attached is a lua I wrote to fire on incoming alarms and check agains one or more triggers to see if they are also true for the source host. If so send on a new alarm, if not send a clear.
the case for this was a system sending start and stop job messages. There was a chance the job abended before the graceful stop. We could detect the missing job but had to correlate it with the required state. Given the number of machines involved this script was simpler than setting up multiple triggers for each machine.
It uses a library containing my version of the rawalarm function Carstein created. I have attached this too.
Hope it is of some use.