Setup an alerts with events from Timestamp format

[devsru]

Dear All,

I want to setup an alert in an event. The event contains three timestamps, New Event time, Last update, and startDate time. So these are the logs coming from MS365. 

I want the Alert if one of the field "Incident Resolved = False" is satisfied even after 4 hours of startDate time. So we receive first event at startDate  but we don't want an alert until 4 hours of startDate .

startDateTime: 2024-07-01T09:00:00Z

[ITWhisperer]

| where _time - strptime(startDateTime,"%FT%T%Z") > 4*60*60 and isResolved="False"

[devsru]

Thanks for your answer but in my case _time may only appear once in 2 days when we have a new update and incident resolve state change to true. Can we do something that my  startDateTime checks with the latest time of the scheduled alert and raise an alarm if it is more than 4 hours ?

[ITWhisperer]

| where time() - strptime(startDateTime,"%FT%T%Z") > 4*60*60 and isResolved="False"