We are attempting to move AD/Exchange/SharePoint from SCOM to SAM. In regards to AD monitoring there are many "offsetting" event ID's. As an example event ID 4013 will trigger and event ID 4 will clear it. I attempted to replicate this in SAM via triggering and reset conditions and was told by development this is not possible as the triggering object and reset object must be the same.
The details can be found in ticket # 1211858
