Methods and systems for defining and distributing information alerts include presenting a user with a series of templates that allows the user to define security events, information alerts to be triggered by the events, and intended recipients for the alerts. Intended recipients for the alerts are presented with templates that allow the individuals to input contact and schedule information for receiving the information alerts. A knowledge switch uses the event definitions and the contact and schedule information to detect events and distribute the information alerts to the intended recipients when an event occurs. The information alerts include directives that instruct intended recipients regarding action to be taken in response to a security event.