A NotificationRule routes events to channels by type pattern and minimum severity. A useful starter pack: a security rule (rotations, ceremonies, identity changes, audit-chain verdicts, brute-force detection), an availability rule (components, CRLs, expiring CA certificates), and an oncall catch-all at serious and up. Seven built-in rules ship enabled; you can add channels or silence them, but not change what they match — which is what lets the manual describe them and be right about your deployment.
The noise controls are what keep the channel readable. Recoveries always arrive: a rule matching component.offline also delivers component.restored, because an audience that saw the outage must see the end of it. A flapping condition is recorded but not re-delivered inside its window — one notify.flapping warning names the count instead. Failed logins coalesce into one message per minute ("17 failed logons, 3 usernames").
And learn the pair: auth.brute-force-suspected observes password guessing; auth.account-locked means goca acted and an operator is currently locked out. Route them differently — the second one is a person.
Now I can route what matters and suppress what repeats.