Hi,
In your case, you want to delay triggering an alert. This is not an out-of-box function. The goal of a monitoring tool is to inform you as soon as possible as an issue is detected.
Still, I think I understand why you have the requirements. My advice to you would be:
Create a custom MonitorType that allows overrides for interval frequency and samples. This will let you customize how often it checks the service state and how many service checks have to return “not running” before it alarms.