Device alerts and timeline just got smarter: Meet Alert Correlation and Zia-powered timeline insights

Hello everyone,

Two important updates just landed in Endpoint Central's DEX module and both help IT teams get to root causes faster. Now, IT teams will have fewer alerts to sift through, and less time spent piecing together what actually happened on a device.

Cut through the noise with smart, correlated alerts

Single-metric alerts have a noise problem. Assume that a group of devices starts reporting sluggish performance during peak hours. Memory usage alone spiking to 90% might just mean someone has too many apps open. But if it's also swapping heavily, that's a different story: the system has actually run out of physical memory and is leaning on disk-based virtual memory, which tanks performance far more than high usage alone.

Meet Alert Correlation, which lets you configure exactly that kind of logic with criteria patterns:

(1 AND 2): trigger only when both conditions are true. Memory swap rate exceeding 500 pages and memory swap size exceeding 4 GB together confirm the device isn't just occasionally paging, it's under sustained, active memory pressure right now.
(1 OR 2): trigger when either condition is true, like memory usage exceeding 90% or memory swap size exceeding 4 GB, since either one alone is worth a closer look.
((1 AND 2) OR 3): mix strict and fallback conditions in one profile. Keep the swap rate and swap size pair from above, and add memory usage exceeding 90% as condition 3, so the alert also fires on its own the moment usage climbs, even before swapping kicks in and confirms it.

Alert correlation

Conditions can mix built-in DEX metrics (CPU, memory, battery, storage, and more) with your own custom sensor fields. Got a value that isn't a standard metric? Create a sensor for it and correlate on it directly.

Don't want to build the logic yourself? Just ask Zia what you're trying to catch: Alert me when CPU or memory usage is high or "flag

devices with slow boot time and too many startup apps. It drafts the profile for you to review and save.

Fire the alert, then let it act: map an Alert profile to a Workflow, turn on Enable Deployment Trigger, deploy in Trigger mode, and remediation kicks off automatically. If you'd like to know more on the types of alerts that can be set up, refer to this document on alert variables.

Device Timeline just got smarter, powered by Zia

If you're on the DEX add-on, Device Timeline will already be familiar: A chronological, interactive view of an endpoint's performance metrics, all on one screen. It just got smarter, powered by Zia.

Timeline Analyzer puts Zia right inside the timeline. Open it and Zia summarizes key events and likely causes on its own. Keep asking questions like what caused the CPU spike at 2pm?, compare this to last week, or compare this device to that one, without leaving the screen.

Device timeline analyzer

Here's what that looks like in practice: a ticket comes in saying a laptop was sluggish around 2pm. Open the Device Timeline and ask Timeline Analyzer what happened. Zia summarizes it in seconds: 94% CPU starting at 1:55pm, with a browser process as the top consumer. Two minutes earlier, a browser auto-update landed, and no technician action is logged in that window. Root cause identified within minutes, from one screen.

Want the full picture? Read more about Device Timeline for endpoint performance monitoring.

Meet DEX Diagnostics: AI-powered context on error codes that look like gibberish otherwise
Click any highlighted process, faulting module (DLL), or error code inside a DEX Insight, and Zia pops up with a plain-language summary, its category (Browser, Security, System Process, and more), and severity where applicable. No more guessing what mso.dll or 0xe0434352 actually means, or whether it's worth a closer look. Read more about DEX Diagnostics and the application crashes insight.
DEX Diagnostics

With this, these updates add to our growing list of AI-powered DEX capabilities:
Sensors: Describe the data you want to collect, and Zia generates the sensor's fields and script directly in the Create Sensor module. Just review and deploy with ease. Read more about Sensors for custom data collection.
Workflows: Describe an automation in plain English, like restart devices that haven't rebooted in seven days or clear temp files when disk usage exceeds 90%, and Zia builds the full workflow, triggers and actions included. Currently supported for Windows devices. Read more about managing workflows.
Anomaly Detection in Device Timeline: Learns each device's normal performance baseline over time and automatically flags meaningful deviations.
Try it out and let us know what you think below. If you have any questions or issues, drop them in the comments or reach out to support.
Note: DEX is an add-on to Endpoint Central. If you'd like to see DEX capabilities within your existing instance, please fill out this form so that we can help you with the activation process.