You can't find it because there is no script section at the event rule or alert management rule level.
If it's something that you get multiple events for over a period of time, I'd look at thresholding in the event rule level.
While it is an interesting idea to attempt it at the alert management level based on created or updated time like you've attempted; I'm going to guess that fails you because the alert won't attempt to trigger another alert management rule until it is updated. So your initial not creating an incident immediately works, but then the alert would need to keep being updated until the time gets beyond your trigger.
I'd say the flow idea is still your best bet. But if you really don't want to create a pass-through flow that looks for your exceptions, you can also look at a business rule.
