In the example of a 5-minute sliding window, how many minutes of samples need to violate the threshold to raise an event?

In a 5-minute sliding window scenario, for an event to be raised, the threshold typically needs to be violated for a certain duration within that window. When we say 5-minute sliding window, it means the analysis considers the most recent 5 minutes of data continuously in increments.

To raise an event, the system generally requires that the threshold is violated for at least 3 consecutive minutes within that window. This is designed to reduce the likelihood of false positives that could arise from momentary spikes or anomalies in the data. Thus, if violations are detected for 3 minutes, this sustained level of metric behavior indicates a significant issue worth flagging as an event.

If violations occur for less than 3 minutes, it might be seen as transitory and not significant enough to trigger an event. Consequently, raising the threshold violation requirement to 3 minutes offers a balance between sensitivity to actual problems while minimizing noise from temporary fluctuations.