How should we actually configure thresholds and alerts for sites?

Set per-site thresholds for data usage (e.g., warn at 80% of plan, critical at 95%), and add separate alerts for uptime and remote-management activity. Tie each site to a simple escalation path (who is alerted first, and what to do if unresolved). Use a centralized dashboard to review site-by-site readings. Keep thresholds stable for a monitoring window of 2–4 weeks to learn patterns, then adjust. Use delta data and site-level views to reduce noise; consider a pooled data plan with per-site caps if you need flexibility. Finally, test thresholds against real incidents rather than relying on plan quotas alone.