zabbix_export:
  version: '7.0'
  template_groups:
    - uuid: a571c0d144b14fd4a87a9d9b2aa9fcd6
      name: Templates/Applications
  host_groups:
    - uuid: a571c0d144b14fd4a87a9d9b2aa9fcd6
      name: Applications
  templates:
    - uuid: d0571c5f2c204b7ab244843040288a35
      template: 'Acronis Cyber Protect Cloud by HTTP'
      name: 'Acronis Cyber Protect Cloud by HTTP'
      description: |
        Requests Acronis Cyber Protect Cloud API access token and creates host prototype for MSP.
        
        Template uses HTTP item to query Acronis Cyber Protect Cloud API client for authorization.
        
        Read the template documentation prior to using this template.
        
        You can discuss this template or leave feedback on our forum https://www.zabbix.com/forum/zabbix-suggestions-and-feedback
        
        Generated by official Zabbix template tool "Templator"
      vendor:
        name: Zabbix
        version: 7.0-0
      groups:
        - name: Templates/Applications
      items:
        - uuid: bce642c2c6e743ccb618c96f6ca533da
          name: 'Get access token'
          type: HTTP_AGENT
          key: acronis.cpc.account_manager.get_token
          delay: '{$ACRONIS.CPC.AUTH.INTERVAL}'
          history: '0'
          value_type: TEXT
          authtype: BASIC
          username: '{$ACRONIS.CPC.AUTH.CLIENT.ID}'
          password: '{$ACRONIS.CPC.AUTH.SECRET}'
          description: 'Authorizes API user and receives access token.'
          preprocessing:
            - type: JAVASCRIPT
              parameters:
                - |
                  value = JSON.parse(value)
                  
                  var list = []
                  list.push({'scope': value['scope'].split(':')[3], 'access_token': value['access_token']})
                  return JSON.stringify(list);
          timeout: 15s
          url: '{$ACRONIS.CPC.DATACENTER.URL}{$ACRONIS.CPC.PATH.ACCOUNT.MANAGEMENT}/idp/token'
          status_codes: ''
          posts: grant_type=client_credentials
          http_proxy: '{$ACRONIS.CPC.HTTP.PROXY}'
          headers:
            - name: Content-Type
              value: application/x-www-form-urlencoded
            - name: X-Application-Secret
              value: 5619386d-de56-49ec-8508-f5c399d3b9bd
          request_method: POST
          tags:
            - tag: component
              value: authorization
      discovery_rules:
        - uuid: d2c30d84c5f44734bc2f0ef38e99a959
          name: 'Acronis CPC: MSP Discovery'
          type: DEPENDENT
          key: acronis.cpc.lld.msp_discovery
          description: 'Discovers MSP and creates host prototype based on that.'
          host_prototypes:
            - uuid: bbdc747270f64876bc701dd87c27dbbe
              host: 'Acronis CPC MSP {#SCOPE}'
              name: 'Acronis CPC MSP {#SCOPE}'
              group_links:
                - group:
                    name: Applications
              templates:
                - name: 'Acronis Cyber Protect Cloud MSP by HTTP'
              macros:
                - macro: '{$ACRONIS.CPC.ACCESS_TOKEN}'
                  value: '{#ACCESS_TOKEN}'
                  description: 'Acronis CPC API access token.'
                - macro: '{$ACRONIS.CPC.MSP.TENANT.UUID}'
                  value: '{#SCOPE}'
                  description: 'UUID of API client tenant.'
          master_item:
            key: acronis.cpc.account_manager.get_token
          lld_macro_paths:
            - lld_macro: '{#ACCESS_TOKEN}'
              path: $.access_token
            - lld_macro: '{#SCOPE}'
              path: $.scope
      tags:
        - tag: class
          value: application
        - tag: target
          value: acronis
        - tag: target
          value: cyber-protect-cloud
      macros:
        - macro: '{$ACRONIS.CPC.AUTH.CLIENT.ID}'
          description: 'Client ID for API user access.'
        - macro: '{$ACRONIS.CPC.AUTH.INTERVAL}'
          value: 110m
          description: 'API token regeneration interval, in minutes. By default, Acronis Cyber Protect Cloud tokens expire after 2 hours.'
        - macro: '{$ACRONIS.CPC.AUTH.SECRET}'
          type: SECRET_TEXT
          description: 'Secret for API user access.'
        - macro: '{$ACRONIS.CPC.DATACENTER.URL}'
          description: 'Acronis Cyber Protect Cloud datacenter URL, e.g., https://eu2-cloud.acronis.com.'
        - macro: '{$ACRONIS.CPC.HTTP.PROXY}'
          description: 'Sets the HTTP proxy for the authorization item. Host prototypes will also use this value for HTTP proxy. If this parameter is empty, then no proxy is used.'
        - macro: '{$ACRONIS.CPC.PATH.ACCOUNT.MANAGEMENT}'
          value: /api/2
          description: 'Sub-path for the Account Management API.'
    - uuid: bf3107deff3a4aabab1e1c0ee71a3281
      template: 'Acronis Cyber Protect Cloud MSP by HTTP'
      name: 'Acronis Cyber Protect Cloud MSP by HTTP'
      description: |
        Discovers and monitors alerts, clients, devices using HTTP agent items.
        
        This template receives API token and datacenter URL from parent host, therefore no additional configuration is necessary.
        
        Read the template documentation prior to using this template.
        
        You can discuss this template or leave feedback on our forum https://www.zabbix.com/forum/zabbix-suggestions-and-feedback
        
        Generated by official Zabbix template tool "Templator"
      vendor:
        name: Zabbix
        version: 7.0-0
      groups:
        - name: Templates/Applications
      items:
        - uuid: dba9a02767be47819f7012f316723fff
          name: 'Get alerts'
          type: HTTP_AGENT
          key: acronis.cpc.alerts.get
          delay: 5m
          history: '0'
          value_type: TEXT
          description: 'Fetches all alerts.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.items
          timeout: 15s
          url: '{$ACRONIS.CPC.DATACENTER.URL}{$ACRONIS.CPC.PATH.ALERTS}/alerts'
          status_codes: ''
          http_proxy: '{$ACRONIS.CPC.HTTP.PROXY}'
          headers:
            - name: Accept
              value: application/json
            - name: Authorization
              value: 'Bearer {$ACRONIS.CPC.ACCESS_TOKEN}'
            - name: X-Application-Secret
              value: 5619386d-de56-49ec-8508-f5c399d3b9bd
          tags:
            - tag: component
              value: raw
        - uuid: 483f9e040091476ba3857ae2957d83bf
          name: 'Alerts with "critical" severity'
          type: DEPENDENT
          key: acronis.cpc.alerts.severity.crit
          description: 'Gets count of alerts with "critical" severity.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - '$..[?(@.severity == ''critical'')].length()'
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: acronis.cpc.alerts.get
          tags:
            - tag: component
              value: alert
            - tag: component
              value: application
        - uuid: 4fcefc1b66fe4c56b68cf5712aa727e5
          name: 'Alerts with "error" severity'
          type: DEPENDENT
          key: acronis.cpc.alerts.severity.err
          description: 'Gets count of alerts with "error" severity.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - '$..[?(@.severity == ''error'')].length()'
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: acronis.cpc.alerts.get
          tags:
            - tag: component
              value: alert
            - tag: component
              value: application
        - uuid: 06003951452f4687bd0f1c0a395e7a77
          name: 'Alerts with "information" severity'
          type: DEPENDENT
          key: acronis.cpc.alerts.severity.info
          description: 'Gets count of alerts with "information" severity.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - '$..[?(@.severity == ''information'')].length()'
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: acronis.cpc.alerts.get
          tags:
            - tag: component
              value: alert
            - tag: component
              value: application
        - uuid: ca3a1c7649874dfdaf191c7063022498
          name: 'Alerts with "ok" severity'
          type: DEPENDENT
          key: acronis.cpc.alerts.severity.ok
          description: 'Gets count of alerts with "ok" severity.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - '$..[?(@.severity == ''ok'')].length()'
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: acronis.cpc.alerts.get
          tags:
            - tag: component
              value: alert
            - tag: component
              value: application
        - uuid: a4516d8961b3426f859511e1614c4403
          name: 'Alerts with "warning" severity'
          type: DEPENDENT
          key: acronis.cpc.alerts.severity.warn
          description: 'Gets count of alerts with "warning" severity.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - '$..[?(@.severity == ''warning'')].length()'
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          master_item:
            key: acronis.cpc.alerts.get
          tags:
            - tag: component
              value: alert
            - tag: component
              value: application
        - uuid: 77f25dbbd477458a88f1850701dccc69
          name: 'Get customers'
          type: HTTP_AGENT
          key: acronis.cpc.customers.get
          delay: 5m
          history: '0'
          value_type: TEXT
          description: 'Fetches all customers.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.items
          timeout: 15s
          url: '{$ACRONIS.CPC.DATACENTER.URL}{$ACRONIS.CPC.PATH.ACCOUNT.MANAGEMENT}/tenants'
          query_fields:
            - name: subtree_root_id
              value: '{$ACRONIS.CPC.MSP.TENANT.UUID}'
          status_codes: ''
          http_proxy: '{$ACRONIS.CPC.HTTP.PROXY}'
          headers:
            - name: Accept
              value: application/json
            - name: Authorization
              value: 'Bearer {$ACRONIS.CPC.ACCESS_TOKEN}'
            - name: X-Application-Secret
              value: 5619386d-de56-49ec-8508-f5c399d3b9bd
          tags:
            - tag: component
              value: raw
        - uuid: 81b3d23d30964b88aeb3a0911ba0e487
          name: 'Get devices'
          type: HTTP_AGENT
          key: acronis.cpc.devices.get
          history: '0'
          value_type: TEXT
          description: 'Fetches all devices.'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.items
          timeout: 15s
          url: '{$ACRONIS.CPC.DATACENTER.URL}{$ACRONIS.CPC.PATH.RESOURCE.MANAGEMENT}/resources'
          query_fields:
            - name: type
              value: '{$ACRONIS.CPC.DEVICE.RESOURCE.TYPE}'
          status_codes: ''
          http_proxy: '{$ACRONIS.CPC.HTTP.PROXY}'
          headers:
            - name: Accept
              value: application/json
            - name: Authorization
              value: 'Bearer {$ACRONIS.CPC.ACCESS_TOKEN}'
            - name: X-Application-Secret
              value: 5619386d-de56-49ec-8508-f5c399d3b9bd
          tags:
            - tag: component
              value: raw
        - uuid: 3697d34ebbb74b90aa7318321ecc27e5
          name: 'Register integration'
          type: SCRIPT
          key: acronis.cpc.register.integration
          delay: 24h
          history: '0'
          trends: '0'
          params: |
            
            const request_path = '/api/integration_management/v2/status';
            const app_id = '5619386d-de56-49ec-8508-f5c399d3b9bd';
            
            function checkParams(params) {
            	['api_url', 'api_token', 'tenant_uuid'].forEach(function (field) {
            		if (typeof params !== 'object' || typeof params[field] === 'undefined' || params[field] === '') {
            			throw 'Required param is not set: ' + field + '.';
            		}
            	});
            	return params;
            }
            
            function getHttpData(url, register, params, api_token, tenant_uuid) {
            	const request = new HttpRequest();
            
            	request.addHeader('Content-Type: application/json');
            	request.addHeader('Authorization: Bearer ' + api_token);
            	request.addHeader('X-Application-Secret: ' + app_id);
            
            	if (params['http_proxy']) {
            		request.setProxy(params['http_proxy']);
            		Zabbix.log(4, '[ ACRONIS CYBER PROTECT CLOUD API ] Using http proxy: ' + params['http_proxy']);
            	}
            
            	if (!register) {
            		const response = request.get(url + '?tenantID=' + encodeURIComponent(tenant_uuid));
            		Zabbix.log(4, '[ ACRONIS CYBER PROTECT CLOUD API ] [ ' + url + ' ] Received response with status code ' + request.getStatus() + ': ' + response);
            
            		if (request.getStatus() !== 200) {
            			if (typeof (response.error && response.error.message) !== 'undefined') {
            				throw response.error.message;
            			} else {
            				throw 'Failed to receive data: invalid response status code. Check debug log for more information.';
            			}
            		}
            
            		return response;
            
            	} else {
            
            		const request_body = {
            			"application_id": app_id,
            			"module": {
            				"name": "Zabbix integration with Acronis Cyber Protect Cloud",
            				"version": "1.0.0"
            			},
            			"vendor_system": {
            				"name": "Product integrated with Acronis",
            				"version": "23.07"
            			},
            			"events": [
            				{
            					"category": "activation",
            					"action": "activated integration",
            					"activation_event": true
            				}
            			]
            		};
            
            		const response = request.post(url + '?tenantID=' + encodeURIComponent(tenant_uuid), JSON.stringify(request_body));
            		Zabbix.log(4, '[ ACRONIS CYBER PROTECT CLOUD API ] [ ' + url + ' ] Received response with status code ' + request.getStatus() + ': ' + response);
            
            		if (request.getStatus() !== 204) {
            			if (typeof (response.error && response.error.message) !== 'undefined') {
            				throw response.error.message;
            			} else {
            				throw 'Failed to receive data: invalid response status code. Check debug log for more information.';
            			}
            		}
            
            		return 1;
            	}
            }
            
            function parseGetStatusData(http_response) {
            	const data = JSON.parse(http_response);
            	if (data['items']) {
            		data['items'].forEach(function (app) {
            			if (app['application_id'] && app['application_id'] === app_id) {
            				return app['active'];
            			}
            		});
            		return false;
            	} else {
            		throw 'Unexpected data structure in HTTP response.';
            	}
            }
            
            const params = checkParams(JSON.parse(value)),
            	url = params.api_url,
            	api_token = params.api_token,
            	tenant_uuid = params.tenant_uuid;
            
            const current_activation_status = parseGetStatusData(getHttpData(url + request_path, false, params, api_token, tenant_uuid));
            
            if (!current_activation_status) {
            	return getHttpData(url + request_path, true, params, api_token, tenant_uuid);
            } else {
            	return 0;
            }
          description: 'Registers integration on Acronis services.'
          timeout: 30s
          parameters:
            - name: api_token
              value: '{$ACRONIS.CPC.ACCESS_TOKEN}'
            - name: api_url
              value: '{$ACRONIS.CPC.DATACENTER.URL}'
            - name: tenant_uuid
              value: '{$ACRONIS.CPC.MSP.TENANT.UUID}'
          tags:
            - tag: component
              value: raw
      discovery_rules:
        - uuid: ee0d74749b93459ca40e477b31b3aa21
          name: 'Acronis CPC: Alerts discovery'
          type: DEPENDENT
          key: acronis.cpc.alerts.discovery
          filter:
            evaltype: AND
            conditions:
              - macro: '{#CATEGORY}'
                value: '{$ACRONIS.CPC.ALERT.DISCOVERY.CATEGORY.MATCHES}'
              - macro: '{#CATEGORY}'
                value: '{$ACRONIS.CPC.ALERT.DISCOVERY.CATEGORY.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
              - macro: '{#RESOURCE_NAME}'
                value: '{$ACRONIS.CPC.ALERT.DISCOVERY.RESOURCE.MATCHES}'
              - macro: '{#RESOURCE_NAME}'
                value: '{$ACRONIS.CPC.ALERT.DISCOVERY.RESOURCE.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
              - macro: '{#SEVERITY}'
                value: '{$ACRONIS.CPC.ALERT.DISCOVERY.SEVERITY.MATCHES}'
              - macro: '{#SEVERITY}'
                value: '{$ACRONIS.CPC.ALERT.DISCOVERY.SEVERITY.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
          lifetime: '0'
          description: 'Discovers alerts.'
          item_prototypes:
            - uuid: b298e768dc0447b4b5c29c99a5852453
              name: 'Alert [{#TYPE}]:[{#ALERT_ID}]: Alert severity'
              type: DEPENDENT
              key: 'acronis.cpc.alert.severity[{#ALERT_ID}]'
              description: 'Severity for the alert.'
              valuemap:
                name: 'Alert severity'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$[?(@.id == "{#ALERT_ID}")].severity.first()'
                  error_handler: CUSTOM_ERROR
                  error_handler_params: 'Could not find alert severity'
                - type: JAVASCRIPT
                  parameters:
                    - |
                      const idx = [
                      	'ok',
                      	'warning',
                      	'error',
                      	'critical',
                      	'information'
                      ].indexOf(value);
                      return idx !== -1 ? idx : 10;
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: acronis.cpc.alerts.get
              tags:
                - tag: category
                  value: '{#CATEGORY}'
                - tag: component
                  value: alert
                - tag: component
                  value: application
                - tag: resource
                  value: '{#RESOURCE_NAME}'
                - tag: severity
                  value: '{#SEVERITY}'
              trigger_prototypes:
                - uuid: f72a128c289540869ceeb4eb8a32519b
                  expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.alert.severity[{#ALERT_ID}])=3'
                  name: 'Alert [{#TYPE}]:[{#ALERT_ID}]: Alert has "critical" severity'
                  event_name: 'Alert [{#ALERT_ID}]: "critical" severity'
                  opdata: 'Alert type: {#TYPE}, Current status: {ITEM.LASTVALUE}'
                  priority: HIGH
                  description: 'Alert has "critical" severity.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
                - uuid: 360fcc25d3fe442194ddea76db8157be
                  expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.alert.severity[{#ALERT_ID}])=2'
                  name: 'Alert [{#TYPE}]:[{#ALERT_ID}]: Alert has "error" severity'
                  event_name: 'Alert [{#ALERT_ID}]: "error" severity'
                  opdata: 'Alert type: {#TYPE}, Current status: {ITEM.LASTVALUE}'
                  priority: AVERAGE
                  description: 'Alert has "error" severity.'
                  manual_close: 'YES'
                  dependencies:
                    - name: 'Alert [{#TYPE}]:[{#ALERT_ID}]: Alert has "critical" severity'
                      expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.alert.severity[{#ALERT_ID}])=3'
                  tags:
                    - tag: scope
                      value: notice
                - uuid: 687b26d91e6e448d911663f190328fb4
                  expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.alert.severity[{#ALERT_ID}])=1'
                  name: 'Alert [{#TYPE}]:[{#ALERT_ID}]: Alert has "warning" severity'
                  event_name: 'Alert [{#ALERT_ID}]: "warning" severity'
                  opdata: 'Alert type: {#TYPE}, Current status: {ITEM.LASTVALUE}'
                  priority: WARNING
                  description: 'Alert has "warning" severity.'
                  manual_close: 'YES'
                  dependencies:
                    - name: 'Alert [{#TYPE}]:[{#ALERT_ID}]: Alert has "error" severity'
                      expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.alert.severity[{#ALERT_ID}])=2'
                  tags:
                    - tag: scope
                      value: notice
          master_item:
            key: acronis.cpc.alerts.get
          lld_macro_paths:
            - lld_macro: '{#ALERT_ID}'
              path: $.id
            - lld_macro: '{#CATEGORY}'
              path: $.category
            - lld_macro: '{#RESOURCE_NAME}'
              path: $.details.resourceName
            - lld_macro: '{#SEVERITY}'
              path: $.severity
            - lld_macro: '{#TYPE}'
              path: $.type
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
        - uuid: 4211387734c642f88e236bd588940cc1
          name: 'Acronis CPC: Customer discovery'
          type: DEPENDENT
          key: acronis.cpc.customer.discovery
          filter:
            evaltype: AND
            conditions:
              - macro: '{#KIND}'
                value: '{$ACRONIS.CPC.CUSTOMER.DISCOVERY.KIND.MATCHES}'
              - macro: '{#NAME}'
                value: '{$ACRONIS.CPC.CUSTOMER.DISCOVERY.NAME.MATCHES}'
              - macro: '{#NAME}'
                value: '{$ACRONIS.CPC.CUSTOMER.DISCOVERY.NAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
          description: 'Discovers customers.'
          item_prototypes:
            - uuid: d61dc067880a4317886acd54d0df1da1
              name: 'Customer [{#NAME}]: Enabled status'
              type: DEPENDENT
              key: 'acronis.cpc.customer.status[{#NAME}]'
              description: 'Enabled status for customer (true or false).'
              valuemap:
                name: 'True false'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$[?(@.name == "{#NAME}")].enabled.first()'
                  error_handler: CUSTOM_ERROR
                  error_handler_params: 'Could not find customer status'
                - type: BOOL_TO_DECIMAL
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: acronis.cpc.customers.get
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: customer
                - tag: customer
                  value: '{#NAME}'
          master_item:
            key: acronis.cpc.customers.get
          lld_macro_paths:
            - lld_macro: '{#KIND}'
              path: $.kind
            - lld_macro: '{#NAME}'
              path: $.name
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
        - uuid: 67e399a0a6884589adc2618b181024e7
          name: 'Acronis CPC: Device discovery'
          type: DEPENDENT
          key: acronis.cpc.device.discovery
          filter:
            evaltype: AND
            conditions:
              - macro: '{#TENANT_NAME}'
                value: '{$ACRONIS.CPC.DEVICE.DISCOVERY.TENANT.MATCHES}'
              - macro: '{#TENANT_NAME}'
                value: '{$ACRONIS.CPC.DEVICE.DISCOVERY.TENANT.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
          description: 'Discovers devices.'
          item_prototypes:
            - uuid: 63f8280408c34e029085af75f15c0db3
              name: 'Device [{#NAME}]:[{#ID}]: Agent enabled'
              type: DEPENDENT
              key: 'acronis.cpc.device.agent.enabled[{#NAME}]'
              description: 'Agent status (enabled or disabled) for the device.'
              valuemap:
                name: 'True false'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.context.attributes.[?(@.name == "agent")].kvs.[?(@.key == "enabled")].value.first()'
                  error_handler: CUSTOM_ERROR
                  error_handler_params: 'Could not parse agent status'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
              trigger_prototypes:
                - uuid: 7e33ba82ad90436c88beee8d32a3f29d
                  expression: 'max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.agent.enabled[{#NAME}],3m) < 1'
                  name: 'Device [{#NAME}]:[{#ID}]: Agent disabled'
                  opdata: 'Current score: {ITEM.LASTVALUE}'
                  priority: INFO
                  description: 'Agent for this device is disabled for at least 3 minutes.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
            - uuid: e1eaefb0e0af4793abadb0b3ad20ff4b
              name: 'Device [{#NAME}]:[{#ID}]: Agent online'
              type: DEPENDENT
              key: 'acronis.cpc.device.agent.online[{#NAME}]'
              description: 'Agent reachability for the device.'
              valuemap:
                name: 'True false'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.context.attributes.[?(@.name == "agent")].kvs.[?(@.key == "is_online")].value.first()'
                  error_handler: CUSTOM_ERROR
                  error_handler_params: 'Could not parse agent reachability status'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: 7bc04c3526704b578e2b7561e6c97b6a
              name: 'Device [{#NAME}]:[{#ID}]: Agent version'
              type: DEPENDENT
              key: 'acronis.cpc.device.agent.version[{#NAME}]'
              value_type: CHAR
              description: 'Agent version for the device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.context.attributes.[?(@.name == "agent")].kvs.[?(@.key == "version")].value.first()'
                  error_handler: CUSTOM_ERROR
                  error_handler_params: 'Could not parse agent version'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: d8c3372e05f3480aaa499b143ab47e87
              name: 'Device [{#NAME}]:[{#ID}]: Next machine backup run'
              type: DEPENDENT
              key: 'acronis.cpc.device.backup.next[{#NAME}]'
              units: unixtime
              description: 'Next scheduled machine backup run for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.backup.machine")].next_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
              trigger_prototypes:
                - uuid: 6a2c53a89d7748f89956464849d0b7de
                  expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.backup.next[{#NAME}]) < (now() + {$ACRONIS.CPC.OFFSET.SCHEDULED.BACKUP})'
                  name: 'Device [{#NAME}]:[{#ID}]: Scheduled machine backup failed to run'
                  opdata: 'Scheduled: {ITEM.LASTVALUE1}'
                  priority: WARNING
                  description: 'Scheduled machine backup failed to run.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
            - uuid: 9fbbfa68438a406d82900d5c8801a756
              name: 'Device [{#NAME}]:[{#ID}]: Previous successful machine backup run'
              type: DEPENDENT
              key: 'acronis.cpc.device.backup.prev.ok[{#NAME}]'
              units: unixtime
              description: 'Previous successful machine backup run for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.backup.machine")].last_success_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: cea527353e34488a92dc5d2c082f6710
              name: 'Device [{#NAME}]:[{#ID}]: Previous machine backup run'
              type: DEPENDENT
              key: 'acronis.cpc.device.backup.prev[{#NAME}]'
              units: unixtime
              description: 'Previous machine backup run for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.backup.machine")].last_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: b45fb50f8caa40438eecfc4482d80fc2
              name: 'Device [{#NAME}]:[{#ID}]: CyberFit score'
              type: DEPENDENT
              key: 'acronis.cpc.device.cyberfit[{#NAME}]'
              value_type: FLOAT
              description: 'Acronis "CyberFit" score for the device. Value of "-1" is assigned if "CyberFit" could not be found for device.'
              valuemap:
                name: 'CyberFit score'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.context.attributes.[?(@.name == "cyberfit")].details.[?(@.key == "cyberfit_score_value")].value.first()'
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '-1'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
              trigger_prototypes:
                - uuid: 0c7edd6256fc48c49316644faef8df0a
                  expression: |
                    min(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.cyberfit[{#NAME}],3m) < {$ACRONIS.CPC.CYBERFIT.HIGH}
                    and
                    max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.cyberfit[{#NAME}],3m) <> -1
                  name: 'Device [{#NAME}]:[{#ID}]: CyberFit score critical'
                  opdata: 'Current score: {ITEM.LASTVALUE}'
                  priority: HIGH
                  description: 'CyberFit score for this device is critical for at least 3 minutes.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
                - uuid: 4c841b8207d642b28dbd365983aac0ec
                  expression: |
                    min(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.cyberfit[{#NAME}],3m) < {$ACRONIS.CPC.CYBERFIT.WARN}
                    and
                    max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.cyberfit[{#NAME}],3m) <> -1
                  name: 'Device [{#NAME}]:[{#ID}]: CyberFit score low'
                  opdata: 'Current score: {ITEM.LASTVALUE}'
                  priority: WARNING
                  description: 'CyberFit score for this device is low for at least 3 minutes.'
                  manual_close: 'YES'
                  dependencies:
                    - name: 'Device [{#NAME}]:[{#ID}]: CyberFit score critical'
                      expression: |
                        min(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.cyberfit[{#NAME}],3m) < {$ACRONIS.CPC.CYBERFIT.HIGH}
                        and
                        max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.cyberfit[{#NAME}],3m) <> -1
                  tags:
                    - tag: scope
                      value: notice
            - uuid: 1f4d019c271c4272b055253d99d90244
              name: 'Device [{#NAME}]:[{#ID}]: Next patch management run'
              type: DEPENDENT
              key: 'acronis.cpc.device.patch.next[{#NAME}]'
              units: unixtime
              description: 'Next scheduled patch management run for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.security.patch_management")].next_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
              trigger_prototypes:
                - uuid: 7f82e95335b746c1a061b0ae811165a7
                  expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.patch.next[{#NAME}]) < (now() + {$ACRONIS.CPC.OFFSET.SCHEDULED.PATCH})'
                  name: 'Device [{#NAME}]:[{#ID}]: Scheduled patch management failed to run'
                  opdata: 'Scheduled: {ITEM.LASTVALUE1}'
                  priority: WARNING
                  description: 'Scheduled patch management failed to run.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
            - uuid: 8ff39ea389ec4c53aa572074266536da
              name: 'Device [{#NAME}]:[{#ID}]: Previous successful patch management run'
              type: DEPENDENT
              key: 'acronis.cpc.device.patch.prev.ok[{#NAME}]'
              units: unixtime
              description: 'Previous successful patch management run for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.security.patch_management")].last_success_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: 81bc4b10c3484673a76e9bb8e012af26
              name: 'Device [{#NAME}]:[{#ID}]: Previous patch management run'
              type: DEPENDENT
              key: 'acronis.cpc.device.patch.prev[{#NAME}]'
              units: unixtime
              description: 'Previous patch management run for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.security.patch_management")].last_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: 43dc6e6bb7e042149b356fb6b067f0d5
              name: 'Device [{#NAME}]:[{#ID}]: Protection plan name'
              type: DEPENDENT
              key: 'acronis.cpc.device.protection.name[{#NAME}]'
              value_type: CHAR
              description: 'Protection plan name for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.aggregate.names
                  error_handler: CUSTOM_ERROR
                  error_handler_params: 'Could not parse protection plan name'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: 98701aa6f99f48c3a769529b2c3c3123
              name: 'Device [{#NAME}]:[{#ID}]: Next antimalware protection scan'
              type: DEPENDENT
              key: 'acronis.cpc.device.protection.scan.next[{#NAME}]'
              units: unixtime
              description: 'Next scheduled antimalware protection scan for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.security.antimalware_protection")].next_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
              trigger_prototypes:
                - uuid: 75156ffdb1ed4b90b594e50bce8752e5
                  expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.protection.scan.next[{#NAME}]) < (now() + {$ACRONIS.CPC.OFFSET.SCHEDULED.ANTIMALWARE})'
                  name: 'Device [{#NAME}]:[{#ID}]: Scheduled antimalware scan failed to run'
                  opdata: 'Scheduled: {ITEM.LASTVALUE1}'
                  priority: WARNING
                  description: 'Scheduled antimalware scan failed to run.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
            - uuid: d9510ad24a1a40dfb14313e0e135a247
              name: 'Device [{#NAME}]:[{#ID}]: Previous successful antimalware protection scan'
              type: DEPENDENT
              key: 'acronis.cpc.device.protection.scan.prev.ok[{#NAME}]'
              units: unixtime
              description: 'Previous successful antimalware protection scan for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.security.antimalware_protection")].last_success_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: 684b4a46e4d84a588bd84fac3e6cfc55
              name: 'Device [{#NAME}]:[{#ID}]: Previous antimalware protection scan'
              type: DEPENDENT
              key: 'acronis.cpc.device.protection.scan.prev[{#NAME}]'
              units: unixtime
              description: 'Previous antimalware protection scan for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.security.antimalware_protection")].last_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: e0a94793d31c4cf08f64c0d230134870
              name: 'Device [{#NAME}]:[{#ID}]: Protection status'
              type: DEPENDENT
              key: 'acronis.cpc.device.protection.status[{#NAME}]'
              value_type: CHAR
              description: 'Protection status for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - $.aggregate.status
                  error_handler: CUSTOM_ERROR
                  error_handler_params: 'Could not parse protection status'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
              trigger_prototypes:
                - uuid: 0c38a47343cb4df4bda534982f344c15
                  expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.protection.status[{#NAME}])="error"'
                  name: 'Device [{#NAME}]:[{#ID}]: Protection status "error"'
                  opdata: 'Current status: {ITEM.LASTVALUE}'
                  priority: AVERAGE
                  description: 'Device has "error" protection status.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
                - uuid: 3338e8c43c2149819e0a48156d6ec21a
                  expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.protection.status[{#NAME}])="warning"'
                  name: 'Device [{#NAME}]:[{#ID}]: Protection status "warning"'
                  opdata: 'Current status: {ITEM.LASTVALUE}'
                  priority: WARNING
                  description: 'Device has "warning" protection status.'
                  manual_close: 'YES'
                  dependencies:
                    - name: 'Device [{#NAME}]:[{#ID}]: Protection status "error"'
                      expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.protection.status[{#NAME}])="error"'
                  tags:
                    - tag: scope
                      value: notice
            - uuid: 20d93972ca2f47af96aed7ee9aa642af
              name: 'Device [{#NAME}]:[{#ID}]: Raw data resources status'
              type: HTTP_AGENT
              key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              history: '0'
              value_type: TEXT
              description: 'Gets statuses for device resources.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.items[0]'
                  error_handler: CUSTOM_ERROR
                  error_handler_params: 'Could not parse resource status data'
              timeout: 15s
              url: '{$ACRONIS.CPC.DATACENTER.URL}{$ACRONIS.CPC.PATH.RESOURCE.MANAGEMENT}/resource_statuses'
              query_fields:
                - name: resource_id
                  value: '{#ID}'
                - name: include_attributes
                  value: 'true'
              status_codes: ''
              http_proxy: '{$ACRONIS.CPC.HTTP.PROXY}'
              headers:
                - name: Accept
                  value: application/json
                - name: Authorization
                  value: 'Bearer {$ACRONIS.CPC.ACCESS_TOKEN}'
                - name: X-Application-Secret
                  value: 5619386d-de56-49ec-8508-f5c399d3b9bd
              tags:
                - tag: component
                  value: raw
            - uuid: e6905aa1998a41cfa0e6fda699558ceb
              name: 'Device [{#NAME}]:[{#ID}]: Next vulnerability assessment'
              type: DEPENDENT
              key: 'acronis.cpc.device.vuln.next[{#NAME}]'
              units: unixtime
              description: 'Next scheduled vulnerability assessment for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.security.vulnerability_assessment")].next_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
              trigger_prototypes:
                - uuid: b71001b751594fc5b4b9b38673133171
                  expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.vuln.next[{#NAME}]) < (now() + {$ACRONIS.CPC.OFFSET.SCHEDULED.VULNERABILITY})'
                  name: 'Device [{#NAME}]:[{#ID}]: Scheduled vulnerability assessment failed to run'
                  opdata: 'Scheduled: {ITEM.LASTVALUE1}'
                  priority: WARNING
                  description: 'Scheduled vulnerability assessment failed to run.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
            - uuid: 36fb3f57c4ae4f5cad01913a453869dc
              name: 'Device [{#NAME}]:[{#ID}]: Previous successful vulnerability assessment'
              type: DEPENDENT
              key: 'acronis.cpc.device.vuln.prev.ok[{#NAME}]'
              units: unixtime
              description: 'Previous successful vulnerability assessment for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.security.vulnerability_assessment")].last_success_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
            - uuid: 9a45c38169c848fd92b8e6a782ad065b
              name: 'Device [{#NAME}]:[{#ID}]: Previous vulnerability assessment'
              type: DEPENDENT
              key: 'acronis.cpc.device.vuln.prev[{#NAME}]'
              units: unixtime
              description: 'Previous vulnerability assessment for device.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$.policies.[?(@.type == "policy.security.vulnerability_assessment")].last_run.first()'
                  error_handler: DISCARD_VALUE
                - type: JAVASCRIPT
                  parameters:
                    - 'return Math.floor(Date.parse(value) / 1000);'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'acronis.cpc.device.res.status.raw[{#NAME}]'
              tags:
                - tag: component
                  value: application
                - tag: component
                  value: device
                - tag: resource
                  value: '{#NAME}'
                - tag: tenant
                  value: '{#TENANT_NAME}'
          trigger_prototypes:
            - uuid: f0a9c94a81ef4018a76b73cb98780f1f
              expression: 'max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.backup.prev.ok[{#NAME}],1m)<>max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.backup.prev[{#NAME}],1m)'
              name: 'Device [{#NAME}]:[{#ID}]: Previous machine backup run not successful'
              opdata: 'Last scan: {ITEM.LASTVALUE2}, Last OK scan: {ITEM.LASTVALUE1}'
              priority: AVERAGE
              description: 'Previous machine backup did not run successfully.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
            - uuid: 5ce3f0bc18cd40878059b48ba436fa6d
              expression: 'max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.patch.prev.ok[{#NAME}],1m)<>max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.patch.prev[{#NAME}],1m)'
              name: 'Device [{#NAME}]:[{#ID}]: Previous patch management run not successful'
              opdata: 'Last scan: {ITEM.LASTVALUE2}, Last OK scan: {ITEM.LASTVALUE1}'
              priority: AVERAGE
              description: 'Previous patch management run did not run successfully.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
            - uuid: b0341da543c34c9491863a6fb8caea0c
              expression: 'last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.protection.scan.prev.ok[{#NAME}])<>last(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.protection.scan.prev[{#NAME}])'
              name: 'Device [{#NAME}]:[{#ID}]: Previous protection scan not successful'
              opdata: 'Last scan: {ITEM.LASTVALUE2}, Last OK scan: {ITEM.LASTVALUE1}'
              priority: AVERAGE
              description: 'Device has "error" protection status.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
            - uuid: 3c0f47531c1a435eb93d01107a6e0b3d
              expression: 'max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.vuln.prev.ok[{#NAME}],1m)<>max(/Acronis Cyber Protect Cloud MSP by HTTP/acronis.cpc.device.vuln.prev[{#NAME}],1m)'
              name: 'Device [{#NAME}]:[{#ID}]: Previous vulnerability assessment not successful'
              opdata: 'Last scan: {ITEM.LASTVALUE2}, Last OK scan: {ITEM.LASTVALUE1}'
              priority: AVERAGE
              description: 'Previous vulnerability assessment did not run successfully.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
          graph_prototypes:
            - uuid: feba1571ed4a47d5a5bbbb16153983b0
              name: 'Device [{#NAME}]:[{#ID}]: CyberFit score'
              graph_items:
                - color: 199C0D
                  item:
                    host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                    key: 'acronis.cpc.device.cyberfit[{#NAME}]'
          master_item:
            key: acronis.cpc.devices.get
          lld_macro_paths:
            - lld_macro: '{#ID}'
              path: $.id
            - lld_macro: '{#NAME}'
              path: $.name
            - lld_macro: '{#TENANT_NAME}'
              path: $.tenant_name
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
      tags:
        - tag: class
          value: application
        - tag: target
          value: acronis
        - tag: target
          value: cyber-protect-cloud
      macros:
        - macro: '{$ACRONIS.CPC.ACCESS_TOKEN}'
          type: SECRET_TEXT
          description: 'API access token.'
        - macro: '{$ACRONIS.CPC.ALERT.DISCOVERY.CATEGORY.MATCHES}'
          value: '.*'
          description: 'Sets the alert category regex filter to use in alert discovery for including.'
        - macro: '{$ACRONIS.CPC.ALERT.DISCOVERY.CATEGORY.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'Sets the alert category regex filter to use in alert discovery for excluding.'
        - macro: '{$ACRONIS.CPC.ALERT.DISCOVERY.RESOURCE.MATCHES}'
          value: '.*'
          description: 'Sets the alert resource name regex filter to use in alert discovery for including.'
        - macro: '{$ACRONIS.CPC.ALERT.DISCOVERY.RESOURCE.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'Sets the alert resource name regex filter to use in alert discovery for excluding.'
        - macro: '{$ACRONIS.CPC.ALERT.DISCOVERY.SEVERITY.MATCHES}'
          value: '.*'
          description: 'Sets the alert severity regex filter to use in alert discovery for including.'
        - macro: '{$ACRONIS.CPC.ALERT.DISCOVERY.SEVERITY.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'Sets the alert severity regex filter to use in alert discovery for excluding.'
        - macro: '{$ACRONIS.CPC.CUSTOMER.DISCOVERY.KIND.MATCHES}'
          value: customer
          description: 'Sets the customer name regex filter to use in customer discovery for including.'
        - macro: '{$ACRONIS.CPC.CUSTOMER.DISCOVERY.NAME.MATCHES}'
          value: '.*'
          description: 'Sets the customer name regex filter to use in customer discovery for including.'
        - macro: '{$ACRONIS.CPC.CUSTOMER.DISCOVERY.NAME.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'Sets the customer name regex filter to use in customer discovery for excluding.'
        - macro: '{$ACRONIS.CPC.CYBERFIT.HIGH}'
          value: '579'
          description: 'CyberFit score threshold for "high" severity trigger.'
        - macro: '{$ACRONIS.CPC.CYBERFIT.WARN}'
          value: '669'
          description: 'CyberFit score threshold for "warning" severity trigger.'
        - macro: '{$ACRONIS.CPC.DATACENTER.URL}'
          description: 'Acronis Cyber Protect Cloud datacenter URL, e.g., https://eu2-cloud.acronis.com.'
        - macro: '{$ACRONIS.CPC.DEVICE.DISCOVERY.TENANT.MATCHES}'
          value: '.*'
          description: 'Sets the tenant name regex filter to use in device discovery for including.'
        - macro: '{$ACRONIS.CPC.DEVICE.DISCOVERY.TENANT.NOT_MATCHES}'
          value: CHANGE_IF_NEEDED
          description: 'Sets the tenant name regex filter to use in device discovery for excluding.'
        - macro: '{$ACRONIS.CPC.DEVICE.RESOURCE.TYPE}'
          value: resource.machine
          description: 'Comma separated list of resource types for devices retrieval.'
        - macro: '{$ACRONIS.CPC.HTTP.PROXY}'
          description: 'Sets the HTTP proxy for the authorization item. Host prototypes will also use this value for HTTP proxy. If this parameter is empty, then no proxy is used.'
        - macro: '{$ACRONIS.CPC.MSP.TENANT.UUID}'
          description: 'UUID for MSP.'
        - macro: '{$ACRONIS.CPC.OFFSET.SCHEDULED.ANTIMALWARE}'
          value: '-180'
          description: 'Offset time in seconds for scheduled antimalware scan trigger check.'
        - macro: '{$ACRONIS.CPC.OFFSET.SCHEDULED.BACKUP}'
          value: '-180'
          description: 'Offset time in seconds for scheduled backup run trigger check.'
        - macro: '{$ACRONIS.CPC.OFFSET.SCHEDULED.PATCH}'
          value: '-180'
          description: 'Offset time in seconds for scheduled patch management run trigger check.'
        - macro: '{$ACRONIS.CPC.OFFSET.SCHEDULED.VULNERABILITY}'
          value: '-180'
          description: 'Offset time in seconds for scheduled vulnerability assessment run trigger check.'
        - macro: '{$ACRONIS.CPC.PATH.ACCOUNT.MANAGEMENT}'
          value: /api/2
          description: 'Sub-path for the Account Management API.'
        - macro: '{$ACRONIS.CPC.PATH.AGENTS}'
          value: /api/agent_manager/v2
          description: 'Sub-path for the Agents API.'
        - macro: '{$ACRONIS.CPC.PATH.ALERTS}'
          value: /api/alert_manager/v1
          description: 'Sub-path for the Alerts API.'
        - macro: '{$ACRONIS.CPC.PATH.RESOURCE.MANAGEMENT}'
          value: /api/resource_management/v4
          description: 'Sub-path for the Resource Management API.'
      dashboards:
        - uuid: 711853342bbe4a5b8d145fc96644d1e5
          name: 'Acronis Cyber Protect Cloud Overview'
          pages:
            - widgets:
                - type: item
                  width: '9'
                  height: '3'
                  hide_header: 'YES'
                  fields:
                    - type: STRING
                      name: bg_color
                      value: 1EA7FD
                    - type: INTEGER
                      name: decimal_places
                      value: '0'
                    - type: STRING
                      name: description
                      value: '"Information" severity alert count'
                    - type: INTEGER
                      name: desc_size
                      value: '8'
                    - type: ITEM
                      name: itemid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        key: acronis.cpc.alerts.severity.info
                    - type: INTEGER
                      name: show.0
                      value: '2'
                    - type: INTEGER
                      name: show.1
                      value: '1'
                - type: item
                  'y': '3'
                  width: '9'
                  height: '3'
                  hide_header: 'YES'
                  fields:
                    - type: STRING
                      name: bg_color
                      value: 66BF3C
                    - type: INTEGER
                      name: decimal_places
                      value: '0'
                    - type: STRING
                      name: description
                      value: '"OK" severity alert count'
                    - type: INTEGER
                      name: desc_size
                      value: '8'
                    - type: ITEM
                      name: itemid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        key: acronis.cpc.alerts.severity.ok
                    - type: INTEGER
                      name: show.0
                      value: '2'
                    - type: INTEGER
                      name: show.1
                      value: '1'
                - type: item
                  'y': '6'
                  width: '9'
                  height: '3'
                  hide_header: 'YES'
                  fields:
                    - type: STRING
                      name: bg_color
                      value: E69D00
                    - type: INTEGER
                      name: decimal_places
                      value: '0'
                    - type: STRING
                      name: description
                      value: '"Warning" severity alert count'
                    - type: INTEGER
                      name: desc_size
                      value: '8'
                    - type: ITEM
                      name: itemid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        key: acronis.cpc.alerts.severity.warn
                    - type: INTEGER
                      name: show.0
                      value: '2'
                    - type: INTEGER
                      name: show.1
                      value: '1'
                - type: item
                  'y': '9'
                  width: '9'
                  height: '3'
                  hide_header: 'YES'
                  fields:
                    - type: STRING
                      name: bg_color
                      value: FF4400
                    - type: INTEGER
                      name: decimal_places
                      value: '0'
                    - type: STRING
                      name: description
                      value: '"Error" severity alert count'
                    - type: INTEGER
                      name: desc_size
                      value: '8'
                    - type: ITEM
                      name: itemid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        key: acronis.cpc.alerts.severity.err
                    - type: INTEGER
                      name: show.0
                      value: '2'
                    - type: INTEGER
                      name: show.1
                      value: '1'
                - type: item
                  'y': '12'
                  width: '9'
                  height: '3'
                  hide_header: 'YES'
                  fields:
                    - type: STRING
                      name: bg_color
                      value: E23636
                    - type: INTEGER
                      name: decimal_places
                      value: '0'
                    - type: STRING
                      name: description
                      value: '"Critical" severity alert count'
                    - type: INTEGER
                      name: desc_size
                      value: '8'
                    - type: ITEM
                      name: itemid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        key: acronis.cpc.alerts.severity.crit
                    - type: INTEGER
                      name: show.0
                      value: '2'
                    - type: INTEGER
                      name: show.1
                      value: '1'
                - type: graph
                  x: '9'
                  width: '12'
                  height: '6'
                  fields:
                    - type: GRAPH
                      name: graphid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        name: 'Acronis CPC: Alerts overview'
                    - type: STRING
                      name: reference
                      value: AAAAA
                - type: graphprototype
                  x: '9'
                  'y': '6'
                  width: '36'
                  height: '9'
                  fields:
                    - type: GRAPH_PROTOTYPE
                      name: graphid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        name: 'Device [{#NAME}]:[{#ID}]: CyberFit score'
                    - type: STRING
                      name: reference
                      value: AAAAC
                    - type: INTEGER
                      name: rows
                      value: '2'
                - type: graphprototype
                  x: '21'
                  width: '24'
                  height: '6'
                  fields:
                    - type: ITEM_PROTOTYPE
                      name: itemid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        key: 'acronis.cpc.customer.status[{#NAME}]'
                    - type: STRING
                      name: reference
                      value: AAAAB
                    - type: INTEGER
                      name: source_type
                      value: '3'
                - type: graphprototype
                  x: '45'
                  width: '27'
                  height: '7'
                  fields:
                    - type: ITEM_PROTOTYPE
                      name: itemid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        key: 'acronis.cpc.device.agent.enabled[{#NAME}]'
                    - type: STRING
                      name: reference
                      value: AAAAD
                    - type: INTEGER
                      name: source_type
                      value: '3'
                - type: graphprototype
                  x: '45'
                  'y': '7'
                  width: '27'
                  height: '8'
                  fields:
                    - type: ITEM_PROTOTYPE
                      name: itemid.0
                      value:
                        host: 'Acronis Cyber Protect Cloud MSP by HTTP'
                        key: 'acronis.cpc.device.agent.online[{#NAME}]'
                    - type: STRING
                      name: reference
                      value: AAAAE
                    - type: INTEGER
                      name: source_type
                      value: '3'
      valuemaps:
        - uuid: 0c425866d0ce4412a54b66f215df4cde
          name: 'Alert severity'
          mappings:
            - value: '0'
              newvalue: OK
            - value: '1'
              newvalue: Warning
            - value: '2'
              newvalue: Error
            - value: '3'
              newvalue: Critical
            - value: '4'
              newvalue: Information
            - value: '10'
              newvalue: Unknown
        - uuid: 4a5652b3706a45faa2b86ae652425692
          name: 'CyberFit score'
          mappings:
            - value: '-1'
              newvalue: Unavailable
        - uuid: df45c606a7ef4f49a3101ad135eef1bc
          name: 'True false'
          mappings:
            - value: '0'
              newvalue: 'False'
            - value: '1'
              newvalue: 'True'
  graphs:
    - uuid: 1950de4a315f487f9382d82c2dba1778
      name: 'Acronis CPC: Alerts overview'
      type: PIE
      graph_items:
        - color: 1EA7FD
          item:
            host: 'Acronis Cyber Protect Cloud MSP by HTTP'
            key: acronis.cpc.alerts.severity.info
        - sortorder: '1'
          color: 66BF3C
          item:
            host: 'Acronis Cyber Protect Cloud MSP by HTTP'
            key: acronis.cpc.alerts.severity.ok
        - sortorder: '2'
          color: E69D00
          item:
            host: 'Acronis Cyber Protect Cloud MSP by HTTP'
            key: acronis.cpc.alerts.severity.warn
        - sortorder: '3'
          color: FF4400
          item:
            host: 'Acronis Cyber Protect Cloud MSP by HTTP'
            key: acronis.cpc.alerts.severity.err
        - sortorder: '4'
          color: E8083E
          item:
            host: 'Acronis Cyber Protect Cloud MSP by HTTP'
            key: acronis.cpc.alerts.severity.crit
