If process is not running, user name cannot be obtained hence $user is not expanded in ?Process down? alarm.
Therefore at present it is not supported by the probe.
However there is a workaround (not recommended when a process is being accessed by multiple user)
Please see processes.docx attached to article