For each event, decide: does this need someone called immediately, addressed during business hours, or included in a weekly report? If an event doesn't have a clear response path and owner, it shouldn't be an alert.