...
Even though they are installed only for the parent domain and will trigger based on the parent domain data, they must be installed with the “All clients” option selected in the tenant dropdown.
These alerts contain the client field to inform analysts of the domain they come from but will not be visible to users in child domains.
...