The engine sees it first

Two things can start an incident. The health score crosses one of its floors, or an endpoint check fails twice in a row. Both are deliberate: a score crossing means the machine is deteriorating from the inside, a failed check means something outside can already tell.

Two consecutive failures rather than one is the difference between monitoring and noise. Any single check can fail for reasons that have nothing to do with your service — a dropped packet, a DNS hiccup, a probe region having a bad second. Requiring the failure to repeat costs you one interval of delay and removes most false pages.

The floors are 35, 60 and 82. At 35 the machine is worth watching and nothing else happens. At 60 something is genuinely wrong and evidence collection begins. At 82 an incident opens on its own. You can move them, but the defaults are where the tradeoff between early warning and false alarms actually sits.