Yes, this exactly. And to expand on what happens around that: - monitoring system picks up irregularity (smoothed over some window of time, which delays alerti

Yes, this exactly. And to expand on what happens around that: - monitoring system picks up irregularity (smoothed over some window of time, which delays alerting) - alert propagates to humans - humans may take time to notice alert (even a page takes a few seconds to read) - humans make decisions, may need to talk to other humans (all of what you said above) - humans evaluate correct procedure, double-check it (you don't want them making the wrong "fix" and making something else worse, do you?) - humans execute commands - commands take time to run on large collections of computers (running them completely in parallel can cause thundering herd issues, in some cases)