How can I show results for a field that is disabled and not re-enabled in a certain amount of time? I want to be alerted when AV protection on an endpoint is disabled for a period of time without being re-enabled. Ex: IF signature="Protection Disabled" AND (more than 5 minutes passes without Signature="Protection Enabled") THEN generate alert. ... View more