Severity escalation starts when the device goes offline and continues as long as the alert status is not "closed." The recommended severity escalation is to go in order from the lowest level of "info" to the highest level of "critical" (info, warning, error, then critical).
It is recommended that you do not set time intervals between escalations for less than five minutes to avoid possible issues in situations where a large number of devices goes offline at the same time. For example, if you set up an alert policy to send an "info" alert when a device is offline for 10 minutes, do not set up the next escalation alert ("warning") for 30 seconds later.