Security wants an immediate alert the instant three or more vault-vibration events occur within any three-minute span, evaluated continuously as each new reading arrives rather than only at fixed checkpoints. Which windowing function is designed for this kind of continuous, event-triggered evaluation?

A sliding window evaluates continuously: rather than emitting output at fixed boundaries or fixed hop intervals, it produces a new result every time an event enters or leaves the trailing window span, which makes it the natural fit for immediate, event-triggered detection like 'alert the instant three events occur within any three-minute span.' Only a sliding window checks the condition on every new arrival rather than waiting for the next scheduled boundary.

A tumbling window only reports once per fixed three-minute segment, so three vibration events that straddle a boundary — two in one segment, one in the next — would never trigger the alert even though they occurred within three minutes of each other, and even a correctly-contained burst wouldn't be flagged until the segment closes. A hopping window improves granularity over tumbling but still only re-evaluates at each hop boundary (here, once a minute), introducing up to a minute of detection delay rather than the truly immediate response required. A session window closes on a gap of inactivity, which is the wrong trigger condition entirely — it says nothing about counting events within a fixed span, so it cannot express a 'three events in three minutes' rule.

A caveat: sliding windows can emit on every event, making them the most compute-intensive window type, so a very high-volume stream needs capacity planning. Operationally, verify the alert path by injecting three test events within a three-minute span and confirming the alert fires immediately rather than after a delay.