Defining a search query and creating an alert rule