Alerts tell you what to read
An alert should give its reader a useful first investigation, not merely a red indicator. Name the observed condition, affected scope, persistence window, responsible team, and next evidence to inspect. These details are part of the rule’s behavior: test them with the trigger instead of treating notification text as decoration added after the incident. ...