If you have a pair of high availability devices and are not able to monitor the cluster service directly, you could test the service availability on each of the devices belonging to the cluster and then escalate the events if the services are no longer available on both devices.

import re
 
def escalatecheck(dev1,dev2):
  if evt.device == dev1 or evt.device == dev2 and re.search(repattern,evt.summary) and evt.severity != 0:
    events = dmd.ZenEventManager.getEventList(where="device='" + dev1 + "' and summary like '% " + pattern + "%'")
    dev1count = 0
    try:
      for e in events:
        dev1count += e.count
    except:
      dev1count = 0
    events = dmd.ZenEventManager.getEventList(where="device='" + dev2 + "' and summary like '% " + pattern + "%'")
    dev2count = 0
    try:
      for e in events:
        dev2count += e.count
    except:
      dev2count = 0
    # adjust the amount of events needed per device here. with a count > 3 it will take about 20 minutes until the events get escalated
    if dev1count > 3 and dev2count > 3:
      evt.severity = 5      
 
# pattern the event escalation is based on
pattern = "HA Service failed"
repattern = r'.*HA Service failed.*'
 
# define the two servers which should be checked cross-over
dev1 = "server1.example.com"
dev2 = "server2.example.com"
 
# call the function
escalatecheck(dev1,dev2)