Yes, you need to look at the Orion database to get CPU metric per core:
SELECT n.Caption ,cml.TimeStampUTC ,cml.CPUIndex ,cml.MaxLoad ,cml.AvgLoad
,'/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N:'+CAST(n.NodeID AS varchar(256)) AS [DetailsURL]
FROM CPUMultiLoad cml
INNER JOIN NOdes n ON n.NodeID = cml.NodeID
WHERE cml.NodeID = <NodeID of server in question>
AND cml.MAxLoad > 99
AND TimeStampUTC > DATEADD(mi,-10, getdate()) --you may need to play with the DATEADD to correct for your timezone
ORDER BY TimeStampUTC DESC
This will show any core that has exceeded 99% utilisation in the past 10 minutes (if you are in UTC).
Next you need to wrap this into an alert, a little harder, as the node alerts need to based form the node table. Open the Alert Trigger condition, set it to Custom SQL Alert (Advanced) and you'll see what i mean.
Select Node in the Set up your SQL condition and try this SQL under neath the pre populated grey box:
INNER JOIN CPUMultiLoad ON Nodes.NodeID = CPUMultiLoad.NodeID
WHERE CPUMultiLoad.MAxLoad > 99
AND CPUMultiLoad.TimeStampUTC > DATEADD(mi,-10, getdate())
it should look like this:
That will trigger when any device, with multiple cpu cores, exceeds the 99% utilisation.
Obviously, adjust the timezone and threshold to suit your environment and requirements.
I hope it helps