I have a log source that sends an event when an alert is triggered
event.type: "Alert Started". Another event is triggered when the alert clears
event.type: "Alert Ended"
I'm looking to know how best I can retrieve a count of "active" alerts. i.e. number of alerts that has yet to receive an
Alert Ended event.