Devices ranked by unresolved RMM alert count, with site-level concentration analysis and proactive replacement recommendations. Generated by AI via Proxuma Power BI MCP server.
Devices ranked by unresolved RMM alert count, with site-level concentration analysis and proactive replacement recommendations. Generated by AI via Proxuma Power BI MCP server.
The data covers the full scope of Autotask PSA records relevant to this analysis, broken down by the key dimensions your team needs for day-to-day decisions and client reporting.
Who should use this: MSP operations teams and service delivery managers
How often: As needed for specific analysis or reporting requirements
Devices ranked by unresolved RMM alert count, with site-level concentration analysis and proactive replacement recommendations. Generated by AI via Proxuma Power BI MCP server.
EVALUATE
ADDCOLUMNS(
VALUES('BI_Datto_Rmm_Alerts'[priority]),
"TotalAlerts", CALCULATE(COUNTROWS('BI_Datto_Rmm_Alerts')),
"Unresolved", CALCULATE(
COUNTROWS('BI_Datto_Rmm_Alerts'),
'BI_Datto_Rmm_Alerts'[resolved] = FALSE()
),
"Resolved", CALCULATE(
COUNTROWS('BI_Datto_Rmm_Alerts'),
'BI_Datto_Rmm_Alerts'[resolved] = TRUE()
)
)
ORDER BY [TotalAlerts] DESCTop 10 devices ranked by unresolved alert count. Devices with 40+ unresolved alerts are flagged as Critical risk.
| Metric | Value |
|---|---|
| Total Devices | 6,953 |
| Online | 3,395 (48.8%) |
| Offline | 3,558 (51.2%) |
| Alerts | 135,387 |
| Sites | 314 |
EVALUATE ROW("TotalDevices", COUNTROWS('BI_Datto_Rmm_Devices'), "OnlineDevices", CALCULATE(COUNTROWS('BI_Datto_Rmm_Devices'), 'BI_Datto_Rmm_Devices'[online] = TRUE()), "OfflineDevices", CALCULATE(COUNTROWS('BI_Datto_Rmm_Devices'), 'BI_Datto_Rmm_Devices'[online] = FALSE()), "TotalAlerts", COUNTROWS('BI_Datto_Rmm_Alerts'), "TotalSites", COUNTROWS('BI_Datto_Rmm_Sites'))Distribution of 135,387 total alerts across five priority levels, showing resolved vs. unresolved counts
| Priority | Total Alerts | Resolved | Unresolved | % Unresolved |
|---|---|---|---|---|
| Information | 118,217 | 115,184 | 3,033 | 2.6% |
| Moderate | 6,524 | 6,481 | 43 | 0.7% |
| Low | 5,393 | 5,219 | 174 | 3.2% |
| Critical | 3,786 | 3,737 | 49 | 1.3% |
| High | 1,467 | 1,397 | 70 | 4.8% |
| Total | 135,387 | 132,018 | 3,369 | 2.5% |
EVALUATE
ADDCOLUMNS(
VALUES('BI_Datto_Rmm_Alerts'[priority]),
"TotalAlerts", CALCULATE(COUNTROWS('BI_Datto_Rmm_Alerts')),
"Unresolved", CALCULATE(
COUNTROWS('BI_Datto_Rmm_Alerts'),
'BI_Datto_Rmm_Alerts'[resolved] = FALSE()
),
"Resolved", CALCULATE(
COUNTROWS('BI_Datto_Rmm_Alerts'),
'BI_Datto_Rmm_Alerts'[resolved] = TRUE()
)
)
ORDER BY [TotalAlerts] DESCSites ranked by total unresolved alert count across all devices
EVALUATE
TOPN(
10,
ADDCOLUMNS(
VALUES('BI_Datto_Rmm_Alerts'[site_name]),
"TotalAlerts", COUNTROWS('BI_Datto_Rmm_Alerts'),
"Unresolved", CALCULATE(
COUNTROWS('BI_Datto_Rmm_Alerts'),
'BI_Datto_Rmm_Alerts'[resolved] = FALSE()
)
),
[Unresolved], DESC
)6 of the top 10 highest-risk devices belong to a single site. This is not a coincidence.
Foster Inc accounts for 979 unresolved alerts across its device fleet, the highest of any site in the dataset. Seven of the ten devices flagged in section 2.0 belong to this client: PC-4868, PC-7174, PC-5340, PC-1041, PC-7061, PC-3441, and PC-5141.
The pattern points to a systemic issue rather than isolated hardware failures. Possible explanations include an aging fleet that has passed its refresh cycle, a shared network or environmental condition (heat, power instability) affecting multiple machines, or a policy configuration in Datto RMM that is generating recurring alerts without resolution.
| Device | Total Alerts | Unresolved | % Unresolved | Risk |
|---|---|---|---|---|
| PC-4868 | 103 | 54 | 52.4% | Critical |
| PC-7174 | 95 | 52 | 54.7% | Critical |
| PC-5340 | 108 | 51 | 47.2% | Critical |
| PC-1041 | 100 | 45 | 45.0% | Critical |
| PC-7061 | 118 | 36 | 30.5% | High |
| PC-3441 | 97 | 34 | 35.1% | High |
| PC-5141 | 394 | 31 | 7.9% | High |
| Total (7 devices) | 1,015 | 303 | 29.9% |
EVALUATE
ADDCOLUMNS(
FILTER(
VALUES('BI_Datto_Rmm_Alerts'[device_name]),
MAX('BI_Datto_Rmm_Alerts'[site_name]) = "Foster Inc"
),
"TotalAlerts", COUNTROWS('BI_Datto_Rmm_Alerts'),
"Unresolved", CALCULATE(
COUNTROWS('BI_Datto_Rmm_Alerts'),
'BI_Datto_Rmm_Alerts'[resolved] = FALSE()
)
)
ORDER BY [Unresolved] DESCPC-6309 at Martinez Contreras Rios is the single highest-risk device in the fleet. It has 200 total alerts with 161 unresolved, an 80.5% unresolved rate. That ratio means alerts are being generated faster than anyone is closing them. This device is either failing or already functionally degraded. A technician needs to assess it on-site this week.
The High priority category has the worst unresolved rate at 4.8%, double the overall average of 2.5%. This suggests that High alerts are falling through the cracks. They are serious enough to warrant attention but are being deprioritized in favor of Critical alerts. With 70 unresolved High alerts, this gap represents real risk accumulating in the background.
Foster Inc stands out as the most exposed site. Seven of their devices appear in the top 10 risk list, with a combined 303 unresolved alerts. The concentration is too high to be random. Either the fleet is aging, environmental conditions are poor, or there is a monitoring policy that is creating noise without driving resolution. Whatever the cause, this site needs a focused review.
On the positive side, 97.5% of all alerts are resolved. The overall resolution rate is strong. The problem is not systemic neglect. It is that the remaining 2.5% is concentrated on a small number of devices and sites, creating pockets of high risk that are easy to miss in a dashboard view.
5 priorities based on the findings above
161 unresolved alerts on a single device is not a monitoring issue, it is a hardware issue. Check the alert types: if they cluster around disk health, thermal warnings, or SMART failures, prepare a replacement device before the visit. An 80.5% unresolved rate means this machine is generating problems faster than anyone can fix them remotely.
Seven devices in the top 10 risk list is not a coincidence. This needs a site-level review: check device ages, look for shared infrastructure problems (UPS, cooling, network), and verify that Datto RMM policies are not creating duplicate alerts. 979 unresolved alerts across this single site represents a concentrated failure risk. Bring replacement hardware quotes to the visit.
High alerts have a 4.8% unresolved rate, the worst of any category. Pull the list and categorize by alert type. If they are legitimate hardware or security warnings, assign them to technicians with a 48-hour SLA. If they are false positives or stale alerts, update the monitoring policies so they stop creating noise.
The data shows that devices crossing the 30-unresolved-alert threshold are already in trouble. Set up a Power BI alert or a Datto RMM policy that triggers a notification when any device hits this count. Early detection turns a reactive emergency into a planned replacement.
Present the device risk table and unresolved alert counts to the client. Frame the conversation around risk reduction, not cost. A proactive replacement of four devices at Foster Inc is cheaper than four emergency dispatches spread across the next quarter. Clients who see their own data tend to approve hardware refresh budgets faster.
Datto RMM generates alerts when monitored conditions are met on a managed device: disk space thresholds, CPU temperature, failed services, patch failures, and more. Proxuma Power BI pulls these alerts through the Datto RMM connector and stores them in the BI_Datto_Rmm_Alerts table. The AI then runs DAX queries to aggregate, rank, and identify patterns.
This report flags devices based on their count of unresolved alerts. Devices with 40 or more unresolved alerts are marked Critical. Devices with 30 to 39 unresolved alerts are marked High. A high unresolved count indicates that the device is generating problems faster than they are being resolved, which typically points to underlying hardware degradation or persistent configuration issues.
Yes, that is possible. Some Datto RMM policies generate alerts for conditions that are informational rather than actionable. The best next step is to filter the unresolved alerts for a specific device by alert type. If they cluster around a single non-critical monitor (like a low-priority patch reminder), consider tuning the policy. If they span disk, thermal, and service alerts, the device has a real problem.
Monthly for routine fleet health reviews. Weekly if you are tracking a specific site with known issues (like Foster Inc in this dataset). After any major outage or hardware failure, re-run the report to see if the failed device had been showing warning signs in the data.
Yes. Connect Proxuma Power BI to your Datto RMM account, add an AI tool (Claude, ChatGPT, or Copilot) via MCP, and ask the same question. The AI writes the DAX queries, runs them against your real alert data, and produces a report like this one in under fifteen minutes. No manual SQL or report building required.
Connect Proxuma Power BI to your PSA, RMM, and M365 environment, use an MCP-compatible AI to ask questions, and generate custom reports - in minutes, not days.
See more reports Get started