Can you post the whole alert rule with Max, Delay, Interval any mapped devices etc
I see you had some issues before with ports_down on the dashboard Dashboard Port down Count incorrect to make sure its not related, can you login to the devices and check the timestamp when the ports went down?