My advice configure a automatic response
Alert manager is very old-school. You need to utilise the events the machines will send to ePO anyway.
As mentioned, that's done via automatic responses & notifications.
Full instructions are in the ePO product guide, but basically:
Using the ePolicy Orchestrator Automatic response feature, you can configure your server to automatically trigger an action in response to various types of events; including threat, client, and server events.
The complete set of event types for which you can configure an automatic response depends on the software products you are managing with your ePolicy Orchestratorserver.
By default, your response can include these actions:
• Create issues
• Execute server tasks
• Run external commands
• Run system commands
• Send email messages
• Send SNMP traps