If you activated in the nas transaction logging you could use a query like:
---
select l.time, l.type, l.nimid, l.level, l.severity, l.message, l.subsys, l.source, l.hostname, l.prid, l.robot, l.hub, l.nas,
l.domain, l.suppcount, a.suppcount, l.visible, a.supp_key, l.nimts, DATEDIFF(DAY, l.nimts,l.time) durationdd, CONVERT(varchar(8), DATEADD(minute, DATEDIFF(minute, l.nimts,l.time), 0), 114) durationhh, l.sid,l.acknowledged_by, l.user_tag1, l.user_tag2,l.origin,l.assigned_by,l.assigned_to
from nas_transaction_log l
left outer join nas_alarms a on l.nimid = a.nimid
WHERE l.time >= DATEADD(hh, -1, GETDATE())
and l.message like '%threshold%'
order by l.time, l.suppcount
---
This will show you the exact detail of incoming messages.
Adapt the like statement to something unique in your message and check:
- severity: do you see a clear between the messages, perhaps somebody did an acknowledge?
- suppcount: like you only create a ticket when supcount = 2 (you didn't post the definition, so I assume it's "equal to")