A type of alert that searches for events continuously in real time. Real-time alerts can trigger alert actions on a per-result basis. They can also trigger alert actions when results meet user-defined conditions within a rolling time window. For example, an admin can use a real-time alert to get a notification whenever a user has three failed logins within a ten minute period.
For more information
In the Search Manual: