Alerts not triggering

[adrifesa95]

Good morning,

I have some alerts that I have set up that are not triggering. They are Defender events. If I run the query in a normal search if I get the results of the alerts that I miss. However, for some reason the alerts are not triggered: neither the email is sent, nor do they appear in the Triggered alerts section.
This is my alert

adrifesa95_0-1712219633217.png

and this is one of the events for which it should have triggered and has not triggered:

adrifesa95_1-1712219743615.png

I also tried disabling the throttle in case there was a problem and it was leaking.

I also checked to see if the search had been skipped but it was not.

Any idea?

[adrifesa95]

Yes, Microsoft generates incident IDs that are unique and collision-free for each incident. I'm going to try to disable it

[ITWhisperer]

Can you share the macro expansion of the search in a code block </>