NTA alert on single conversation?

I did something similar, but I set it to look at the interface first then check for no traffic. I am pretty sure I borrowed some of this from another post when I was working on it. You might find more in thwack if you keep searching. I will paste it below as a starting point, hopefully it helps.I created this a custom swql alert that had the interfaces entity selected. You could also create a chart/report on the same query to check your status historically too. The interface ID and Entity ID are set to xxxxx and you will need to update them with your interface id. These should match. 

SELECT Interfaces.Uri, Interfaces.DisplayName 
FROM Orion.NPM.Interfaces AS Interfaces
INNER JOIN (
    SELECT DISTINCT InterfaceID FROM Orion.Netflow.Source
    WHERE LastTimeFlow < AddMinute(-10, GETUTCDATE()) 
        AND Enabled=True 
        AND (
            EngineID IS NULL OR 
            EngineID NOT IN 
            (
               SELECT EngineID FROM Orion.Netflow.FlowEngines
WHERE FlowCollectorKeepAlive < AddSecond(-90, GETUTCDATE()) OR
AddMinute(12, FlowCollectorStartTime) > GETUTCDATE()
            )
        )
        AND InterfaceID IN (xxxxx)
        
) as Source
ON Source.InterfaceID = Interfaces.InterfaceID
WHERE Interfaces.InterfaceID NOT IN (
    SELECT EntityID FROM Orion.NetObjectDownTime
    WHERE EntityType = 'Orion.NPM.Interfaces'
          AND DateTimeUntilNow > AddMinute(-10, GETUTCDATE())
          AND State = 9
          AND EntityID IN (xxxxx)
)