What problem would this alarm address? Are these 5 devices related or just any 5 out of the whole pool of devices? Why 5? Does that meet an SLA metric?
I'm just digging to try to get an idea on how to solve this.
you could do a custom sql and use
where Nodes.NodeID = <PUTORIONNODEIDHERE> and (select COUNT(*) from Nodes where nodes.Vendor = 'Cisco' and [Status] <> 1) > 4
and that should do what you want. Not very pretty, cause the alert is on the orion server (or some other node). Oh, if you don't put a node in there and just clear it out, every node will trigger that alert once 5 cisco devices are down.
Let us know if netlogix's resolution works for you.