I monitor processes that only load once the user logs in.
The Atera agent activates on startup before login so I get false alerts whenever they turn the PC on or shut it down.
Could you add a time delay or a setting that only activates the threshold after login and deactivates on shutdown