Rules for alarm management

Hi there,
I want to create an alarm dispostion rule that only takes place on a
certain Windows event ID. The only Condition used is "NT Server: SYSTEM
nonoperational alert" and the Advanced Setting for the VarBind value of the
EventID "leaf". Unfortunately all alerts of this type are being selected
by the rule instead of just the particular eventID. Does this feature
actually work as designed?

Cheers,
Kirk
Maule Systems Consulting