There is a known limitation about live queries that use join() functions — the details are explained at Join Operation and Optimization.

The limitation means that Legacy Alerts cannot be expected to work in combination with these particular query functions.

You should be aware of this when you intend to create an alert with join() functions, as the alert may not trigger as expected.

The UI warns you about this behaviour before you save the alert.

Figure 198. Warning Using Live join()

In such cases, creating a scheduled search instead would better achieve the expected result.