Unfortunately you cannot use NMV telemetry to trigger a custom security event the way you describe.
The 'worst case scenario' for a host running Secure Client is the remote worker use case where the NVM telemetry may be cached for some time before the user connects back to the corporate network via VPN, at which point the cached telemetry is forwarded to SNA and written to the database however the timestamps will be outside of the 5 minute window used by the core engine for real time detections. Today, NVM can be classed as additional context so it will be visible via Report Builder.
