My team is being asked to change an alert situation if it occurs more than once during a short time period.
I've been playing around with the reboot alert, seems to work just fine but trying to capture repeat offenders over a short time is not obvious to us.
If something reboots more than once in a short time, we want to pop another message in the alert logs and events logs with a higher priority.
Any insight would help us move forward.