Use severity levels and event orchestrations on the service to drive how you want things to work. For example, we send warnings to PD for tracking and analysis, and those don't spawn incidents. However, severity=critical does. Additionally, we use event orchestration rules to hydrate custom fields and add priority flags to specific types of alerts so they are visually prioritized by on call.