Microsoft Defender for Endpoint

Connect each client's Microsoft tenant with an Entra app registration (Alert.Read.All and Machine.Read.All) and say which Gochi client it belongs to. Every 15 minutes new Defender alerts raise alerts on the matching Gochi device, so your ticket rules and notifications apply, and resolve when Defender marks them resolved. Connect as many client tenants as you look after. A coverage check lists onboarded machines with no Gochi agent, and the client's Gochi devices that aren't in Defender.