When an alert enters an alert state, the reported state will always be the highest measured level during the same alert state. This means that if your alert went into a critical state and returned below the critical threshold but above the warning threshold, the alert will still show itself as critical until the alert returns below the alerting state and clears.