Identify which alert definitions are firing the most to prioritize tuning
SELECT TOP 10 Name, COUNT(*) AS TriggerCount,
MAX(TriggeredDateTime) AS LastTriggered,
AVG(TriggeredCount) AS AvgTriggerCount
FROM Orion.AlertActive
GROUP BY Name
ORDER BY TriggerCount DESCAI-powered SWQL generation, script management, CVE tracking, and verified solution intelligence.