This tutorial explains it fairly well: support.ipmonitor.com/.../13a7520467994df6a4f3bad6b0a096f6.aspx
Couple of notes:
1. Threshold values are specified in KB (kilobytes not bits).
2. Last-Value Threshold Max Traffic is what is used to trigger the alerting process. ipMonitor first checks this value. If this is exceeded, then it checks the Short-Term Threshold to see if this was just a spike or something that has been building up over time.