alerts.cfg rules for specific files, libs, ports and procs?

Hi folks,

Is it possible to write rules for alerts.cfg that are triggered not by
state changes for services, such as imap or http, but instead for
specific files, libs, ports and procs? If so, what would they look like?

Thanks,

Jaap