diff --git a/splunk_alert.md b/splunk_alert.md
index 16ba581..bbeda68 100644
--- a/splunk_alert.md
+++ b/splunk_alert.md
@@ -18,4 +18,17 @@ priority="High"
 | eval indextime = _indextime 
 | convert ctime(indextime) 
 | table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id mitre_subtechnique_id mitre_subtechnique apt hunting_trigger mitre_link upload_date last_modify_date mitre_version priority
-```
\ No newline at end of file
+```
+
+# Permissions
+    - Display For: App
+    - Read: Everyone
+    - Write: admin
+
+# Schedule
+    - Schedule: Run on Cron Schedule
+    - */15 * * * *
+    - Time Range: Since date time
+    - Schedule Priority: Default
+    - Schedule Window: Auto
+