Maybe I am not explaining the event very well, as I don't thing an InternalAgentOffline.DetectionTime < InternalAgentOnline.DetectionTime would help, as the offline was already preceding the online.
Think of it like this. A PC has an agent, the connection is unplugged, therefore triggering an offline event as there is no communication from the manager to the PC. A few minutes later the connection is plugged back in, bringing the agent back online. This therefore resets the conditions. About 10 minutes later the whole process repeats, thus triggering a new alet every 10 minutes or so.
What our understanding is with the rule the way it is setup, that the Correlation is if you se an agent offline after 60 minutes trigger an alert. However if it is back online within 60 minutes do not trigger an alert. Therefore we should only see the alert once every hour if it keeps cycling up and down.