You probably haven't added any data collection rule to get the foreground app of the target device.  Hence, no comparison can be made and no alert generated.

As the shortest configurable sampling interval is every 2 minutes and the data reported by Google's system firmware is delayed to protect the privacy of device end-user, your chosen comparison of "not Equal" will likely lead to many false positive alert and the timestamp can just be considered an approximate value.   

Thanks for your answer, however alert rules do not require data collection rule. Data collection is implicit when the rule is enabled.

Also I could not see a data collection rule for "App in foreground".

It is really very interesting that you think data collection is always implicit when an alert rule is enabled.  

It is even more interesting that you cannot find the "App in Foreground" item in Data Collection rule, unless you are looking for it in platforms other than Android.

I apologize. I did not see the "App in Foreground" in the available items list because it was already added to my data collection rule. I can see that it has been recording data. So basically the data collection prerequisite was already fulfilled.  I even tried setting the rule as "Equal" instead of "Not Equal" but I still did not get the alert triggered for any of the devices. 

Have you checked from the data-collection tab to see what foreground app bundle-ID were returned to the server?

I don't know what device, Android firmware version, and agent/server version you are using.  If I remembered correctly, I had successfully completed some tests 1-2 years ago.

However, a moment ago,  I did my test again with an Android 6.x and an Android  8.x Samsung phone using latest v13.4 MobiControl server, and did found a few problems :

(1) There seems to be change in app permission model, resulting in empty string returned by Mobicontrol device agent except when the device agent itself is the foreground app

(2)  The "contain", "equal" and "not equal"  comparison failed  to trigger an alert even when the compared string is the device agent's bundle-ID returned and shown in the data-collection tab.

If (2) is the only problem,  reporting this to Soti can get a patch to make the comparison work and an alert triggered, which should be straightforward.  A few years ago, I reported a similar problem related to string comparison on another event/status in Alert rule for a v11 Mobicontrol implementation, and did get a patch version working afterwards.

However,  (1) implies that no meaningful foreground app bundle-ID can be retrieved possibly due to privacy concern.   I have to further investigate if I have forgoten to turn on any extra permissions for MobiControl somewhere within Settings.   If  the required permission cannot be granted, getting foreground app will no longer be meaningful. 

I do get the bundle ID correctly from the Data Collection rule so I believe my issue falls into case (2). Currently we are using MobiControl v13.3, the devices are running Android 5.0.2 with latest Samsung agent. Will be upgrading Mobi Control to latest v13.4 tomorrow.

Thanks.

As my test shows that comparison in the latest v13.4 does not seem to work, there's probably no need for you to rush to an upgrade.

Since you said you can get meaningful apps bundle-ID from data collection rule on your Android 5.x device, I believe your next move is to try the "contains" comparison.  I suspect that Soti developers incorrectly use numeric comparison operations instead of string comparison operations needed.  If "contains"  comparison works for you, then you can use it for now, and  just report to Soti about incorrect comparisons done for the "equal to" or "not equal to" option. 

As a precaution, I suggest you not to upgrade the device to Android 6 or later, just in case you cannot successfully use this type of alert due to possible app permission problem.

I've tried with "Contains" but that did not make any difference. I checked the logs but do not see any evidence that this rule gets fired at all.