Being able to integrate the device hostname and its current status of being AD joined/registered (along with related metrics) would be beneficial when evaluating security incidents. Knowing that the activity is happening from a company owned device that has been joined and active for years is valuable context, just as it would be good to know if it is newly registered.

In the past, hostname info was included in the signals, but we have had a couple of recent incidents that having that intel would have been helpful.