This needs further information.
If you use your trigger like this
and
then say if a device goes down at 5am, you will get an email at 6am stating this device is down. But the email message will say that the device went down at 6am.
Or you can do your alert this way
and
In this scenario you will still get the email at 6am and it will still state the down time as 6am but in the Active Alerts window, you will see the actual time that the node went down. (I only have the email action in my Trigger Action and nothing else).
Either option will work for you. So if these 2 options don't work for you, then there's an issue elsewhere.