Replaces the whole set. Alerts are grouped by a rule's name rather than by its expression, so refining a rule that is already live keeps everything it has matched so far in one group. A rule with no name, a name already used, or an expression that will not compile is refused. Saving a change also re-deduplicates the alerts already stored, because a rule is usually written about a queue that is already full of one fault under several wordings - the response says what moved. Alerts somebody has acknowledged, assigned or closed keep their status and their link, so this never takes work out of an operator's queue.