When all alerts associated to "Alert Storm Detected" have been closed (assuming that they are monitor-based alerts), update resolution state for the "master" alert to 254 (resolved).
Pseudo logic:
Find open master alerts (Alert Storm Detected:)
Get the internal incident number
Find all alerts with the matching incident number
If all alerts with the matching incident number are Closed, then update resolution state for master alert to "Resolved"
When all alerts associated to "Alert Storm Detected" have been closed (assuming that they are monitor-based alerts), update resolution state for the "master" alert to 254 (resolved).
Pseudo logic: