Breach notification are almost always used associated w/ SLAs, 'about to breach' and 'breached'. It seems logical that this would be incorporated directly into the SLA configuration screen. Something like this...