Criteria for combining attacks into single group alert?

Hello, thank you for the work you've done on this service. I'm happy to be able to subscribe to the premium service as it provides great value to our team in the AM01-JULIET02 cell. I have a question about the configuration of attack alerts. What is the criteria for combining multiple attack alerts into a single group alert? I assume the first attack by a given agent on any portal in the group will trigger an alert. It looks like subsequent attacks on that group by that agent will be "ignored" for some period of time then a new alert for the group will be generated. It also looks like the "ignore time" is specific to each agent such that if 7 agents attacked a group of portals in quick succession, we'd get 7 alerts, one for the first attack for each agent, then no alerts for a while. 1) is this correct? 2) what is the "ignore time"? Thanks!

 

Thank you for the clarification. Much appreciated.