Alert Management Rule not creating an INC from the Alert recordIssue This alert rule doesn't always create a task as expected.CauseThe problem is because one of the filter conditions in Alert Management rule "Created on or before 3 minutes ago". ResolutionThe effect of this filter is to prevent processing of the alert until at least 3 minutes after it has been created.This is a problem, because the way we know which alerts need to be processed is by keeping a bookmark of the update time of the last alert processed. When we run the alert management rules every 11 seconds, we only attempt to process alerts that have been updated since that bookmark time.So, if we prevent this rule running until 3 minutes after the alert is created, then meanwhile, however, other rules will run, and other alerts will come in, which advance the last bookmark time to later than the last time this alert was updated (i.e. when it was created). So by the time 3 minutes have elapsed since the alert was created, this alert is no longer eligible for rule processing.You can see, also, that as soon as you update anything on the alert, as long as it is more than 3 minutes since the alert was created, the rule *does* run.