Use the event frequency filter to target workflow audiences based on how often an event has happened — not just whether it happened. This lets you respond to patterns of behavior, like repeated visits to unapproved websites, automatically.
What it does
One-off events and repeated events tell you different things. Someone who visits an unapproved website once may have made a simple mistake. Someone who does it three times in a month is showing a pattern — and patterns are a stronger signal of risk.
The event frequency filter counts how many times selected events have happened for each person within a time window you choose. Only people who match your condition enter the workflow audience, so your interventions reach the people showing the pattern and leave everyone else alone.
How counting works
Counts are per person. Each person's events are counted individually against your condition.
Multiple events are combined. If you select more than one event, the counts are added together. For example, selecting two types of unsafe browsing events with a threshold of 3 matches anyone with 3 or more of those events in total.
Counts apply within your time window. Only events inside the look-back window count toward the threshold. Older events are ignored.
Add an event frequency filter
Open your workflow and go to the audience step.
Open the filter options and select Event frequency.
Select one or more events to count.
Choose an operator — equals, more than, less than, or not equal — and set the count threshold. The threshold defaults to 1.
Set the time window in days. This defaults to 30 days and can be up to 60.
Save your audience. The workflow now targets only people who match the condition.
Example use cases
Respond to repeat risky browsing. Filter to people with 3 or more unapproved website visits in the last 30 days, and send them a targeted nudge or assign relevant training. People who slipped up once aren't caught in the net.
Escalate persistent phishing failures. Filter to people with more than 2 phishing simulation failures in the last 30 days and enroll them in focused follow-up, rather than sending the same generic refresher to everyone who ever failed once.
Reserve stronger responses for repetition. Run one workflow for first-time events and another for repeat events, using different thresholds. This keeps responses proportionate — light touch for a one-off, more support for a pattern.
Get the most from it
Keep the window short. Recent repetition is a stronger risk signal than events spread over a long period. A tight window like 30 days gives you a sharper picture of current behavior.
Combine related events. Counting similar risky behaviors together catches patterns a single event might miss. Avoid mixing unrelated events in one filter — it muddies what the count actually means.
Match the intervention to the pattern. The value of frequency filtering is proportionality. Use it to make sure heavier interventions only reach the people whose behavior warrants them.
Good to know
The look-back window is limited to 60 days.
The count threshold must be a whole number of 0 or more. A threshold of 0 with the equals operator matches people who haven't had the event at all in the window.
The existing Event history filter is still available. Event frequency works alongside it. Any filters using Event history aren't changed.
The audience filter is designed for workflows but can be used anywhere audience filters can be added.