Start with the overall monitoring workflow.
Resolve known RMON problems.
Apply a user-level security baseline.
Configure alert channels and delivery.