You can use the Process:getInstanceCountByCommand method to see if count is 1 or 0 to check if appnode is running or not.

You can write the Rulebase to Monitor the AppNode using below steps:

1. Create Rulebase and select the Process Microagent
2. Select the getInstanceCountByCommand Method to check the AppNode process is running or not.
3. Give the command = <Appnode Process Name> in the Method Arguments. e.g, "Command = bwappnode-TestDomainAppNode.exe"
4. Select the "Process Count = 0" in the Test Builder to check the AppNode is in not RUNNING state.  (If AppNode is not running it return the 0)
5. Select the Action Editor for notification.

Note:
 When you use method getInstanceCount, getProcess or getInstanceCountByCommand, you can use regular expressions to match process names or command. For example, to find process bwappnode-testappnode.exe for windows and bwappnode-testappnode.sh for Linux you might search for the regular expression bwappnode-TestDomainAppNode.* .
 
 So the input would be 
 "Command = bwappnode-TestDomainAppNode.*"
 
 Here ".*" means ".exe" for windows and ".sh" for Linux.
 
In case you have multiple appnodes on same machine with the same name ( e.g. testappnode)  but in different Domains. In this example there are two domains TESTDomain and PRODDomain. So the search expression for each appnode would be:

For Testing Domain :

"Command = TESTDomain.*bwappnode-testappnode.*"

For Production Domain:

"Command = PRODDomain.*bwappnode-testappnode.*"

With the help of the output of getProcess Method you can decide your regular search expression according to your environment.
For More details on Process refer Hawk Microagent reference guide.