@ecasbas wait ... you are reading an alert based on some detection and then writing another detection based on that? i think i lost some context here ... this sounds like you are refining or iterating on an existing detection, no?