I've tried to incorporate the changes you've recommended Michael, but now I'm not getting any alerts published. I've been staring at the code for hours and can't see where I've gone wrong. Would you be able to take a look please?
<Catalog version="1.0" globalextends="GLOBAL!" >
<!-- 28/02/2019 CF - Initial classification for APM alerting -->
<EventClass name="Item" >
<Classify>
<Field input="varbind-1.3.6.1.4.1.791.4.4.27" pattern=".*-pro$" output="eventtype" outval="RunningSoftware_Micro" />
</Classify>
<Format>
<Field output="MdrProduct" format="CA:00036" input="" />
</Format>
</EventClass>
<EventClass name="RunningSoftware_Micro" extends="Item">
<Parse>
<!-- Strip everything after ":active" as we don't want this for the MdrElementID -->
<Field input="varbind-1.3.6.1.4.1.791.4.4.9" pattern="^(.*?):active(.*)" output="ElementID_1,ElementID_2" />
</Parse>
<Format>
<Field output="ClassName" format="RunningSoftware" input="" />
<Field output="MdrProdInstance" format="{0}" input="varbind-1.3.6.1.4.1.791.4.4.27" />
<Field output="DeviceDNSName" format="{0}" input="varbind-1.3.6.1.4.1.791.4.4.27" />
<Field output="MdrElementID" format="{0}" input="{replace([ElementID_1,|,_])}" />
</Format>
<Write>
<Field type="file" name="outfile" properties="*" />
<Field type="publishcache" properties="*" />
</Write>
</EventClass>
<EventClass name="Alert" >
<Classify>
<Field input="varbind-1.3.6.1.4.1.791.4.4.27" pattern=".*-pro$" output="eventtype" outval="Alert_Micro" />
</Classify>
<Normalize>
<Field output="Severity" type="map" input="varbind-1.3.6.1.4.1.791.4.4.16">
<mapentry mapin="0" mapout="Normal" />
<mapentry mapin="1" mapout="Normal" />
<mapentry mapin="2" mapout="Minor" />
<mapentry mapin="3" mapout="Critical" />
<mapentry mapin=".*" mapout="Minor" />
</Field>
</Normalize>
<Format>
<!-- These are fixed, default parameters that generally should be set and then overridden if needed -->
<!-- Field output="MdrProduct" format="CA:00036" input="" /-->
<Field output="AlertType" format="Risk-Fault" input="" />
<Field output="AlertedMdrProduct" format="CA:00036" input="" />
<Field output="OccurrenceTimestamp" format="{0}" input='{xsdateTime(now)}' />
<Field output="ReportTimestamp" format="{0}" input='{xsdateTime(now)}' />
</Format>
</EventClass>
<EventClass name="Alert_Micro" extends="Alert">
<Parse>
<!-- Strip everything after ":active" as we don't want this for the MdrElementID -->
<Field input="varbind-1.3.6.1.4.1.791.4.4.9" pattern="^(.*?):active(.*)" output="ElementID_1,ElementID_2" />
</Parse>
<Format>
<Field output="Summary" format="{0} violated threshold" input="{replace([varbind-1.3.6.1.4.1.791.4.4.9,|, ])}" />
<Field output="Message" format="{0}" input="varbind-1.3.6.1.4.1.791.4.4.4" />
<Field output="AlertedMdrProdInstance" format="{0}" input="varbind-1.3.6.1.4.1.791.4.4.9" />
<Field output="AlertedMdrElementID" format="{0}" input="{replace([ElementID_1,|,_])}" />
<!-- Field output="MdrElementID" format="{0}" input="{replace([ElementID_1,|,_])}" /-->
<!-- Build the Generic helpfile URL for ALM -->
<Field output="userAttribute3" format="http://alerthub.unix.santanderuk.corp/help/wily/APM/{0}" input="{replace([varbind-1.3.6.1.4.1.791.4.4.24, ,%20])}" />
<Field output="userAttribute5" format="APM_SNMP_Alert_RunningSoftware" input="" />
<Field output="userAttribute6" format="Polled" input="" />
<Field output="userAttribute9" format="APM (Introscope)" input="" />
<Field output="userAttribute2" format="{0}" input="{replace([varbind-1.3.6.1.4.1.791.4.4.11, ,%20])}" />
<Field output="Message" format="<b>Hostname: </b>{0} <b><br/>Problem: </b>{1} <br/>{2} <br/><br/><a href="{3}"><b><u>Click here for Ops instructions</b></u></a> <br/><br/><a href="{4}"><b><u>APM Console</b></u></a><br/>" input="AlertedMdrElementID,userAttribute9,Message,userAttribute3,userAttribute2" />
</Format>
<Write>
<Field type="file" name="outfile" properties="*" />
<Field type="publishcache" properties="*" />
</Write>
</EventClass>
<EventClass name="USM-Entity" >
</EventClass>
</Catalog>