Just now getting around to setting up MOM 2005. I ran across this interesting article for setting up security alerts. It was written by no other than John Hann: http://myitforum.techtarget.com/articles/2/view.asp?id=7845. There are, of course, flaws, in the article which we've come to expect from Hann... but it does give some great direction on setting this up. :) Just kidding John. Just remove that pesky Event 639.