Alerting
Review incidents and manage the rules that create them.
Alerting is where users move from passive visibility into active triage. Documentation should separate incidents from rules and explain the operator’s next action in each case.
Incidents
Use incident screenshots to show queue review, severity, and the expected operator response.
Rules
Explain how rules define alert conditions and how users should edit them safely.
Next Actions
Alerts often lead into approvals, workflows, or direct follow-through. Link to those areas clearly.