Top-down alerting by leveraging custom rules