How are the servers managed in Orion. It these are Windows servers managed via SNMP the list of processes can be 2 minutes or more behind the CPU alert since Windows only updates its statistics via SNMP every two minutes. I would recommend instead managing the nodes via WMI which does not exhibit this problem.
As for orioncrack's statement, this too can be done in SAM using the Advanced Alert Manager, but is significantly enhanced with the new web based alert manager included in SAM 6.2 which is currently in beta. There you will be able to combine metrics from virtually any Orion product to concoct the perfect blend of logic and reasoning that signals an issue for a particular server, application, whatever.