I was inspired to make this post after a new alert i created fired off 400 emails when it was activated.
This is pretty straight forward. When you create a alert (in this particular instance it was for admin status changes on critical interfaces) the behavior of the alert when it is activated needs to be a little more intelligent.
The purpose of the alert is to alert on changes in an environment.
If there are users that find this behavior useful then at least prompt the user at the time the rule is implemented to allow allow the user to decide which behavior meets their needs. Option 1. Alert on all current matching conditions, Option 2. Alert based on future changes once the rule is activated.
