Define at least five alerts: - Error rate exceeds threshold - Response time exceeds threshold - Rate limit violations spike (possible attack) - z/OS Connect instance deregisters (node down) - SSL certificate approaching expiry