Yeah I ended up opening a ticket and that is what we did. First off it seems the Real-time event log viewer, service control manager etc are permission based in the SAM settings. I couldn't figure out why I couldn't see those. I figured since I was an admin that I would see all features. From that I found an article saying you could view the event logs and launch a wizard from that to create alerts.
But the way we did it was just go into Advanced Alerts and create a component alert as you mentioned.
Trigger Condition:
Node Status is not equal to Down
Component Status is equal to Down
Component Name is equal to User Account: Account was locked out
Trigger Actions: Email
In the body of the email we put ${WindowsEventMessages}
I would give aLTeReGo full credit if I hadn't already used tech support.
Thanks