Can i do this in the product today or would it have to be an alert developed outside of Cribl Stream?
This is not currently native to Cribl as of 3.4, so youd have to alert from an outside platform. Right now, these are the conditions you can alert on from Cribl:
Further Reference: Notifications | Cribl Docs. There are plans (per the documentation) to enable more triggering conditions and time resolutions in the future.