Hi Sky2830,
this can be achieved by changing of component's setting 'If a match is found in a polling period, component status is:' to 'Based on Event Types'. In such case 'Windows Even Log Monitor' changes its status based on event types. After that you can use component status in your alert.
