Rules run every 5 minutes on data we already have. An alert says what happened; it isn't a recommendation.