Events in the last 24 hours

If you want past_24h you could create a custom macro , e.g " past_24h ": “DATE_SUB(NOW(),INTERVAL 1 DAY)”

https://docs.librenms.org/Alerting/Macros/
or, perhaps easier to specify it in the alert directly like this Realtime syslog alerting

You might need to fix the timestamp bug Alert rule: syslog.timestamp check bug? and I think you can just use contains, instead of Regex