Working on a custom alert I started wondering how the alerting engine handles reset logic. Typically I select "Reset this alert when trigger condition is no longer true (Recommended)" and move on but what happens under the hood here? The reason I ask is because I want to know how to handle the absence of an object in the trigger query output. I'm doing a count of objects in a group which when it exceeds my threshold will produce a row for the group in the query output. When the count falls below the threshold I set then the row for the group will be removed from the query output. Does the engine handle resets by checking the inverse logic for every object that triggered the alert or is it just looking for the absence of the object when it runs the trigger query again? Does it handle both at the same time maybe as a safety measure?
Sorry if this has been answered before. I couldn't find an answer from the few searches I did. I feel like this is probably one of those FAQs.
