Yes, this would be great for clients with more SEIM logging on their workstations, and it would be helpful to split workstation noise from Server or network infrastructure alerts of a lack of communication to the portal.

With many PC/Laptop's being in SIEM this needs to be customizable. We need to get alerts for servers/infrastructure devices but not client devices.

We have many clients that use laptops. When these close and go offline for the weekend, we get flooded with alerts indicating that sources aren't reporting.

We should be able to indicate "always online" devices and suppress alerts from "occasionally offline" devices. If the Huntress agent is reporting data but Rio isn't, that should always trigger an escalation, but if a device is simply offline, we don't need the escalation.