If it is just a simple query without correlation needed, looking for something on a single event source, then a Reporting Alert would work.
The same thing could be done on ESA.
I have some customers using the query for the alert not directly in the reporting engine, but putting it into an APP Rule, updating e.g. alertid and then just querying the alertid.
That speeds up query time.
And it gets load away from ESA. And that's the only Use Case, why i would do that.
