<group name="windows,iis,">
  <rule id="110000" level="0">
    <decoded_as>windows</decoded_as>
    <description>custom-windows-event-alert</description>
  </rule>
  <rule id="110001" level="7">
    <if_sid>110000</if_sid>
    <id>^3005</id>
    <description>Windows unhandled exception has occurred.</description>
  </rule>
</group>