Report on Alerts to include Downtime

Try this, I commented out a custom property

SELECT 
    NodeName AS [Node Name],
        '/Orion/images/StatusIcons/Small-' + StatusIcon AS [_IconFor_Node Name],
        DetailsUrl AS [_LinkFor_Node Name]--, Nodes.CustomProperties._Group as [Group],
        
,MAX(tolocal(DOWNEVENT.EVENTTIME)) AS [DOWN TIME]
FROM ORION.NODES NODES
INNER JOIN ORION.EVENTS DOWNEVENT
ON NODES.NODEID = DOWNEVENT.NETWORKNODE
WHERE STATUS = 2 
GROUP BY NodeName, StatusIcon, DetailsUrl--, Nodes.CustomProperties._Group
--ORDER BY NodeName
ORDER BY [DOWN TIME] DESC

I use this SWQL in the custom query widget to see how long all my alerts were active.

github.com/.../Alert SLA

This was my replacement to the out of the box Node Down resource as I needed the time in it that the node went down, and my exclusion list was getting too long on that resource and it is way easier to work on within the SWQL query. I also included our SNow assignment group so our NOC could see when they went down and what team the node belongs too. The query mesverrum  provided below is also an excellent view.