We receive SIEM Not reporting escalations when workstations go offline for a period of time. A user goes on vacation, gets on a plane, closes their laptop for the weekend, etc.

We'd like the ability to receive escalations for servers, but exclude workstations.