Makes sense, especially as I have a 2-week retention period.
Would you consider:
1. NOT purging "Open" Alerts like this.
2. Including the ORIGINAL Alert reference in the "Ended" email so it can be shown in the UI with one click.
3. Including a BIG BOLD "ALERT SPANS <LONG DURATION>" chunk of verbiage in the email to bring our attention to this kind of thing - I seriously don't have time to read every alert in detail so the more you can highlight "Weird stuff" the more help it is.
<LONG DURATION> should be anything more than the data purge period and optionally, configurable, perhaps, anything over X days. I typically only care about the ORIGINAL Alert email and not the Ended one for 95%+ of reported incidents - I investigate the original, deal with it, clear it, and move on. To be "woken up" so to speak, with really OLD NEWS is noise I don't need so anything you can do to reduce the noise level of Ended emails would be brilliant!