ConnectWise SIEM (Perch) had the ability to create queries for "flatline" conditions. It would be helpful to be able to query for the absence of certain log events within a query in Huntress SIEM. Some things you only want to get alerted for if it does NOT occur. One example could be monitoring for administrative account usage. If an admin account has gone X days without a login, we may want an alert to indicate this account has gone to an inactive/stale state. I know you can make a scheduled query send an email if it has empty results, but I don't think there is an option to ONLY send an email if it has empty results.