Automation that emulates "off" for entity that can only trigger "on"

Configuration
1

I have the Aeotec Multisensor 7. I’m trying to create an automation that sends a notification when a device has stopped vibrating after vibrating for more than 5 minutes. The sensor does not expose an entity for vibration but rather uses a notification. This means I can’t create an automation based on “vibration stopped” but only when it starts. I have this existing automation:

alias: Multisensor 7 Tamper Detection
description: ""
triggers:
  - device_id: abc123
    domain: zwave_js
    type: event.notification.notification
    command_class: 113
    type.: "7"
    label: Home Security
    event: "9"
    trigger: device
conditions: []
actions: []
mode: single

and it triggers as expected, at most every 60 seconds, when vibration is detected. So far so good

My end goal is to

  1. Send a notification
  2. When the device stops vibrating
  3. But only if it was vibrating for more than 5 minutes

Sometimes the device is bumped, so I don’t want to send a notification every time vibration stops.

How should I build this?

2

Make a template binary sensor with auto off set to 5 minutes. Then Use that as the trigger for the automation.