I’m not familiar with services having a state of “unknown” instead of the regular ok, warning or critical, but the default service alerts which I use for warning and critical (from the example alerts) simply test for services.service_status equal to 1 for warning or 2 for critical.
In that case you should just be able to test if services.service_status equalling 3, if that is indeed the correct value for “unknown”.
Alerts “recover” when the triggers no longer match.