Refer to the severity definition and SLA to determine the alert severity.
Alerts refer often to a specific cluster (mainnet/sepolia) and a SuperChain Networks (Base,Mode,…):op, mode, …. other chain networks) Alerts should already come with a specific log filtering and dashboard that should already be helpful for the investigation.