So, as per subject line ... It is a long shot and I am not sure what others think - so, please share your thoughts. I have a feeling this is not an easy one for product team, so, no expectations 
At the moment I do this with SQL scripts by simply summing up last few records (or records over the last XX minutes/hours) and then I would calculate average and use this in my condition. Works ok in SQL, but I am more and more inclined to use standards feature-set to be able to achieve what I want. Customising deployment is ok, but not ideal long-term due to limited support and possibility of schema changes, etc
For example, my CPU alerts/reports behaves as follows:
* Check node is UP
* Use default AVG window (1 hour), unless override configured with special custom property, which allows to change this window per node
* Trigger if all below are true:
- AVG over defined window is more then threshold
- MAX value within default window has breached threshold (in my opinion this is better then to have alerts on delay, simply because on delay every new poll can reset the counter, whereas in this case it will persist over time window)
So, I will probably be ok with dropping MAX and using trigger delay instead (a bit of a compromise here), but I cannot drop AVG.
I have similar logic for many other alerts/reports, where AVG is used to determine trigger condition
