Do you own NetFlow Traffic Analyzer (NTA)? If not, NPM doesn't have enough information about what is using the bandwidth to know this. If you do have NTA, the Top Talker with High Utilization alert is built in.
I see what you mean which I'm guessing is the 'High Receive Percent Utilization with Top Talkers' built in alert. I can't get this to work however. It's set by default to email a web page and when I go to test it, I get the email but the web page is a login page with a "Login Failure":
I have tried to set the 'Web Server Authentication' in the alert but it still gives a login failure.