1. A system, comprising: a field device configured to provide an alert, wherein the field device is configured to receive only a first plurality of behaviors for the alert; and a controller of an industrial control system, wherein the controller is configured to receive the alert and overlay a second plurality of behaviors on the alert, and the controller is configured to process one or more of the second plurality of behaviors differently than the first plurality of behaviors.