Did you perform any Kibana updates recently?
RE: No
Do you mean by "balanced" that the ping went back to its normal/baseline ms but the alert is still in
activestate? How do you read/know the ping status?
When viewing more details of an active alert, this example shows an alert that has been UP for more than 10 minutes (according to my rule it should not be active), it should be marked as recovered