Interesting! Were the vpn's that showed down reported from just one device? Was the alert headline, "VPN Tunnel(s) down?" if so, it looks like there was one of two possible rules it could have been invoked. I suspect it is the latter one because it indicates that an alert will be issued if the timespan is 15 minutes, like what you mentioned.
"If a VPN tunnel is down for at least this amount of time, an alert will be issued.",
So the next step would be to look at the .ind script and see how the metric is being generated. Does the logic make sense or is there a special scenario that was missed? Take a look at the script and see if there is anything you can piece together. show-vpn-flow.ind