How frequently should this rule's thresholds be reviewed? - What backtesting methodology would you use to validate the rule before deployment? - What does an acceptable alert rate look like (alerts per week, expected conversion to STOR)?