Conditional EventSources

Specific need here that could be useful elsewhere.  If an event source could conditionally raise an alert based on the existence or not of a related alert, that would be useful.  Example: under windows, if a user initiates a reboot of the system, a few alerts are thrown.  The request, the systems's response, and the final shutdown notice.  It's also followed up by an informational message that occurs whether the reboot was requested by a user or an unexpected crash.  So we always need to get that last one, but not if we got the first one as the first has much better information and timing for us than the last one.

If you could at least add a scripty piece to the eventSource, I could query existing alert for a device and use that to throw a new alert or not. (I could also use that to automate remediations as a bonus).