Back to normal alert

Yes, see here for example:

Graylog got (the now optional) stateful alerts. This means, Graylog will only send one alert notification if an alert has been triggered and will then wait until the alert has been resolved plus the grace period for it to start checking the condition again.

Greetings - Phil