SkieWhat are open events per device in Insights?
Open events per device is the average number of unresolved alerts for each device in view. A low number means the breach list is short and tidy; a rising number means problems are being left open or are recurring. It is a measure of how well the alert list is being worked.
Every alert in the breach centre is an event, and it stays open until it is resolved. Divide the open events by the number of devices and you get a figure that says how much unresolved trouble there is per device on average.
It rises for two reasons. Either new problems are arriving faster than people close them, or the same device keeps raising the same alert. Both are worth knowing. The first is a workload and attention problem: nobody has looked at the breach centre for a few days. The second is a device or location problem: one tablet that is always silent, or a hostel corridor with no signal.
Compare groups with each other. A class with a high figure next to calm neighbours has something specific going on, such as a charging trolley that is faulty or a teacher who is unsure of the process. Comparing branches is covered in compare branches.
The figure is also a fair way to see whether the daily routine is working. If admins open the breach centre each morning, sync and resolve, the number should hover low. See what resolve does to understand why resolving only closes alerts that have recovered.
Practical tip: do not aim for zero. Aim for a figure where every open event has an owner. A few open events that someone is chasing are healthier than a clean list that came from pressing resolve on things that had not been fixed.