Imagine a strategy that stops when the alarm becomes terminal, but has multiple tactics with one tactic starting/stopping on state 'active'/'inactive'.
The tactic could be triggered multiple times as long the alarm isn't acknowledged.
It would be helpful showing the time the alarm became active in every instance and not just the first time.
multiple timestamps are available on the WIN-911 alarm event; the vtq\eventtime would seem to work for this purpose.