Trigger (When to look) + Rules (What to look for) = Action (Alert)

From events to alerts
Triggers
Define when the engine should wake up and analyze.
Rules
Define what must be true for an alert to fire.
Master this mental model. Most strategy issues are either the wrong Trigger (timing) or the wrong Rules (quality).