...
Depending on the triggering method used to define the alert and its specific settings, the events and timeframe shown in the table will differ. The reason for this is to provide you with specific context to help you identify the anomalous situation exposed by the alert.
Each-type alerts
Time range (ungrouped data): it starts slightly before the eventdate registered in the triggered alert’s extraData (adapted to your timezone) and concludes slightly after it. These additional moments are to account for any triggering delay.
Time range (grouped data): it starts with the beginning of the grouping period, which corresponds to the eventdate registered in the triggered alert’s extraData (adapted to your timezone), and concludes after the period specified in the query grouping.
Events shown: the event that triggered the alert.
...