Detailed description of how Maximum Condition Frequency is applied to Internal Event Match alarms.
Assume the Maximum Condition Frequency is set to four hours.
When an alarm triggers, Trellix ESM will not trigger it again for four hours.
After the blackout period expires, Trellix ESM looks for matching events.
If there are no matching events, the window grows and Trellix ESM continues checking for matching events. The window continues to move forward until an alarm is triggered.
If no alarms events occur for four hours, the window of events that are checked moves forward; it doesn’t continue to grow.
Trellix ESM then checks for matching events periodically until an alarm occurs and a new blackout period begins.
The result is that, during a period of high alarm frequency, Trellix ESM reports events every four hours.
Deep dive
When Trellix ESM checks for events, it is only looking at a certain time range. Right after the blackout period ends, that time period is from now back to the end of the blackout period. That is same for the next checks until the point where now minus four hours doesn't reach the end of the blackout period. At that point, the time window is just now minus four hours up to now. All checks from that point on will use that time range. The check will only look at a four hour window, never a longer one. Once the window that the Trellix ESM is checking reaches four hours, instead of growing it moves forward.
Important
The window is always four hours, it is not dependent on the Maximum Condition Frequency.