The process is very similar to monitoring standard Windows events, however, specific details are needed to properly collect the event as the Source and Log name may differ from what it displayed in the Windows event viewer. When adding your Log and Source you must open the details of the Windows event in XML view.
Now proceed to locate the entry for Provider Name, this will be the event Source name entered into your monitor. It will appear similar to the following:
Now you will need to locate the Channel entry, this will be the Log name entered into the monitor. It will appear similar to the following:
Once this information has been properly added, save the monitor and if possible use event create or generate the event through other means to test the alert.