The schedule job: Event Management - Evaluate Alert Management Rules, is responsible for creating incidents through the alert management rules, which runs every 11 seconds.

London, Madrid, New York

1. Let us consider a case where the above-mentioned schedule job which is responsible for creating incidents completed running at "YYYY-MM-DD 01:06:51".
2. So the next job will run at "YYYY-MM-DD 01:07:02", which would call the flow designer and creates an incident.
3. Let us say we received a closing/clear event while the flow designer is still executing it closes the alert (closing/clear event will close the alert) before the creation of the incident.

This is an expected behavior specifically when there is a very less time gap between the alert creation and alert closure.

We do not recommend decreasing the runtime to below 11 seconds for the job: Event Management - Evaluate Alert Management Rules as this may cause performance issues when we try to trigger this job more frequently.