Are there any known drawbacks for using the auto window when scheduling non real-time alerts?

[danielbb]

I wonder whether there are any known issues with using the auto window capability when scheduling non real-time alerts? In my mind, it should be the default and I just wonder if there are any arguments why it shouldn't be?

[woodcock]

Only what you would expect: some will run late so, for example, if you are looking at a dashboard driven by a scheduled search running every 5-minutes and you have <dashboard refresh=600> at the top, because it is on a very fixed schedule, you may not see your changes until the refresh after you normally would.

[danielbb]

The main focus here is about the alerts. Since we have many cyber alerts, some people have concerns and are not rushing to embrace this promising auto feature. It's interesting whether there is any tracking of the auto driven alerts, meaning, the delta, the actual execution time, etc.