An EventAlarmExpression doesn't have the yellow and red properties, those are used in MetricAlarmExpression.
Have a look at Alarm expressions – Part 2 : Event alarms, it shows how event based alarms should be created.
In fact what kind of alarm are you trying t create ?
Should it fire on an event, or a performance metric crossing a watermark ?
