Incident email generation - how it works

Hi, I'd like to get some information about incident generation in dynaTrace (6.x). Let's say, I have an incident rule for a business transaction with a warning upper treshhold set to 5 seconds and a severe upper set to 10 seconds (for purepath response time). If i configure the incident rule to send email on incident starts AND incident ends, how many emails will i get if the incident is violated mutliple times in one evaluation timeframe? So let's say, my evaluation time is 10 seconds. These are the incoming bTs' max response times for every seconds of the evaluation timeframe: second No. - max resp time - expected outcome of the incident _____________________________________ second #1 - 4  seconds second #2 - 6  seconds - warning incident starts second #3 - 8  seconds - warning continues second #4 - 2  seconds - warning incident ends second #5 - 3  seconds second #6 - 7  seconds - warning incident starts second #7 - 11 seconds - severe incident starts (will this take over the place of the warning incident?) second #8 - 12 seconds - severe incident continues second #9 - 4  seconds - now what? both incident ends? or just the severe one (because the warning ceased to exist when the severe came) second #10- 3  seconds Is this correct? My main question is about the emails: I need one email for every incident start, and one email for every incident end (i'll calculate something from every started-ended email pairs i get). Important note: i need to see the "started"/"ended" words in the subject of the emails. How many emails am i going to receive with the above example? My thinking:  I'll get 4 emails:  Incident started (#2), Incident ended (#4), incident started (#6), incident ended (#9). Is that correct? Now, i have a problem: sometimes i don't get the emails with the subject "... incident ended" or "... incident started". Some of them have the subject like "Incidents, ..." and in the body of the email i see multiple incidents. My guess is when an incident occures (so a violation occurs) while the incident is active (so it already occured and didn't ended yet), the dT will send a summary email, instead of the "... incident ended" ones. Thank you for the help in advance! Best regards, Tamas