Best way to handle logs from client sites you do not control?

MSP problem. Client owns the firewall, we monitor it, they occasionally change things without telling us. Half our alerts are their changes. How do others handle the boundary?