What triggers the red/green icon?

Pete, what exactly triggers whether the system tray icon should be red or green?

I have a few hosts that always are above 500ms will that mean icon will be red? Or is the red icon only when samples are lost?

The icon turns red when an alert condition occurs for an alert that has "Tray icon change / notification" as one of its events. The conditions you set on that alert control at what point the icon changes from green to red and when it returns to green again.