Following an unexpected server restart duplicate alerts may be received from InTrust Agent on the monitored server. The alert was generated following the server start-up but references events from before which were already alerted upon.
If the server reboot was somewhat abnormal and not letting the agent service process shut down gracefully, then this is an expected behavior. The data provider state (including the position in the corresponding event log that has been processed last) is saved when the agent service shuts down, meaning that if the agent fails to save it, then at next agent start all events since the time of the last gracefull agent stop or at least those events which are still present in the log at the moment will be processed again - as if they never were processed before.
Enhancement request ST71867 has been submitted to Development for consideration in a future release of InTrust.