There are no definitive answers, it depends on your search time, the server concurrency load, and the desired time to be notified of alerts or the frequency.
Example : you run 2 correlation searches running every 15 minutes, looking back at 15 minutes.
- If the searchest take 10 seconds to execute, then it will not count on your search concurrency as 2 jobs for 10 seconds every 15 min.
- If the searches take 20 minutes to run, then it will persistently count at 2 job concurrencies, plus every 15 min, you will have an overlap, and it will count at 4...
If you have an alert condition happening t=0, then the correlation search runs as t=10m, then it will take you 10 minutes to be get a notable alert created, and a few seconds to get grouped in an Episode and trigger an action.
Changing the frequency will help control the time before you are notified, it may vary based on the type of data you are monitoring,
