Extra alert information for the "Upstream or Downstream Flap" alert
This alert type is triggered when a upstream and or downstream only briefly (typically less than two minutes) appears with relation to your network, A “upstream” is generally an entity who provides you connectivity, and a downstream is generally considered a customer of yours.
In the case a upstream flap from a network that you would have not expected to supply you transit, it is likely that the flap was the result of a BGP route leak that got corrected fast enough to not fully trigger a “new upstream” alert.
You can read more about how bgp.tools detects these relationships by going to https://bgp.tools/kb/what-is-a-upstream