I can’t think of any easy way to do this.
Unfortunately you can’t create a global collection on an alarm attribute. You could probably achieve it with scripting and/or a Watch. A watch would need to be done on every interface though, so that could potentially introduce a perf issue. For scripting you could use a REST query or cli and then when the timestamp of the alarm is 4 days old create the associations from the device to the GC via CLI…