The screenconnect host section is very useful. It would be great if we could get a notification about new hosts appearing in here because it would be untypical for a new SC server to be added normally and would usually indicate either an incident, or something that needs to be addressed (i.e the previous IT companies remote access being deployed from somewhere).

Ideally this would be expanded to alert on additional Remote Access and RMM tools. E.g Splashtop.

Attackers are increasingly using industry standard MSP tools to stay under the radar and being able to give us a heads up directly about this would be great. I appreciate the SOC would alert on suspicious activity, though the MSP will be more aware of the context - the ability for us to toggle an option on for this would be ideal.