
These three timings work together. For example, with Run frequency at 5 minutes, a Metric window of 15 minutes, and a Cooldown period of 30 minutes, the alarm checks the last 15 minutes of data every 5 minutes, then waits 30 minutes before alerting again on the same breach.