Managed SIEM creates an escalation when a device does not report within the configured timeframe. Currently, the only way to stop repeated alerts is to mute the device, which must later be manually unmuted.

Please add an option to classify or silence a device as “Known Offline” for its current offline period. This status should automatically clear when the device checks in again, allowing a new escalation to be created the next time it goes offline. This would eliminate the ongoing process of manually muting and unmuting devices while ensuring future offline events are still detected. A permanent mute option should remain available for devices whose alerts should stay disabled until manually restored. Offline alerts cannot simply be ignored because a failure to report may indicate an agent or logging issue on a computer that is still running, rather than a computer that is intentionally offline.