From what you’re saying, the “alert” part is less important than the “tied to runbooks” and “automate” (Which is why I’m circling around SOAR)