You're trying to build a rule off "AnyAlert" which is a problem for a number of reasons, not least of which is that not every alert has that field.
Replace all your "AnyAlerts" with "ServiceWarning" events, and you'll be able to find the field you want.