To get alert when a server is affected by external threat

Hi Aswin Thomas(UST,IN), I fully agree with Andrew about SCOM being an operational tool in nature. The only MP for SCOM that is security related is the one Andrew mentioned. It has been devolped by Nathan Gau, who is Senior Cyber Security Consultant with Microsoft and was previosly a SCOM PFE. This the download link: Nathangau/SecurityMonitoring @ GitHub It covers a variaty of common security related use cases/vulnerabilities. I have summed those up and included all the links to the details:  

• Using SCOM to Detect Successful Pass the Hash attacks (Part 1)
  https://nathangau.wordpress.com/2016/10/14/using-scom-to-detect-successful-pass-the-hash-attacks-part-1/
• Using SCOM to Detect Failed Pass the Hash attacks (Part 2)
  https://nathangau.wordpress.com/2016/11/18/using-scom-to-detect-failed-pass-the-hash-attacks-part-2/
• Using SCOM to Detect Overpass the Hash Attacks
  https://nathangau.wordpress.com/2016/12/15/using-scom-to-detect-overpass-the-hash-attacks/
• Using SCOM to Detect Pass the Ticket Attacks
  https://nathangau.wordpress.com/2016/12/13/using-scom-to-detect-pass-the-ticket-attacks/
• Who Disabled A Smartcard For Logon?
  https://docs.microsoft.com/de-ch/archive/blogs/allthat/who-disabled-a-smartcard-for-logon
• Security Monitoring: Using SCOM to capture Suspicious User Activity
  https://nathangau.wordpress.com/2020/04/21/security-monitoring-using-scom-to-capture-suspicious-user-activity/
• Security Monitoring: Updating Local Account Monitoring for GPO Enforced Settings
  https://nathangau.wordpress.com/2019/12/02/security-monitoring-updating-local-account-monitoring-for-gpo-enforced-settings/
• Security Monitoring: Update to Log Clearing Rules
  https://nathangau.wordpress.com/2020/04/02/security-monitoring-update-to-log-clearing-rules/
• Using SCOM to Detect Scheduled Task Creation
  https://nathangau.wordpress.com/2017/03/17/using-scom-to-detect-scheduled-task-creation/
• Security Monitoring–Updating Scheduled Task Creation Rule
  https://nathangau.wordpress.com/2018/08/15/security-monitoring-updating-scheduled-task-creation-rule/
• Security Monitoring–Updating Service Created on DC Rule
  https://nathangau.wordpress.com/2018/08/15/security-monitoring-updating-service-created-on-dc-rule/
• Using SCOM to Detect Golden Tickets
  https://nathangau.wordpress.com/2017/03/08/using-scom-to-detect-golden-tickets/
• Breaking apart the GPO Modification Process and Using SCOM to Detect GPO Changes – Part 1
  https://nathangau.wordpress.com/2017/04/17/breaking-apart-the-gpo-modification-process-and-using-scom-to-detect-gpo-changes-part-1/
• Breaking apart the GPO Modification Process and Using SCOM to Detect GPO Changes – Part 2
  https://nathangau.wordpress.com/2017/04/19/breaking-apart-the-gpo-modification-process-and-using-scom-to-detect-gpo-changes-part-2/
• Breaking apart the GPO Modification Process and Using SCOM to Detect GPO Changes – Part 1
  https://nathangau.wordpress.com/2018/09/04/security-monitoring-using-scom-to-detect-executables-run-in-writeable-os-directories-part-1/
• Breaking apart the GPO Modification Process and Using SCOM to Detect GPO Changes – Part 2
  https://nathangau.wordpress.com/2018/09/06/security-monitoring-using-scom-to-detect-executables-run-in-writeable-os-directories-part-2/
• Breaking apart the GPO Modification Process and Using SCOM to Detect GPO Changes – Part 3
  https://nathangau.wordpress.com/2018/11/08/security-monitoring-using-scom-to-detect-executables-run-in-writeable-os-directories-part-3/
• Security Monitoring–Configuring SCOM to alert on attempts to kill Windows Defender
  https://nathangau.wordpress.com/2018/09/06/security-monitoring-configuring-scom-to-alert-on-attempts-to-kill-windows-defender/ 
• Security Monitoring–Using SCOM to Detect Legacy TLS Protocol Usage
  https://nathangau.wordpress.com/2018/09/13/security-monitoring-using-scom-to-detect-legacy-tls-protocol-usage/
• Security Monitoring–Additional PowerShell Detections
  https://nathangau.wordpress.com/2018/09/07/security-monitoring-additional-powershell-detections/
• Using SCOM to detect WMI Persistence Attempts
  https://nathangau.wordpress.com/2019/03/06/using-scom-to-detect-wmi-persistence-attempts/
• Security Monitoring: Using SCOM to Detect Remote WMI Attempts
  https://nathangau.wordpress.com/2019/03/15/security-monitoring-using-scom-to-detect-remote-wmi-attempts/
• Security Monitoring Distributed Application: Monitoring Audit Settings
  https://nathangau.wordpress.com/2019/01/10/security-monitoring-distributed-application-monitoring-audit-settings/
• Security Monitoring MP: Powershell Exploit Toolkit Rules
  https://nathangau.wordpress.com/2017/05/24/security-monitoring-mp-powershell-exploit-toolkit-rules/
• Security Monitoring: Using SCOM to Collect LAPS Events
  https://nathangau.wordpress.com/2018/01/04/security-monitoring-using-scom-to-collect-laps-events/
• Security Monitoring: Using SCOM to detect NTLMv1 and LanManager Authentication Types
  https://nathangau.wordpress.com/2018/02/26/security-monitoring-using-scom-to-detect-ntlmv1-and-lanmanager-authentication-types-2/
• Security Monitoring: Using SCOM to Detect SMB1 Authentications
  https://nathangau.wordpress.com/2017/11/13/security-monitoring-using-scom-to-detect-smb1-authentications/
• Updating GPO Monitoring in Security Monitoring for MSFT AGPM
  https://nathangau.wordpress.com/2018/03/26/updating-gpo-monitoring-in-security-monitoring-for-msft-agpm/
• Using SCOM to Capture Registering Remotely Located DLL Files
  https://nathangau.wordpress.com/2017/05/25/using-scom-to-caputre-registering-remotely-located-dll-files/
• Security Monitoring: A Possible New Way to Detect Privilege Escalation
  https://nathangau.wordpress.com/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/
• Security Monitoring: Detecting Wdigest Authentication
  https://nathangau.wordpress.com/2017/11/13/security-monitoring-detecting-wdigest-authentication/
• Security Monitoring MP AppLocker Rules
  https://nathangau.wordpress.com/2017/05/19/security-monitoring-mp-applocker-rules/

In addition to this I would recommend you to install the new MECM Management Pack (if you haven't done it already), developed by Kevin Holman, as the old one is not supported anymore. Here is the link with some more interesting details: Monitoring Microsoft Endpoint Configuration Manager (MECM)

Some important additional information on the same topic: SCOM Security – the best tips, tools and MPs to secure your SCOM environment This is a session by Nathan Gau, who is the author of the Security MP. Some session info:

With cyber-attacks on the rise, security is top of the agenda for most IT teams. But there is no need to shell out for costly security products when SCOM has the building blocks to do security monitoring and is great for analysing log data. Join Cookdown’s Director of Products, Bruce Cullen, and Nathan Gau, Senior Cyber Security Consultant at Microsoft, for this month’s Coffee Break episode where they will be discussing how SCOM can help with intrusion detection, highlighting known vulnerabilities and augmenting organizational best practices surrounding security. They will also be showing off the latest version of Nathan Gau’s Security Monitoring MP, built from customer requests to use SCOM to do exactly these things. In this webinar, you will learn how:

• SCOM can be used as a security monitoring tool with the Security Monitoring MP
• To detect legacy protocols
• To identify security vulnerabilities before attackers do
• To look for signs that your IT estate is under attack
• To help implement Security best practices and processes through SCOM

Last, but not least, another session by Nathan Gau on the same topic, again on SCOMathon: SCOM as a security tool and securing SCOM Session summary:

Nathan’s session covered basic cyber security concepts for the IT professional, as well as how SCOM can be used as a cyber security tool. He also showed how to secure SCOM given that it is a very powerful tool that, if compromised, could easily be exploited by people with bad intentions.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)
Regards
Stoyan Chalakov