Ideas for devices generating a lot of alerts

Not specifically... some of the collector script amount data is similar to them...  I'm using get-winevent in powershell to filter logname=security, id=4625, startdate=(get-date).addminutes(-5)

Then setting the collection frequency to 5 minutes (matching the addminutes)... if 15 minutes, change that to -15... 30m = -30

I grab those remote, then pull back the result to the collector and do followup processing there to save load on the customer's production environment.

$badPass = $events | where message -match "006A"

write-output "badpass = $($badpass.count)"

Pick that up in a datapoint and you're good to go.  Basically, grab a set of things from a specific timeframe that matches the collection frequency... then count them and pass that number to a datapont using key/value interpretation