This issue occurs because the system triggering the Real time alert is unable to resolve the SID because it does not belong to the domain in which this system resides. To verify this, go to the Event Viewer and event log of the system that triggered the event and verify that a SID is in the event.
