Alert Creation on Duplicate Event Logs

gsingh_ 

You probably need something based around this (I used the SecurityIncident table as an example).  I added a check for Severity which you may need to consider (e.g. if someone has closed the alert yesterday is is it still to be considered today?)

let highSeveritySigninLogsToday = SecurityIncident
| where TimeGenerated >= startofday(now()) 
    and Severity == "High"
    and Status !="Closed";
let highSeveritySigninLogsYesterday = SecurityIncident
| where TimeGenerated between (startofday(ago(1d)) .. endofday(ago(1d)) ) 
    and Severity == "High"
    and Status !="Closed";
highSeveritySigninLogsToday
| join kind=rightanti
    highSeveritySigninLogsYesterday
    on Title