You want to create multiple alarm actions to check for the same alarms different times. Three alarm actions are probably enough.
(Alarm Action 1)
(Alarm Action 2)
(Alarm Action 3)
The logic here is that Alarm Action 1 will catch the first mass failure and send out an email alert immediately. When the majority recovers, the remaining alarms will be caught by Alarm Action 2 if these alarms remain for 30 minutes in this example. The same thinking than follows for Alarm Action 3. You can keep going with Alarm Action X but three should really be enough.
Note: The time count is from the initial firing of the alarm. So the 30 minutes and 1 hour setup, in the example above, means we are checking at 30 minutes intervals twice.
