Hi, simplest way to achieve that without JS nor customization :
(I'M on a french version, maybe the translation of admin nodes items will not be accurate)
admin -> notifications -> activity notification -> create a new one and call it Major Incident
You can link your notification rule.
admin - notifications - activity association -> create a new one for major_incident and link the previously created activity notification
This way, the previously created activity notification will be "triggered" instead of "Field update"
Please note that your activity notification will be "triggered" only when major_incident is updated.
So it's easy to catch the "check" and the "uncheck". This way you can send notification for the beginning of a major incident, and for the end of a major incident.
Hope this helps