Hi,

We've been asked to put in a solution whereby alerts will be automatically generated to us when a device hasn't provided audit/security logs for a period of time. 

So far this is ok as we can install the AD Audit+ agent and it will tell us when a device hasn't sent audit logs to the server. 

However the issue we're finding is that we have many laptops that are supposed to be offline for a period of time (Either spare stock, laptops for people who are on long term leave etc.). 

Is there a way to only send alerts based on the difference to when the device was last online and when the last security event was received by the server. Otherwise we'll get a lot of noise from these offline devices. 

Many thanks