Hi Chris,
again, there are some missing attributes, now for the Alert (you had them in the previous policy).
I updated the policy (but did not test it) - I hope it works:
<Catalog version="1.0" globalextends="GLOBAL!" >
<!-- 28/02/2019 CF - Initial classification for APM MicroService alerting -->
<EventClass name="Item" >
<Classify>
<Field input="varbind-1.3.6.1.4.1.791.4.4.27" pattern=".*-pro$" output="eventtype" outval="RunningSoftware_Micro" />
</Classify>
<Format>
<Field output="MdrProduct" format="CA:00036" input="" />
<Field output='MdrProdInstance' format='{0}' input='{fqdn(localhost)}' />
</Format>
<Write>
<Field type="file" name="outfile" properties="*" />
<Field type="publishcache" properties="*" />
</Write>
</EventClass>
<EventClass name="RunningSoftware_Micro" extends="Item">
<Format>
<Field output="ClassName" format="RunningSoftware" input="" />
<Field output="MdrElementID" format="{0}" input="varbind-1.3.6.1.4.1.791.4.4.27" />
<Field output="ProductName" format="APM-MicroService" input="" />
<Field output="DeviceSysName" format="{0}" input="varbind-1.3.6.1.4.1.791.4.4.27" />
<Field output="temp_Label" format="{0}" input="varbind-1.3.6.1.4.1.791.4.4.27" />
</Format>
</EventClass>
<EventClass name="Alert" >
<Classify>
<Field input="varbind-1.3.6.1.4.1.791.4.4.27" pattern=".*-pro$" output="eventtype" outval="Alert_Micro" />
</Classify>
<Normalize>
<Field output="Severity" type="map" input="varbind-1.3.6.1.4.1.791.4.4.16">
<mapentry mapin="0" mapout="Normal" />
<mapentry mapin="1" mapout="Normal" />
<mapentry mapin="2" mapout="Minor" />
<mapentry mapin="3" mapout="Minor" />
<mapentry mapin="4" mapout="Major" />
<mapentry mapin="5" mapout="Critical" />
<mapentry mapin=".*" mapout="Minor" />
</Field>
</Normalize>
<Format>
<Field output='ClassName' format='Alert' input='' />
<Field output="AlertType" format="Risk-Fault" input="" />
<Field output="MdrProduct" format="CA:00036" input="" />
<Field output='MdrProdInstance' format='{0}' input='{fqdn(localhost)}' />
<Field output="AlertedMdrProduct" format="CA:00036" input="" />
<Field output='AlertedMdrProdInstance' format='{0}' input='{fqdn(localhost)}' />
<Field output="OccurrenceTimestamp" format="{0}" input='{xsdateTime(now)}'/>
<Field output='ReportTimestamp' format='{0}' input='{xsdateTime(now)}' />
</Format>
<Write>
<Field type="file" name="outfile" properties="*" />
<Field type="publishcache" properties="*" />
</Write>
</EventClass>
<EventClass name="Alert_Micro" extends="Alert">
<Parse>
<Field input="varbind-1.3.6.1.4.1.791.4.4.9" pattern="^(.*?)\|(.*?)\|(.*?):.*$" output="ElementID_1,ElementID_2,ElementID_3" />
</Parse>
<Format>
<Field output="MdrElementID" format="Alert_{0}-{1}-{2}" input="ElementID_1,ElementID_2,ElementID_3" />
<Field output="AlertedMdrElementID" format="{0}" input="varbind-1.3.6.1.4.1.791.4.4.27" />
<Field output="Summary" format="{0} violated threshold" input="varbind-1.3.6.1.4.1.791.4.4.24" />
<Field output="Message" format="{0}" input="varbind-1.3.6.1.4.1.791.4.4.4" />
<!-- Build the helpfile URL -->
<Field output="userAttribute2" format="{0}" input="{replace([varbind-1.3.6.1.4.1.791.4.4.11, ,%20])}" />
<Field output="userAttribute3" format="http://alerthub.unix.santanderuk.corp/help/wily/APM/{0}" input="{replace([varbind-1.3.6.1.4.1.791.4.4.24, ,%20])}" />
<Field output="userAttribute5" format="APM_SNMP_Alert_RunningSoftware" input="" />
<Field output="userAttribute6" format="Polled" input="" />
<Field output="userAttribute9" format="APM (Introscope)" input="" />
<Field output="Message" format="<b>Hostname: </b>{0} <b><br/>Problem: </b>{1} <br/>{2} <br/><br/><a href="{3}"><b><u>Click here for Ops instructions</b></u></a> <br/><br/><a href="{4}"><b><u>APM Console</b></u></a><br/>" input="AlertedMdrElementID,userAttribute9,Message,userAttribute3,userAttribute2" />
</Format>
</EventClass>
<EventClass name="USM-Entity" >
<Format2>
<Field conditional='temp_Label' output='Label' format='{0}' input='temp_Label' />
</Format2>
</EventClass>
</Catalog>
MichaelBoehm