Follow assets, then set a threshold on any of the nine layers. Alerts arrive with the evidence that triggered them, not just a number.