If stating that the alert must persist for more than X amount of minutes, is there a way to show the time that the event originally happened? (not the alert trigger time)

celesteflan

I know that there is a variable for alerts that shows the Trigger time for the alerts, but because a few of our alerts wait 5 or 15 minutes, that time does not accurately reflect when the problem happened. Is there a formula, or SWQL function that I can use to change this time, or is there simply a variable I am overlooking?

If I didn't explain that clear enough:

Server goes down at 9:00AM

- alert trigger condition is set to wait 5 minutes before firing.

Server status is still down at 9:05AM. Alert triggers and sends email.

- Currently I have the variable "Alert Trigger Time" set to send in an email. This will record 9:05AM not 9;00AM when it originally went down. This makes sense, as it is the "trigger time".

For more accurate alerting, it has been requested that I show not just the alert trigger time but the time the system goes down.

Thanks for any and all help.