In the XC console, alerts notified in WAAP have the following fields:
"startsAt": "2026-05-18T13:27:23.531Z",
"endsAt": "2026-05-18T13:39:23.531Z",
in the JSON structure.

However, when configuring email delivery, this information is not sent. Thus, it is not possible to correlate an email with "status": "firing" with an email with "status": "resolved". Understanding that startsAt can be combined with other fields such as "vh_name" and "alertname" could be used as an alert identifier and thus monitor/automate the opening and closing of alerts.

In my case, I am specifically referring to the alertname APISecurityTooManyAttacks, but I believe it applies to all of them.