We often use things like Checksums to check if a file changed, if a user was added, if firewalls were changed, etc.but these alerts/events only last for a single check cycle in most cases, i.e. as soon as the check is made again, such as hourly, the current checksum matches the last one and the alert goes away; sure we could use averages or more check to lengthen the time, but ideally there would be a way to leave the event on / active until we really acknowledge it (separate from the current ACK system).

We often use / want such a thing over a night or weekend when or an extended period when we are working lots of alerts; if we are not careful, we'll miss these checks before they go away.

This is not easy and not sure even how to do it, but would be very useful for the checks of changes like this, and even normal things like high CPU; the event/alert would latch on until we turned it off, making sure we never missed that the event happened; today they just all go away upon recovery.