You have to write your own stuff. I did this at a previous organization I worked at. DBA's had our own SQL server and I scrounged up 5TB of storage for it over the years and set up a process to audit most connections and queries.
Anytime we had a problem I was able to provide an answer 90% of the time. A few times I screwed up and blocked critical apps. You win some, you lose some.
Not sure if I used this query to collect data, but it's a start for what you need.
select runtime = getdate(), server_name = @@servername, a.session_id as
exec_session_id, b.session_id as sessions_session_id, c.session_id as conn_session_id,
a.transaction_id, c.most_recent_session_id, a.blocking_session_id,
a.connection_id as exec_conn_id, c.connection_id as conn_connection_id, c.connect_time,
c.net_transport, c.protocol_type, c.protocol_version, c.net_packet_size,
a.database_id, b.login_time, b.last_successful_logon, b.last_unsuccessful_logon,
b.host_name, b.program_name, b.client_interface_name, c.client_net_address,
b.login_name, c.local_tcp_port, c.local_net_address,
a.start_time, b.last_request_start_time, b.last_request_end_time, a.status, a.command,
a.blocking_session_id, a.wait_type, a.wait_time, a.last_wait_type,
a.cpu_time, a.reads as reads_exec, b.reads as reads_session, a.writes as writes_exec,
b.writes as writes_session, a.logical_reads as logical_reads_exec,
b.logical_reads as logical_reads_session, c.last_read, c.last_write, a.command,
a.percent_complete, a.row_count, st.text
from sys.dm_exec_requests a
inner join sys.dm_exec_sessions b on a.session_id = b.session_id
inner join sys.dm_exec_connections c on c.session_id = b.session_id
cross apply sys.dm_exec_sql_text (c.most_recent_sql_handle) as st
where a.session_id is not null