In the on-prem version of deviation reports, low or 0 count events are being listed, which clutters and makes reports heavy. Allow the filter to be on absolute event count as well as deviation counts. Same idea applies to alerts, e.g. event count of 10 with a deviation 30 is not something worth looking at. Oh, and the last item on the wish list is to sort the content in the deviation report alerts - high dev counts to be on top.