Have you considered creating correlation rules for the thresholds and reporting on those events when they fire?
I did but I am trying to avoid creating unnecessary correlation hits.
It's also not quite what I am looking for.
Good Idea though. I might just have to consider doing that in historical mode.
I figured that out in the last a few days ago.
Been meaning to reply.