Hello,

The detected issue is described at

https://www.prelude-siem.org/boards/1/topics/218.

To sum up, it seems that in order to raise an alert, two conditions must be fullfiled:

1. the expire (time) of the context ran out
2. the threshold reaches the limit value

So, in a use case when I'm receiving continuous logs, despite the threshold is reached, the timer would be reset continuosly and the alert will not be triggered until we stop receiving logs (I tested it). And that supposes that I won't notice that I'm receiving an EventStorm for example until it ended.

So there are two options to solve this issue:

1. Avoid the timer reset each time a new context is called/updated

Changing ctx = search(name, idmef, update=True) to ctx = search(name, idmef, update=False) at the new function

2. Trigger an alert when a context reaches the threshold value, regardless the expire value. (I didn't analyze where this process takes place)