Need a basic configuration to allow us to email whenever we get an alarm. Policies seem great until you have numerous policies forwarding events to a remote logger and trying to find a way to also alarm if the risk => 2. Seems like it would be an easy add in the administration settings to say if there is an alarm, email notification.
Also, for federated servers there are not events to generate a action on. So you cannot set the Federated servers to send a email notification on alarm. Maybe someone else knows a better way.