1. Do not use "process all thresholds" - it should work as expected without that option.
2. Use more complex condition for last threshold - exclude all explicitly checked values.
3. Use different deactivation event for last threshold.

Best regards,
Victor

I did just remove last(1) == On Line with UPS_ONLINE being both the activation and deactivation events, and that seemed to have resolved the issue. Should I not have that line in there, or should it be listed?

2023.06.13 22:51:59.301 *D* [event.corr        ] CorrelateEvent: event UPS_ONLINE id 424636 source Tech Server UPS [1075]
2023.06.13 22:51:59.301 *D* [event.corr        ] CorrelateEvent: finished, rootId=0
2023.06.13 22:51:59.301 *D* [event.proc        ] EVENT UPS_ONLINE [100037] at {0} (ID:424636 F:0x0001 S:0 TAGS:"") FROM Tech Server UPS: UPS is On Line
2023.06.13 22:51:59.301 *D* [event.policy      ] EPP: processing event 424636
2023.06.13 22:51:59.301 *D* [event.policy      ] Event 424636 match EPP rule 54
2023.06.13 22:51:59.348 *D* [event.policy      ] Action 1 execution blocked by timer "UPS_Abnormal_0x00000433" key
2023.06.13 22:51:59.348 *D* [event.policy      ] Delayed action execution with key "UPS_Abnormal_0x00000433" cancelled
2023.06.13 22:51:59.348 *D* [event.proc        ] Event 424636 with code 100037 passed event processing policy
2023.06.13 22:51:59.348 *D* [event.corr        ] CorrelateEvent: event UPS_ONLINE id 424637 source Tech Server UPS [1075]
2023.06.13 22:51:59.348 *D* [event.corr        ] CorrelateEvent: finished, rootId=0
2023.06.13 22:51:59.348 *D* [event.proc        ] EVENT UPS_ONLINE [100037] at {0} (ID:424637 F:0x0001 S:0 TAGS:"") FROM Tech Server UPS: UPS is On Line
2023.06.13 22:51:59.348 *D* [event.policy      ] EPP: processing event 424637
2023.06.13 22:51:59.348 *D* [event.policy      ] Event 424637 match EPP rule 54
2023.06.13 22:51:59.364 *D* [event.proc        ] Event 424637 with code 100037 passed event processing policy

So it appears that the timer is working, however I'm getting two 'UPS_ONLINE' events back-to-back, and the second one is the one that is triggering the e-mail. This is happening with multiple UPSes, so I can't say it is just this one device causing the issue.

I've tried on my system, everything works as intended.

Just in case, check that there is no other rule that could be interfering with that timer.

You can check in Configuration -> Scheduled tasks. If you enable showing of system tasks (under three dots menu), during your 120 second delay an entry should be visible with correct value in "Timer key" column.

You can also set debug level 7 for debug tags
event.*
scheduler
to monitor event processing and scheduled task execution in server log

configuration looks correct. We will test this and check if something is broken with the timers.

Best regards,
Victor