For our last receive alerts, I’ve got it set as follows: delta is not checked, > 1800 and in the comparing, have N minutes 5. So, really as written, ours triggers in 35 minutes, but you could just change the 1800 to 1500. The duration is what I feel is important, because this says the condition must hold true for x amount of time – that stops the false positives of a thread being bounced, etc.
The other thing to eliminate false positives or inconsistencies is to make sure the alert window is not around the time when a stat reset is done (hcimsiutil -Z)… this clears the monitor daemons ‘memory’ of when last sends/receives happen, and may cause false triggers.
