TIL you can use PowerShell to pull alarm counts for monthly metrics.

Everyone's busy clicking through dashboards and exporting CSV reports like it's 2010. Meanwhile, I just needed a simple count of alarms by category for last month's operational review. The usual "best practice" of using the UI for reporting is, predictably, a time sink.

Turns out you can bypass the GUI circus entirely with the `Get-LRAlarms` cmdlet from LogRhythm's PowerShell module. Pair it with some date math and you've got a scriptable metric. Who knew? (Sarcasm intended. The documentation for this is buried, which seems to be a feature, not a bug.)

Here's the gist. You filter by date, group by whatever property you need—`$_.'Alarm Status'` or `$_.'Alarm Rule Name'`—and get your counts. No manual aggregation needed.

```powershell
# Assuming you're already connected via Connect-LRServer
$StartDate = (Get-Date).AddMonths(-1).Date
$EndDate = (Get-Date).Date

$Alarms = Get-LRAlarms -StartDate $StartDate -EndDate $EndDate -ObjectStatus 1,2,3 # Active, Acknowledged, Assigned

$AlarmCounts = $Alarms | Group-Object -Property 'Alarm Status' | Select-Object Name, Count

$AlarmCounts | Format-Table
```

This spit out a clean table of counts per status for my reporting period. You can pipe it to `Export-Csv` if you need to feed it into another system. The point is, it's automatable. No more screenshots of pie charts in slide decks.

Of course, the PowerShell module has its own quirks—pagination, timeout handling, and the usual XML depth issues with larger result sets. But once you wrestle with that, it's still faster than the approved, click-heavy "workflow." Sometimes the official path is just the scenic route to frustration.