable bit "1", disable all others, and then monitor the AuditValue.
The only thing that I'm not sure of, and you'd have to test, is whether the AuditValue changes when there are pending Online Edits, such as Assembled or Untested, or does it only change once the Online Edits are Accepted?
As the description of bit "1" in the Mask is "Online edits modified controller program" it would suggest to me the latter.
This might not be what you are looking for, but it's the closest I can get you.
Regards,
George