Create alert when microsft third part service stopped and not return in the status started after 5 m

CliveWatson 

I modified the query, in my log i write 'RenderedDescription' :

Event
| where TimeGenerated > ago(60m)
| where Computer contains "BKE"
| where EventLog == "Application"
and EventLevelName == "Information"
// look for STOPPED only
// and EventID == 7036
and Source == "BiTXRDeq"
// example of the xml: <Data Name="param1">WMI Performance Adapter</Data><Data Name="param2">running</Data><Binary>77006D006900410070005300720076002F0034000000</Binary></EventData></DataItem>
| parse kind = relaxed EventData with *'<Data Name="param1">' Windows_Service_Name '</Data><Data Name="param2">' Windows_Service_State "</Data>" *
| sort by TimeGenerated desc
| project Computer, RenderedDescription, TimeGenerated
 
Because if I use :

| project Computer, Windows_Service_Name, Windows_Service_State, TimeGenerated

I don't have any rows. I don't have Windows_Service_Name and Windows_Service_State compiled.

Even with query modified the problem remaining because i've always 2 rows, one stop service and one start service. 

I did a restart service test and I 've 2 rows in event viewer; i think i need a query that discard this situation on restart service and notify me when I've only more stop that start in the same TimeGenerated .

I hope explained better the situation
thanks