A Historical query pulls alerts only from the database; there is no interaction between the alert cache and a Historical query. There is no refresh of newer alerts because the Historical Threat Analyzer only requests alerts from a specific time frame. Any alert file alteration (acknowledgement, deletion, and so forth) is simultaneously saved to the database. Thus, the Historical Threat Analyzer can pull and push alert records directly from the database.