Pick a failure scenario, set your thresholds, see which rules fire. The goal: catch real incidents without paging on noise.