Hello,
Is the switch user login alert for password expiring configurable as a trap or is it a syslog message that can be sent to XMC?
If so you could potentially create an alarm to look for a match phrase for the syslog message that is sent, or based on trap (if defined).
Thanks
-Ryan