nas: alarm_enrichment rule