Framework for monitoring a CAP aggregation and taking alerting actions based on user-specified policy