event handlers

39 minutes ago, mnagel said:

Alert processing happens outside the detection point (in "the cloud") -- there need to be triggers to an event handler that operate in the collector context.  

That makes complete sense and something I initially overlooked as in the context of a server, LM needs to push logic down the to collector (not sure what that process is called) and then the collector needs to push that down to the server and then send those results back up to the cloud via the collector for processing.

In the context of the "check" I'd like to see some type of functionality that would look something like this:

• From the cloud run a Windows service check through the collector down the server
• If the service has failed, execute trigger (in the same workflow) to attempt to restart service, and if service restarts, do not alert, but send those results back up to the cloud for processing
• If the restart fails, do the same thing sending the results back up to the cloud with the difference being generate an alert.

I'm also curious how long this feature request has been asked for since during our demo LM stated they had plenty of customers asking for this functionality.