OH2 zwave Everspring SF812 smoke-detector alarm notifies

I wonder how I can manage to distinguish the following two z-wave triggers coming from z-wave smoke detector:

  1. Alarm Report with value = 17 (is tampering report, someone has opened the detector)
2017-08-20 10:37:13.041 [DEBUG] [ve.internal.protocol.ZWaveController] - Process Message = 01 0A 00 04 00 0E 04 71 05 01 11 9F
2017-08-20 10:37:13.042 [DEBUG] [ve.internal.protocol.ZWaveController] - Message: class=ApplicationCommandHandler[0x04], type=Request[0x00], priority=High, dest=255, callback=0, payload=00 0E 04 71 05 01 11
2017-08-20 10:37:13.043 [DEBUG] [ssage.ApplicationCommandMessageClass] - NODE 14: Application Command Request (ALIVE:DONE)
2017-08-20 10:37:13.045 [DEBUG] [alization.ZWaveNodeInitStageAdvancer] - NODE 14: Starting initialisation from DONE
2017-08-20 10:37:13.046 [DEBUG] [ve.internal.protocol.ZWaveController] - Event Listener org.openhab.binding.zwave.internal.protocol.initialization.ZWaveNodeInitStageAdvancer@1206b73 already registered
2017-08-20 10:37:13.048 [DEBUG] [ssage.ApplicationCommandMessageClass] - NODE 14: Incoming command class ALARM
2017-08-20 10:37:13.050 [DEBUG] [.commandclass.ZWaveAlarmCommandClass] - NODE 14: Received ALARM command V0
2017-08-20 10:37:13.057 [DEBUG] [.commandclass.ZWaveAlarmCommandClass] - NODE 14: Process NOTIFICATION_REPORT V0
2017-08-20 10:37:13.058 [DEBUG] [.commandclass.ZWaveAlarmCommandClass] - NODE 14: ALARM report - 1 = 17
2017-08-20 10:37:13.063 [DEBUG] [.commandclass.ZWaveAlarmCommandClass] - NODE 14: Alarm Type = SMOKE (1)
2017-08-20 10:37:13.067 [DEBUG] [ve.internal.protocol.ZWaveController] - Notifying event listeners: ZWaveAlarmValueEvent
2017-08-20 10:37:13.069 [DEBUG] [ding.zwave.handler.ZWaveThingHandler] - NODE 14: Got an event from Z-Wave network: ZWaveAlarmValueEvent
2017-08-20 10:37:13.071 [DEBUG] [ding.zwave.handler.ZWaveThingHandler] - NODE 14: Got a value event from Z-Wave network, endpoint = 0, command class = ALARM, value = 17
2017-08-20 10:37:13.073 [DEBUG] [ternal.converter.ZWaveAlarmConverter] - Alarm converter processing ALARM
2017-08-20 10:37:13.088 [DEBUG] [ding.zwave.handler.ZWaveThingHandler] - NODE 14: Updating channel state zwave:device:ttyACM0:node14:alarm_tamper to ON [OnOffType]

  1. Alarm Report with value = 255 (is low battery report)
2017-08-21 14:49:29.823 [DEBUG] [WaveSerialHandler$ZWaveReceiveThread] - Receive Message = 01 0A 00 04 00 10 04 71 05 01 FF 6F
2017-08-21 14:49:29.826 [DEBUG] [ve.internal.protocol.ZWaveController] - Receive queue TAKE: Length=0
2017-08-21 14:49:29.827 [DEBUG] [wave.internal.protocol.SerialMessage] - Assembled message buffer = 01 0A 00 04 00 10 04 71 05 01 FF 6F
2017-08-21 14:49:29.829 [DEBUG] [ve.internal.protocol.ZWaveController] - Process Message = 01 0A 00 04 00 10 04 71 05 01 FF 6F
2017-08-21 14:49:29.830 [DEBUG] [ve.internal.protocol.ZWaveController] - Message: class=ApplicationCommandHandler[0x04], type=Request[0x00], priority=High, dest=255, callback=0, payload=00 10 04 71 05 01 FF
2017-08-21 14:49:29.831 [DEBUG] [ssage.ApplicationCommandMessageClass] - NODE 16: Application Command Request (DEAD:DONE)
2017-08-21 14:49:29.831 [DEBUG] [ng.zwave.internal.protocol.ZWaveNode] - NODE 16: Node is ALIVE. Init stage is DONE.
2017-08-21 14:49:29.832 [DEBUG] [ve.internal.protocol.ZWaveController] - Notifying event listeners: ZWaveNodeStatusEvent
2017-08-21 14:49:29.833 [DEBUG] [ding.zwave.handler.ZWaveThingHandler] - NODE 16: Got an event from Z-Wave network: ZWaveNodeStatusEvent
2017-08-21 14:49:29.834 [DEBUG] [ding.zwave.handler.ZWaveThingHandler] - NODE 16: Setting ONLINE
2017-08-21 14:49:29.837 [DEBUG] [ve.internal.protocol.ZWaveController] - NODE 16: Node Status event - Node is ALIVE
2017-08-21 14:49:29.839 [DEBUG] [alization.ZWaveNodeInitStageAdvancer] - NODE 16: Starting initialisation from DONE
2017-08-21 14:49:29.839 [DEBUG] [ve.internal.protocol.ZWaveController] - Event Listener org.openhab.binding.zwave.internal.protocol.initialization.ZWaveNodeInitStageAdvancer@71eb2f already registered
2017-08-21 14:49:29.840 [DEBUG] [ssage.ApplicationCommandMessageClass] - NODE 16: Incoming command class ALARM
2017-08-21 14:49:29.841 [DEBUG] [.commandclass.ZWaveAlarmCommandClass] - NODE 16: Received ALARM command V0
2017-08-21 14:49:29.842 [DEBUG] [.commandclass.ZWaveAlarmCommandClass] - NODE 16: Process NOTIFICATION_REPORT V0
2017-08-21 14:49:29.842 [DEBUG] [.commandclass.ZWaveAlarmCommandClass] - NODE 16: ALARM report - 1 = 255
2017-08-21 14:49:29.843 [DEBUG] [.commandclass.ZWaveAlarmCommandClass] - NODE 16: Alarm Type = SMOKE (1)
2017-08-21 14:49:29.844 [DEBUG] [ve.internal.protocol.ZWaveController] - Notifying event listeners: ZWaveAlarmValueEvent
2017-08-21 14:49:29.844 [DEBUG] [ding.zwave.handler.ZWaveThingHandler] - NODE 16: Got an event from Z-Wave network: ZWaveAlarmValueEvent
2017-08-21 14:49:29.845 [DEBUG] [ding.zwave.handler.ZWaveThingHandler] - NODE 16: Got a value event from Z-Wave network, endpoint = 0, command class = ALARM, value = 255
2017-08-21 14:49:29.846 [DEBUG] [ternal.converter.ZWaveAlarmConverter] - Alarm converter processing ALARM
2017-08-21 14:49:29.847 [DEBUG] [ding.zwave.handler.ZWaveThingHandler] - NODE 16: Updating channel state zwave:device:ttyACM0:node16:alarm_tamper to ON [OnOffType]

Is there a chance to get the origin ALARM value (17 or 255) to write a rule according to these values? Unfortunately both triggered alarms are assigned to alarm_tamper which is OnOffType type only and does not help to find the root cause of this alarm.

Many thanks ahead.