alerts.cfg rules for specific files, libs, ports and procs?

Hi folks,

Is it possible to write rules for alerts.cfg that are triggered not by  
state changes for services, such as imap or http, but instead for  
specific files, libs, ports and procs? If so, what would they look like?

Thanks,

Jaap