The email for less than X messages is useful for other issues not necessarily direct KSS errors. If you normally get 1000 messages in 5 minutes and only got 10 there may be an issue(network, sending hosts, FW, etc).
The service and/or process monitor are the most important. Then the log file. Most errors will end up crashing/stopping the service. Some will leave it in a running state but not processing(rare). We don't alert on just "error" anymore since some errors don't have an impact.
Our current strings are:
FlushCacheLines <Encoding Failed>
Out of String Space
INTERNAL PROGRAM ERROR
Automation Error
Unspecified Error
mswinsck.ocx Error
Unable to determine remaining space on drive C:
Unable to open
Unable to bind