An anomaly alert will always have the following events:
Alert started (=1 event)
Alert updated (>=0 events)
Alert closed (=1 event)
For instance, we can have an initial anomaly alert started with timestamp 2024-01-04T03:55:00Z and only HeapMemoryUsage is affected. At 2024-01-04T04:30:00Z there is an anomaly alert update, that now also includes AverageExecutionTime. At 2024-01-04T04:47:00Z there is an anomaly alert closed, meaning that both metrics are back within their normal ranges and the alert is ended.
...