Hello,
I wrote a similar script to passive-interface EIGRP if it is flapping. The logic remains the same. Just change the trigger and what actions you want it to take.
event manager applet CIRCUIT_STABILITY authorization bypass
event syslog occurs 3 pattern " %DUAL-5-NBRCHANGE: EIGRP-IPv4 10: Neighbor 10.51.2.1 .*down" period 45000 maxrun 120
action 1.0 cli command "enable"
action 1.1 syslog priority errors msg "%EEM-ACTION-ENGAGED% due to Multiple EIGRP Flaps"
action 2.0 cli command "conf t"
action 3.0 cli command "router eigrp 10"
action 4.0 cli command "passive-interface tunnel 512"
action 4.1 syslog priority errors msg "Tunnel 512 has been made passive by TEST"