I would be great to be able to get an alert if one security features or threat intelligence  is triggered (seen in logs)  for a device.

ways you could do this:

email

Syslog event on UDM  

mobile app push notification