I like the idea of querying my environment based on time - I am often frustrated in AlienVault by lack of context to the alarms, especially when an event changed that environment.