When your machines are actually in use
Wegweiser now reads when each machine is on and when it is worked, from the CPU samples it was already collecting. Ask the chat when a PC is used, find the quiet window for a reboot, and let analyses judge a spike against the hour it happened in.
Every Wegweiser agent has been sending a CPU sample with its heartbeat for months, and the server has been keeping one every five minutes for ninety days. Until today, everything that read that history flattened it: a chart of the last 24 hours, an average with a p95, a line of weekly percentiles in every analysis. Useful, but none of it answered the question a technician actually has, which is when.
The rows answered it before any code did. One workstation on the fleet had a month of history: nearly two thousand samples during weekday daytime and under two hundred at night, and it averaged 19% CPU by day against 3% after hours. The machine was telling us its working day by the simple fact that a switched off computer sends nothing. The servers on the same tenant were flat around the clock, as servers are.
What you get
Each device now has a usage profile: one sentence, computed from its own samples, no AI and no wegcoins. A workstation reads like this:
In use weekdays 10:00-20:00 and weekends 10:00-19:00 (avg CPU 18% while in use); outside those hours on 14% of days; quiet window 21:00-09:00.
A server with an office-hours load says when its busy period is and where the quiet hours are. A hypervisor running at 29% all day and all night says so, and does not pretend any hour is quieter than another. A machine with under two weeks of history says nothing at all, because a pattern from four days is a guess.
It shows up in three places.
In the chat. Ask a device "when is this PC used", "when can I reboot it" or "is this load normal for this time of day" and the answer comes with a chart of the typical day: CPU on weekdays, CPU on weekends, and how often the machine was powered on at each hour. The hours are in your own clock.
In every analysis. Each analyser now sees the machine's pattern before it judges a reading, in the same block that tells it the operating system and the security posture. A busy afternoon on a workstation is a Tuesday, not a finding.
In investigations. When Wegweiser investigates a resource finding, the investigator is told what that machine normally looks like at the hour the reading was taken. Forty percent at three in the morning on a machine that is normally off at three in the morning is an event. The same forty percent at two in the afternoon is what the machine is for.
The one thing to know
Hour of day needs a timezone, and the agent does not report one yet. The chat uses your clock, which is right for a single-country MSP. Analyses and investigations say UTC and label it. A zone reported by the agent is the proper fix and is next on the list for the agent.
Also today
The metric history tool used to tell the model that samples arrived every nine minutes. They arrive every five, and the model reads gaps accordingly now.