Thanks everyone. I'll dig into this and see how it works.
One thing to note: Dude works by
polling... so it records an instantance reading of something. It does NOT do "traps" or events... so its may not capture if up/down perfectly, but close (and closer if you shorten the polling intervals).
This polling usually happens via probes on a device, which also create "data sources". But you can "shortcut" the probe, by directly using the data sources as @bpwl shows
While you can also send logs from RouterOS device via Dude's syslog server – which save the logs, but it does NOT let you query/alarm logs.