Query to Create Alert for W3WP process

Satishms 

I'm not sure how to look for Cores rather than CPUs, so this shows the % for the process.  This is a query I use to detect the last 6 data points and if they are all above the threshold defined by maxVal you will see the servers listed.  I left a last line in but commented out, as that allows you to test for an OR condition (where any of the final 6 data points are above the threshold). 
You can amend line #8 if you want more or less data points

let procName = 'w3wp';
let maxVal = 150;
Perf 
| where TimeGenerated >= ago(1d)
| where CounterName == "% Processor Time"
        and InstanceName ==procName
| make-series processCpuPct = max(CounterValue)  on TimeGenerated from ago(1d) to now()  step 1h by Computer 
| where processCpuPct[-1] > maxVal and processCpuPct[-2] > maxVal and processCpuPct[-3] > maxVal and processCpuPct[-4] > maxVal and processCpuPct[-5] > maxVal  and processCpuPct[-6] > maxVal
//| where processCpuPct[-1] > maxVal or processCpuPct[-2] > maxVal or processCpuPct[-3] > maxVal or processCpuPct[-4] > maxVal or processCpuPct[-5] > maxVal or processCpuPct[-6] > maxVal

  I