Interval of ReportID used

Hi.

Regarding the ReportID for AdvancedHunting, the Docs states the following.

"""

Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns.

"""

When will the Report ID be repeated?

I want to identify the event using the ReportID and Table listed in the DeviceAlertEvent.

But multiple ReportIDs exist on the same device and cannot be identified.

Maybe I need to narrow down the Timestamp.

Is there a better way?

Thanks,