Alerts not triggering

[adrifesa95]

Good morning,

I have some alerts that I have set up that are not triggering. They are Defender events. If I run the query in a normal search if I get the results of the alerts that I miss. However, for some reason the alerts are not triggered: neither the email is sent, nor do they appear in the Triggered alerts section.
This is my alert

and this is one of the events for which it should have triggered and has not triggered:

I also tried disabling the throttle in case there was a problem and it was leaking.

I also checked to see if the search had been skipped but it was not.

Any idea?

[adrifesa95]

Yes, Microsoft generates incident IDs that are unique and collision-free for each incident. I'm going to try to disable it

[ITWhisperer]

Can you share the macro expansion of the search in a code block </>