Looking at the WD_MyAppsAlert table, it looks like the UniqueUserName column will be set to an actual user name, rather than NULL or SystemAction, if the user "responds" and selects to uninstall. The same holds true if the user selects "keep". In either case, the users response will be reflected in the Response column (either keep or uninstall). I don't have a particularly good way to test the "Latest application usage", but it looks like the LastUsed column should be updated to reflect the last used date reported by ITAM/FNMS. Perhaps you could detect when an altert was expired due to usage of the software, by checking to see if the LastUsed column was greater than the NotificationDate? The NotificationDate is when the alert was first created.
I have observed last usage date is not getting changed in Alert view neither in DB but the last used date has been changed in Flexera and alert is expired.
Your observation is correct, the LastUsed date in WD_MyAppsAlert does not get updated if the alert is expired due to the application being used.. I noticed that in this case, the UniqueUserName=SystemAction, and RespondedOn=NULL, so perhaps you could use this to identify those alerts where the alerts were expired after the software was used. Perhaps not ideal, but it is the only thing that I could find that you might use.
I'd like to see an "expired reason" column, or something similar.. When the expired column was set to 1, the reason column would also be set. Perhaps there is a more elegant way to implement this, but this is the first thing that comes to mind.. I'd suggest opening an idea in the community for this. I was just working with somebody yesterday that was looking for something similar.
