Is there any way to fire an alert when a condition is true for 2 days (or any amount of time)?

alejopdl

The idea is to create an alert that is activated when an entity matches a status for a certain amount of days

AaronO

Hi! Thanks for your question.  I think we arrived on this as the alert:

FIND cbdefense_sensor WITH status='BYPASS' AS CBS
THAT HAS AS R
    jupiterone_rule_alert WITH name = "given alert" AS JRA
WHERE R._createdOn < date.now - 48 hours
RETURN CBS.displayName, JRA.name, R.*
Kind of specific to your scenario but should be replicable with some name changes.