Before creating automatic response rules, think about the actions you want the ePO - On-prem server to take.
Plan for these items:
The event types that trigger messages in your environment.
Who receives which messages. For example, you might not need to notify all administrators about a failed product upgrade, but you might want them to know that an infected file was discovered.
The types and levels of thresholds that you want to set for each rule. For example, you might not want to receive an email message every time an infected file is detected during an outbreak. Instead, you can choose to send one message for every 1,000 events.
The commands or registered executables you want to run when the conditions of a rule are met.
The server task you want to run when the conditions of a rule are met.