So it sounds like you may have turned on an alert to notify you regarding any changes to services?
Tracing an alert event back to the rule that triggered your message is kind of a beast in LEM, you might be able to figure it out by looking at the internal lem events filter on the monitor tab to see when the alert fired and i think it lists the ruleid, but i suspect I would just go directly to the rules and hunt through them looking for anything that looks like it would be tracking windows service audits.