You can use particular event code or event description in search string, whenever if any violation happens or particular string match in a log file you will get an alert
Example: if account is locked out we will get an alert immediately by creating the alert by using below query,
index=winsec EventCodeDescription="A user account was locked out" OR E ventCode = 4740|dedup user| stats count by user _time host
Example for Crontab schedule:
The cron parameters, * * * * *, correspond to minute hour day month day-of-week.
*/5 * * * * Every 5 minutes.
*/30 * * * * Every 30 minutes.
0 */12 * * * Every 12 hours, on the hour.
*/20 * * * 1-5 Every 20 minutes, Monday through Friday.
0 9 1-7 * 1 First Monday of each month, at 9am.
Let me know if this is work out.
Create a search like this
index=yourindexname sourcetype=sourcetypename "matchingstringhere"
Save this as an alert. For schedule you can choose to run it at whatever frequency you would like. For trigger condition, choose "if number of events greater than" 0. For alert mode, select once.