...

The alert can be added to current variables being polled from the devices, or a new section can be added.  For example a new section in Model->system->sys could be added which might look like this, the --snip-- indicates that extra model code has been removed, this is provided as an example of the context for where to add this to the models.

%hash = (
  --snip-- 
  'system' => {
     --snip-- 
    'sys' => {
      'alerts' => {
        'snmp' => {
          'tcpCurrEstab' => {
            'oid' => 'tcpCurrEstab',
            'title' => 'TCP Established Sessions',
            'alert' => {
              'test' => '$r > 250',
              'event' => 'High TCP Connection Count',
              'level' => 'Warning'
            }
          }
        }
      },
       --snip--
    }
    --snip--  
  }
  --snip--    
);  

Adding the alert also adds the information to the "Device Details" panel, so you get the last polled value displayed all the time.

Image Added 

Example

The following is an example of the layout of an alert (in this example serialNum is taken from Model-CiscoRouter.nmis) and uses a string based (stringwise) comparison:

'serialNum' => {
  'oid' => 'chassisId',
  'title' => 'Serial Number',
  'alert' => {
    'test' => '$r ne "SomeSerialNumber"',
    'event' => 'Serial Number Invalid',
    'level' => 'criticalCritical'
  }
} 

$r in this case is the value of the OID chassisId.  This will raise the event "ALERT: Serial Number Invalid" when the oid chassisId is not equal to "SomeSerialNumber. 

...

'cipSecGlobalActiveTunnels' => {
  'oid' => 'cipSecGlobalActiveTunnels',
  'title' => 'Global Active Tunnels',
  'alert' => {
    'test' => '$r == 0',
    'event' => 'No tunnels present',
    'level' => 'criticalCritical'
  }
}       

Another example might be to check the number of TCP Connections to a server and alert when it is higher than 250.

 'tcpCurrEstab' => {
   'oid' => 'tcpCurrEstab',
   'title' => 'Current TCP Established Sessions',
   'alert' => {
     'test' => '$r > 250',
     'event' => 'High TCP Connection Count',
     'level' => 'Warning'
   }
 }

Adding the alert also adds the information to the "Device Details" panel, so you get the last polled value displayed all the time.

...