For System.ServiceState parameter, you should specify service name - don't be confused with display name you see in "Services" in MMC. Service name can be seen in service properties. System.ServiceState returns service status code, which can be one of the following:

0 - service running;
1 - service paused;
2 - service starting (start pending);
3 - service pausing (pause pending);
4 - service starting after pause (continue pending);
5 - service stopping (stop pending);
6 - service stopped;
255 - unable to get current service state.

So in threshold you have to check if status code not equal 0 and if it is, generate appropriate event. The following discussion could also be useful:
https://www.netxms.org/forum/index.php/topic,166.0.html

Best regards,
Victor