I've looked at http://thwack.solarwinds.com/message/155034 and it seems to indicate that the field "Hardware" under Node Details in NPM is a derived value.
I'm looking for a way to put the value physical or virtual into the alert, so our system admins know whether the alerting node is a physical box or a VM. It seems the solution is probably SQL, but I'm willing to work with it whichever way.