Opposite state override
Any state type rule or monitor should have an opposite override parameter. The two best examples are service and web site/app pools state. By default, alerts are created for those based on their state being down/disabled but you should be able to reverse that logic with a simple override (as in you want an alert if the state is up/enabled). So the override parameter could be a simple down/disabled by default but with a up/enabled option for services or web site/app pools that you want to alert on if they ever are up/enabled.