To understand how this works let's take a monitor with a 30-second check frequency, immediate confirmation period, and 1-minute recovery period.
When this monitor observers a downtime, it will create an incident immediately as the confirmation period is set to an immediate start. If the next check that comes after 30 seconds shows the monitor as available (up and working), it will start the confirmation period countdown. This will take 60 seconds, during which 2 additional checks are performed, and both need to be valid in order for the incident to resolve automatically.
If any of the checks fails during the recovery period the counter is reset and the monitor waits again for a valid check to start the recovery period again.