How can I prevent this scenario in the future – if a closed or ticketed event gets an update that would require an update/reopen – shouldn’t the occurrence counter be bumped instead or a new alarm opened?
By "reopen," it was meant that an APM triggered a new alert on same metric caused new alarm being raised in OI, but the lifecycle event was not handled properly in this case, resulting in older alarm fields being carried over to the new alarm.