Alerts

Audit log of every fired detection rule. Same alert 3× in 7 days auto-escalates to CRITICAL.