Feature Requests

I would like the ability to filter out noise from events like SharePoint link sharing in the near-time monitoring feature, as it currently generates too many alerts.

I would like the system to automatically obtain warranty expiration and purchase dates for all devices, including HP, without manual input. The current solution only supports Dell and Lenovo, which is insufficient for our needs as most of our devices are HP.

The use metric as a threshold for another metric will allow us to create alerts for things that do not have hard coded values or limits.Example: if Metric A is > Metric B ; AlertReal world example: I have written two custom metric, one to query the total number of used SharePoint space in GB drives[].quota.used | sum(@)And one to query the total Space provided by Microsoft. Using 1024 + (BusLics * 10)[multiply(Licensing[?ProductFriendlyName == 'Microsoft 365 Business Premium' || ProductFriendlyName == 'Office 365 E3'].consumedUnits | min(@), 10 ), 1024 ] | sum (@)I could compare the two numbers and trigger an alert if we are out of, or getting low on storage

I believe having a metric for each inspector would allow for more precise alert triggers. This would make it easier to maintain and change, as well as show alerts in the inspector's history. It would also ensure that the ticket created is more intuitive and already under the correct client.

for an example; we have an actionable alert for when a users mailbox reaches above 92%. If we have multiple users in the same environment that have mailboxes with above 92 percent full, we only get one ticket with all the user names that are affected. We would like to be able to generate a ticket for each individual user that triggered the alert so we can deal with it separately accordingly thank you

Allowing us to create conditions from multiple inspectors will greatly increase the power of the platform.For Example: If user A is not in Duo MFA active users list and is also not in MS MFA Active users list, trigger an alert.

I would like the ability to use custom metrics that are based on different inspectors within one alert. I have a custom metric based on the Office 365 inspector, and another custom metric based on the Active Directory inspector. I would like to create a single actionable alert that is based on both of these custom metrics. I should be able to customize what triggers the alert with simple logic. (metric 1 and metric 2) or (metric 1 or metric 2) etc. The benefit of this would be that I can create even more reliable alerts that help prevent my team from acting on false tickets. Currently if I use the stale user metric for Active Directory, we can receive false tickets due to the user only using Office 365 and not recently logging into their corporate network. Have the alert check both of these sources of data prior to creating or updating the alert would provide a single ticket to look into stale users instead of 2 separate tickets that may or may not be valid.

I would like to have the ability to receive alerts from multiple endpoints within an environment as a single alert. For instance, if five endpoints trigger an alert based on a specific metric, it would be beneficial to generate only one ticket that notes all the devices that triggered the alert. This would streamline the alert management process and reduce the number of tickets generated.

I want a more comprehensive SIEM solution that correlates different logs to create actionable incidents, rather than just providing raw alerts. This would help our team respond more effectively to incidents.

Feature Request: Please implement the functionality to compare metric outputs from different inspectors in an actionable alert. For example, in our environment, we would like to compare a SonicWall metric that monitors for the DNS Table on the firewall to a Windows Server Metric that checks our servers' DNS listings and compare them, with the intention to any inconsistencies that could be causing issues. This would be particularly helpful for onboardings, migrations, projects, and the continued maintenance of systems. Thank you