I created policies for monitoring Windows Events.
I created a high threshold of 2111111111 events in 30 minutes and it fires up constantly.
The thing is: in investigate i searched for events in a minute and i get 20000. 20000x30 minutes gives me 630000.
So the question is how does te monitoring policies work to fire up the alarm for 2111111111??