Alert types

There are two alert types, scheduled and real-time. Alert type definitions are based on alert search timing. Depending on the scenario, you can configure timing, triggering, and other behavior for either alert type.

Alert type comparison

Here is a comparison of scheduled and real-time alerts.

Alert type	When it searches for events	Triggering options	Throttling options
Scheduled	Searches according to a schedule. Choose from the available timing options or use a cron expression to schedule the search.	Specify conditions for triggering the alert based on result or result field counts. When a set of search results meets the trigger conditions, the alert can trigger one time or once for each of the results.	Specify a time period for suppression.
Real-time	Searches continuously.	Per-result: Triggers every time there is a search result.	Specify a time period and optional field values for suppression.
Real-time	Searches continuously.	Rolling time window: Specify conditions for triggering the alert based on result or result field counts within a rolling time window. For example, a real-time alert can trigger whenever there are more than ten results in a five minute window.	Specify a time period for suppression.