I don't have a 10.5 server in front of me - I'm currently looking at 10.6 - but I looked at the admin guide for 10.5 and I think the instructions haven't changed.
When you open the Alert entity editor, go to the Authorization tab.
- Select and existing group entry or add a new group entry.
- In the conditions row, click in the left-hand side dropdown and choose the column "Enrichment data..."
- That will open a popup dialog where you enter the enrichment field name (see image 1 below).
- Click ok. The dialog will fill in the left-hand side of the condition.
- Enter the value you want to match on the right-hand side like any other rule (see image 2 below).
Enrichment field dialog
Completed security rule