Why should alerting be based on user-facing SLOs rather than only on infrastructure metrics like CPU?

Infrastructure metrics can be noisy (CPU spikes during a GC pause or a batch job that don't affect users) and can also miss real problems (a service can have low CPU usage while still returning errors due to a downstream dependency failure). SLO-based alerts (error rate, latency percentiles, availability) directly measure what users experience, which both reduces false-positive alert fatigue and ensures the team is paged for things that actually matter to the business, with infrastructure metrics retained as supporting diagnostic context rather than the primary trigger.