We use an email account in a similar way with seven categories of alerts:
Application and COM invocation email alert rule.
Critical events (agent or MC problems)
Malware related event email alert rule
Portscan event email alert rule
Significant Network Event email alert rule
WSUS failures (goes to Service Desk to fix)
Suspend Agent event email alert rule
The thresholds and events are defined in the event sets and we filter false positives using email rules. You could probably do the same for Global Event correlation and portscans and use a pager.
The challenge is making it only notify you if you need to be notified so you don't start to ignore it.
Tom
