[{"key":"device_down","display":"AP offline","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","timestamp":1629753888,"last_seen":1629753888,"aps":["d420b02000fa"],"org_id":"09dac91f-6e73-4100-89f7-698e0fafbb1b","site_id":"dcfb31a1-d615-4361-8c95-b9dde05aa704","count":1,"hostnames":["Vendor_AP2"],"id":"f70c308f-7007-4866-9ecd-0d01842979ea","type":"device_down","group":"infrastructure"},"fields":["aps","hostnames"]},{"key":"device_restarted","display":"AP restarted","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["power_cycle"],"timestamp":1629754030,"last_seen":1629754094,"aps":["5c5b350e1d1f","5c5b353ed0bb"],"org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","count":2,"hostnames":["AP1","AP3"],"id":"94d015f6-5f8f-44a0-a75e-02e70969803a","type":"device_restarted","group":"infrastructure"},"fields":["aps","reasons","hostnames"]},{"key":"loop_detected_by_ap","display":"Loop detected (by AP)","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","aps":["5c5b355114cc"],"hostnames":["TR-FIPS"],"count":2,"id":"d188d20f-bfdb-49f6-95a5-82ba50366a7e","type":"loop_detected_by_ap","group":"infrastructure"},"fields":["aps","hostnames"]},{"key":"switch_down","display":"Switch offline","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","switches":["f4bfa806c96c"],"count":2,"hostnames":["switch_vc"],"id":"badb2358-53c3-413d-adba-c45436a3196f","type":"switch_down","group":"infrastructure"},"fields":["switches","hostnames"]},{"key":"switch_radius_server_unresponsive","display":"Switch Radius Server Unresponsive","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"critical","timestamp":1629911554,"last_seen":1629911554,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["f4bfa806c96c"],"hostnames":["SF-Office-Core-Switch"],"models":["EX4400-48P"],"details":["AUTHD_RADIUS_SERVER_STATUS_CHANGE: Status of radius server 3.33.194.183 set to UNREACHABLE (profile dot1x)"],"count":1,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"cac51761-cf91-41e7-80ad-a508061e666e","type":"switch_radius_server_unresponsive","group":"infrastructure"},"fields":["switches","details","hostnames","models"]},{"key":"switch_restarted","display":"Switch restarted","group":"infrastructure","severity":"info","default_enabled":true,"example":{"severity":"info","reasons":["power_cycle"],"timestamp":1629911554,"last_seen":1629911554,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["f4bfa806c96c"],"count":1,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","hostnames":["switch_vc"],"id":"cac51761-cf91-41e7-80ad-a508061e666e","type":"switch_restarted","detail":"SNMPD_TRAP_COLD_START: trap_generate_cold: SNMP trap: cold start","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"gateway_down","display":"WAN Edge offline","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","gateways":["94f7adf72ea0"],"timestamp":1629919661,"last_seen":1629919661,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"46700c97-aa48-4058-aeba-ad57e2e766c1","count":1,"hostnames":["Champak_Srx"],"id":"d9ab6dfe-7fe3-4155-9c8a-66cdcf0092aa","type":"gateway_down","group":"infrastructure"},"fields":["hostnames","gateways"]},{"key":"device_reconnected","display":"AP reconnected","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629754258,"last_seen":1629754258,"aps":["5c5b355114cc"],"org_id":"09dac91f-6e73-4100-89f7-698e0fafbb1b","site_id":"dcfb31a1-d615-4361-8c95-b9dde05aa704","count":1,"hostnames":["WAP3157"],"id":"7ba476db-e804-4c1b-a322-b94e43b58570","type":"device_reconnected","group":"infrastructure"},"fields":["aps","hostnames"]},{"key":"infra_dhcp_failure","display":"DHCP Failure","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","timestamp":1629754258,"last_seen":1629754258,"aps":["5c5b355114cc"],"org_id":"09dac91f-6e73-4100-89f7-698e0fafbb1b","site_id":"dcfb31a1-d615-4361-8c95-b9dde05aa704","count":1,"id":"7ba476db-e804-4c1b-a322-b94e43b58570","type":"infra_dhcp_failure","group":"infrastructure"},"fields":["incident_count","hostnames","wlan_ids","servers","aps","ssids","vlans","client_count","wcids"]},{"key":"infra_dhcp_success","display":"DHCP Recovered","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629754258,"last_seen":1629754258,"aps":["5c5b355114cc"],"org_id":"09dac91f-6e73-4100-89f7-698e0fafbb1b","site_id":"dcfb31a1-d615-4361-8c95-b9dde05aa704","count":1,"id":"7ba476db-e804-4c1b-a322-b94e43b58570","type":"infra_dhcp_success","group":"infrastructure"},"fields":["vlans","servers"]},{"key":"infra_dns_failure","display":"DNS Failure","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","timestamp":1629754258,"last_seen":1629754258,"aps":["5c5b355114cc"],"org_id":"09dac91f-6e73-4100-89f7-698e0fafbb1b","site_id":"dcfb31a1-d615-4361-8c95-b9dde05aa704","count":1,"id":"7ba476db-e804-4c1b-a322-b94e43b58570","type":"infra_dns_failure","group":"infrastructure"},"fields":["incident_count","hostnames","wlan_ids","servers","aps","ssids","vlans","client_count","wcids"]},{"key":"infra_dns_success","display":"DNS Recovered","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629754258,"last_seen":1629754258,"aps":["5c5b355114cc"],"org_id":"09dac91f-6e73-4100-89f7-698e0fafbb1b","site_id":"dcfb31a1-d615-4361-8c95-b9dde05aa704","count":1,"id":"7ba476db-e804-4c1b-a322-b94e43b58570","type":"infra_dns_success","group":"infrastructure"},"fields":["vlans","servers"]},{"key":"infra_arp_failure","display":"ARP Failure","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","timestamp":1629754258,"last_seen":1629754258,"aps":["5c5b355114cc"],"org_id":"09dac91f-6e73-4100-89f7-698e0fafbb1b","site_id":"dcfb31a1-d615-4361-8c95-b9dde05aa704","count":1,"id":"7ba476db-e804-4c1b-a322-b94e43b58570","type":"infra_arp_failure","group":"infrastructure"},"fields":["incident_count","hostnames","wlan_ids","servers","aps","ssids","vlans","client_count","wcids"]},{"key":"infra_arp_success","display":"ARP Recovered","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629754258,"last_seen":1629754258,"aps":["5c5b355114cc"],"org_id":"09dac91f-6e73-4100-89f7-698e0fafbb1b","site_id":"dcfb31a1-d615-4361-8c95-b9dde05aa704","count":1,"id":"7ba476db-e804-4c1b-a322-b94e43b58570","type":"infra_arp_success","group":"infrastructure"},"fields":["vlans","servers"]},{"key":"switch_reconnected","display":"Switch reconnected","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629911711,"last_seen":1629911711,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","switches":["f4bfa806c96c"],"count":1,"hostnames":["switch_vc"],"id":"06c42798-cf77-4817-ba5e-02c9c05404dd","type":"switch_reconnected","group":"infrastructure"},"fields":["switches","hostnames"]},{"key":"gateway_reconnected","display":"WAN Edge reconnected","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["0c812667c568"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"hostnames":["srx320-hub"],"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"gateway_reconnected","group":"infrastructure"},"fields":["hostnames","gateways"]},{"key":"secpolicy_violation","display":"Security Policy Violation","group":"security","severity":"warn","default_enabled":false,"example":{"id":"8d2ae972-4339-4db4-bad7-a9440c72dd90","org_id":"688605f-916a-47a1-8c68-f19618300a08","site_id":"ec3b5624-73f1-4ed3-b3fd-5ba3ee40368a","type":"secpolicy_violation","group":"security","severity":"warn","timestamp":1633084683,"last_seen":1633084683,"secpolicy_violated":true,"aps":["5c5b350f3208"],"hostnames":["5c5b353e2698"],"wlan_ids":["1bf047be-9819-445c-a531-d6637a3736b3"],"count":1},"fields":["aps","hostnames"]},{"key":"vpn_peer_down","display":"Wan Edge VPN Peer Down","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","gateways":["0200010bd3cf"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"cb768f63-1f32-455c-acf7-d98a7e579dd0","count":609,"site_id":"3bf704d8-a0a6-416b-9623-5bcc2ed042bb","id":"bdbee805-4d69-466f-93a1-74ad09c4e53e","reasons":["peer CSQA_Hub01 down"],"hostnames":["all-my-circuits"],"type":"vpn_peer_down","group":"infrastructure"},"fields":["hostnames","gateways","reasons"]},{"key":"vpn_peer_up","display":"VPN Peer Up","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["0200010bd3cf"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"cb768f63-1f32-455c-acf7-d98a7e579dd0","count":609,"site_id":"3bf704d8-a0a6-416b-9623-5bcc2ed042bb","id":"bdbee805-4d69-466f-93a1-74ad09c4e53e","reasons":["peer CSQA_Hub01 up"],"hostnames":["all-my-circuits"],"type":"vpn_peer_up","group":"infrastructure"},"fields":["hostnames","gateways","reasons"]},{"key":"gw_vpn_path_up","display":"Wan Edge VPN Path Up","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["ac78d14bac78"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"d1b87599-5e61-4403-aae5-b6d3b2a59081","site_id":"08f42f73-8221-451b-8368-41ab9e917944","id":"1f863ef8-e81b-4b6d-9a01-cc645b45d2c3","reasons":["VPN WAN_INET_to_2c4c159b3600_WAN_0 from 6.4.0.9 is up."],"hostnames":["gateway"],"type":"gw_vpn_path_up","group":"infrastructure"},"fields":["hostnames","gateways","reasons"]},{"key":"gw_vpn_path_down","display":"Wan Edge VPN Path Down","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["ac78d14bac78"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"d1b87599-5e61-4403-aae5-b6d3b2a59081","site_id":"08f42f73-8221-451b-8368-41ab9e917944","id":"1f863ef8-e81b-4b6d-9a01-cc645b45d2c3","reasons":["VPN WAN_INET_to_2c4c159b3600_WAN_0 from 6.4.0.9 is down."],"hostnames":["gateway"],"type":"gw_vpn_path_down","group":"infrastructure"},"fields":["hostnames","gateways","reasons"]},{"key":"ha_control_link_down","display":"HA Control Link Down","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["0200010bd3cf"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"cb768f63-1f32-455c-acf7-d98a7e579dd0","count":609,"site_id":"3bf704d8-a0a6-416b-9623-5bcc2ed042bb","id":"bdbee805-4d69-466f-93a1-74ad09c4e53e","reasons":["peer CSQA_Hub01 down"],"hostnames":["all-my-circuits"],"type":"ha_control_link_down","group":"infrastructure"},"fields":["hostnames","gateways","reasons"]},{"key":"sw_alarm_chassis_mgmt_link_down","display":"Fpc Management Ethernet Link Down","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["FPC Management1 Ethernet Link Down"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"8dc44280-48cc-4f40-bc9a-fdb446409620","switches":["485a0de80600"],"hostnames":["Switch1"],"site_id":"1e7bc86d-6558-4bab-9c6b-a026c5f45ec3","id":"6ee3267b-122c-4b07-85ad-94174ec3974e","type":"sw_alarm_chassis_mgmt_link_down","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_mgmt_link_down_clear","display":"Fpc Management Ethernet Link Down Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["Alarm cleared: (SW_ALARM_CHASSIS_MGMT_LINK_DOWN) FPC Management1 Ethernet Link Down Clear"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"8dc44280-48cc-4f40-bc9a-fdb446409620","switches":["485a0de80600"],"hostnames":["Switch1"],"site_id":"1e7bc86d-6558-4bab-9c6b-a026c5f45ec3","id":"6ee3267b-122c-4b07-85ad-94174ec3974e","type":"sw_alarm_chassis_mgmt_link_down_clear","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"ha_control_link_up","display":"HA Control Link Up","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["0200010bd3cf"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"cb768f63-1f32-455c-acf7-d98a7e579dd0","count":609,"site_id":"3bf704d8-a0a6-416b-9623-5bcc2ed042bb","id":"bdbee805-4d69-466f-93a1-74ad09c4e53e","reasons":["peer CSQA_Hub01 up"],"hostnames":["all-my-circuits"],"type":"ha_control_link_up","group":"infrastructure"},"fields":["hostnames","gateways","reasons"]},{"key":"gw_bgp_neighbor_down","display":"WAN Edge BGP Neighbor Down","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","gateways":["0200010bd3cf"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"cb768f63-1f32-455c-acf7-d98a7e579dd0","count":609,"site_id":"3bf704d8-a0a6-416b-9623-5bcc2ed042bb","id":"bdbee805-4d69-466f-93a1-74ad09c4e53e","reasons":["peer CSQA_Hub01 down"],"hostnames":["all-my-circuits"],"type":"bgp_neighbor_down","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_bgp_neighbor_up","display":"WAN Edge BGP Neighbor Up","group":"infrastructure","severity":"info","default_enabled":true,"example":{"severity":"info","gateways":["0200010bd3cf"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"cb768f63-1f32-455c-acf7-d98a7e579dd0","count":609,"site_id":"3bf704d8-a0a6-416b-9623-5bcc2ed042bb","id":"bdbee805-4d69-466f-93a1-74ad09c4e53e","reasons":["peer CSQA_Hub01 up"],"hostnames":["all-my-circuits"],"type":"bgp_neighbor_up","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"tunnel_down","display":"Wan Edge Tunnel Down","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","timestamp":1629755232,"last_seen":1629755840,"org_id":"cb768f63-1f32-455c-acf7-d98a7e579dd0","count":609,"site_id":"3bf704d8-a0a6-416b-9623-5bcc2ed042bb","id":"bdbee805-4d69-466f-93a1-74ad09c4e53e","gateways":["0200010bd3cf"],"tunnel_names":["template-zscaler"],"peer_hosts":["104.129.194.39"],"reasons":["Tunnel torn down from other side"],"type":"tunnel_down","group":"infrastructure"},"fields":["gateways","tunnel_names","reasons","peer_hosts"]},{"key":"tunnel_up","display":"Tunnel up","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","timestamp":1629755232,"last_seen":1629755840,"org_id":"cb768f63-1f32-455c-acf7-d98a7e579dd0","count":609,"site_id":"3bf704d8-a0a6-416b-9623-5bcc2ed042bb","id":"bdbee805-4d69-466f-93a1-74ad09c4e53e","gateways":["0200010bd3cf"],"tunnel_names":["template-zscaler"],"peer_hosts":["10.213.18.23"],"reasons":["GRE Tunnel gr-0/0/0.0 from mid to 10.213.18.23 up"],"type":"tunnel_up","group":"infrastructure"},"fields":["gateways","tunnel_names","reasons","peer_hosts"]},{"key":"bssid_spoofing","display":"BSSID Spoofing detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"info","timestamp":1626694986,"last_seen":1626694986,"org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","site_id":"5ca47c9b-b637-4935-958e-10d7e39a697c","count":1,"id":"1ec37c5b-0e6b-4032-96a8-1f41b9d53386","type":"bssid_spoofing","group":"security","aps":["5c5b35ce1111"],"hostnames":["AP_NAME"],"bssids":["5c5b35c61111"],"ssids":["@brguest"]},"fields":["aps","bssids","ssids","hostnames"]},{"key":"honeypot_ssid","display":"Honeypot SSID detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"info","last_seen":1629755289,"aps":["5c5b350e02b7"],"hostnames":["AP_NAME"],"count":4,"type":"honeypot_ssid","ssids":["New WLAN"],"timestamp":1629755289,"bssids":["5c5b352016b2","5c5b35001685","5c5b352016c2","5c5b35001695"],"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"57b2f891-09c1-4dcc-8ff1-2f9fb3ff7d39","id":"ec653cbc-73e5-4712-a54c-29aa26deb54a","group":"security"},"fields":["aps","bssids","ssids","hostnames"]},{"key":"adhoc_network","display":"Adhoc Network detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["adhoc"],"timestamp":1631205266,"last_seen":1631205266,"aps":["5c5b35507ed6"],"hostnames":["AP43_AWS_Staging","AP41_AWS_Staging"],"org_id":"26c435c0-910e-4298-a58d-643783b61eec","site_id":"4819f8ce-434f-44c4-8ffc-89a9c6cc1cad","count":1,"id":"07f001dc-175f-4c6d-99a7-8e2ce7a57131","type":"adhoc_network","group":"security"},"fields":["client_mac1","aps","ssids","hostnames","client_mac2"]},{"key":"rogue_ap","display":"Rogue AP detected","group":"security","severity":"critical","default_enabled":false,"example":{"severity":"critical","last_seen":1629862968,"aps":["5c5b35500442"],"hostnames":["AP_NAME"],"count":2,"type":"rogue_ap","ssids":["DIRECT-roku-371-0064B1","DIRECT-wa-BRAVIA"],"timestamp":1629862968,"bssids":["ca3a6bef7457","d2143d426fd4"],"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"f688779c-e335-4f88-8d7c-9c5e9964528b","id":"59be9221-1e26-4466-baa3-6afbce1b7bcb","group":"security"},"fields":["aps","bssids","ssids","hostnames"]},{"key":"rogue_client","display":"Client Connection to rogue AP detected","group":"security","severity":"critical","default_enabled":false,"example":{"severity":"critical","last_seen":1629139377,"aps":["5c5b350edd65"],"hostnames":["AP_NAME"],"count":2,"type":"rogue_client","timestamp":1629139377,"bssids":["1491827decc6","5c5b35094de0"],"org_id":"41f579e0-5a00-4164-92f3-662b53ae8c66","wcids":["84942dde-81dc-90be-3627-b785e7b31915"],"site_id":"c475d117-b152-445d-8117-2248046f58f7","id":"96a1b7f2-dcf7-49ed-91e5-7cd55c0a2b6d","group":"security"},"fields":["aps","bssids","hostnames","wcids"]},{"key":"watched_station","display":"Active Watched Station detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","timestamp":1631666109,"last_seen":1631666291,"aps":["5c5b350e75c7"],"hostnames":["AP_NAME"],"org_id":"bb1a8bf6-4064-4bbd-83dc-8053a663cf66","wcids":["fb9418b5-4d8f-578c-2ca3-52652bd6e963"],"count":4,"site_id":"efe0473b-ad62-4c41-adfe-8b15d1ad18bb","id":"80ba651f-a1c2-45a8-8b5a-9ae9b8929aae","type":"watched_station","group":"security"},"fields":["aps","hostnames","wcids"]},{"key":"eap_handshake_flood","display":"EAP Handshake Flood detected","group":"security","severity":"info","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"client_macs":["9809cfa7eef8"],"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"eap_handshake_flood","group":"security"},"fields":["client_macs","aps","ssids","hostnames","bssids"]},{"key":"air_magnet_scan","display":"Air Magnet Scan detected","group":"security","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1631194699,"last_seen":1631194821,"aps":["5c5b352e22ec"],"hostnames":["AP_NAME"],"org_id":"26c435c0-910e-4298-a58d-643783b61eec","site_id":"4819f8ce-434f-44c4-8ffc-89a9c6cc1cad","count":3,"client_macs":["9809cfa7eef8"],"id":"bf4301fd-c0fa-4ff1-b500-96740ab0c42c","type":"air_magnet_scan","group":"security"},"fields":["aps","hostnames","client_macs"]},{"key":"excessive_eapol_start","display":"Excessive EAPOL-Start detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"client_macs":["9809cfa7eef8"],"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"excessive_eapol_start","group":"security"},"fields":["aps","ssids","hostnames","client_macs"]},{"key":"eapol_logoff_attack","display":"EAPOL-Logoff Attack detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","last_seen":1628102718,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"count":1,"type":"eapol_logoff_attack","ssids":["Personal_WLAN"],"timestamp":1628102718,"bssids":["5c5b35545e93"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","client_macs":["9809cfa7eef8"],"id":"f3853f77-8a50-45fe-b472-9e511d0cac3a","group":"security"},"fields":["client_macs","aps","ssids","hostnames","bssids"]},{"key":"eap_dictionary_attack","display":"EAP Dictionary Attack detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"client_macs":["9809cfa7eef8"],"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"eap_dictionary_attack","group":"security"},"fields":["client_macs","aps","ssids","hostnames","bssids"]},{"key":"disassociation_flood","display":"Disassociation Attack detected","group":"security","severity":"warn","default_enabled":false,"example":{"aps":["5c5b35500451"],"bssids":["5c5b35545e93"],"client_macs":["9809cfa7eef8"],"hostnames":["AP_NAME"],"count":1,"group":"security","id":"2a2e9de5-279b-4f49-8e05-c30ab82de810","last_seen":1628102718,"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","severity":"warn","site_name":"Countess","ssids":["sauce"],"timestamp":1641498035,"type":"disassociation_flood"},"fields":["client_macs","aps","ssids","hostnames","bssids"]},{"key":"beacon_flood","display":"Fake AP Flooding detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","timestamp":1628208162,"last_seen":1628208162,"aps":["5c5b352e22ec"],"hostnames":["AP45_AWS_Staging"],"org_id":"26c435c0-910e-4298-a58d-643783b61eec","site_id":"4819f8ce-434f-44c4-8ffc-89a9c6cc1cad","count":1,"id":"1e768717-00f9-419d-b2c1-e9c229d352d5","type":"beacon_flood","group":"security"},"fields":["aps","hostnames"]},{"key":"essid_jack","display":"ESSID Jack detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"essid_jack","group":"security"},"fields":["aps","hostnames"]},{"key":"krack_attack","display":"Replay Injection detected - KRACK Attack","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"client_macs":["9809cfa7eef8"],"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"krack_attack","group":"security"},"fields":["client_macs","aps","ssids","hostnames","bssids"]},{"key":"vendor_ie_missing","display":"Vendor IE Missing","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","last_seen":1628222361,"aps":["5c5b352e4cb3"],"count":2,"type":"vendor_ie_missing","ssids":["","we.piranha.xf3"],"bssids":["c0a00d58e833","725bf0c36c69"],"timestamp":1628222318,"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","id":"e1ee1619-b9c5-4697-832a-28de216dd576","group":"security"},"fields":["aps","bssids","ssids","hostnames"]},{"key":"tkip_icv_attack","display":"TKIP ICV Attack","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"client_macs":["9809cfa7eef8"],"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"tkip_icv_attack","group":"security"},"fields":["client_macs","aps","ssids","hostnames","bssids"]},{"key":"repeated_auth_failures","display":"Repeated Client Authentication Failures","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"info","last_seen":1633069735,"aps":["5c5b350e0262"],"hostnames":["AP_NAME"],"count":1,"type":"repeated_auth_failures","ssids":["TORAN_TEST"],"timestamp":1633069735,"bssids":"5c5b35001ad8","org_id":"1688605f-916a-47a1-8c68-f19618300a08","site_id":"ec3b5624-73f1-4ed3-b3fd-5ba3ee40368a","client_macs":["52b2f369d7cd"],"id":"59033c55-55a8-483a-a60f-d02b27a4f70d","group":"security"},"fields":["client_macs","aps","ssids","hostnames","bssids"]},{"key":"eap_failure_injection","display":"EAP Failure Injection detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"eap_failure_injection","group":"security"},"fields":["aps","bssids","hostnames"]},{"key":"eap_spoofed_success","display":"EAP Spoofed Success detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"eap_spoofed_success","group":"security"},"fields":["aps","bssids","hostnames"]},{"key":"out_of_sequence","display":"Out of Sequence detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"client_macs":["9809cfa7eef8"],"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"out_of_sequence","group":"security"},"fields":["aps","bssids","ssids","hostnames"]},{"key":"zero_ssid_association","display":"Zero SSID Association Request detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"client_macs":["9809cfa7eef8"],"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"excessive_eapol_start","group":"security"},"fields":["aps","bssids","ssids","hostnames"]},{"key":"monkey_jack","display":"Monkey Jack detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["WIDS_Test"],"timestamp":1628283423,"last_seen":1628283423,"aps":["5c5b35500451"],"hostnames":["AP_NAME"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"id":"e9c121dd-6d4f-4fdf-a383-9dd9790cac93","type":"monkey_jack","group":"security"},"fields":["aps","bssids","hostnames"]},{"key":"excessive_client","display":"Excessive Clients detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","timestamp":1628262281,"last_seen":1628262281,"aps":["5c5b35500451"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"id":"364748ac-e83c-49a1-97db-6032ed2e7a05","type":"excessive_client","group":"security"},"fields":["aps","hostnames"]},{"key":"esl_recovered","display":"ESL Recovered","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","timestamp":1628262281,"last_seen":1628262281,"aps":["5c5b35500451"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"id":"364748ac-e83c-49a1-97db-6032ed2e7a05","type":"esl_recovered","group":"security"},"fields":["aps"]},{"key":"esl_hung","display":"ESL Hung","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","timestamp":1628262281,"last_seen":1628262281,"aps":["5c5b35500451"],"org_id":"5e230eaf-93ff-4180-af6f-c1adc5dded52","site_id":"b9e4defa-453e-4ca8-a8c1-8c9d337ed2ef","count":1,"id":"364748ac-e83c-49a1-97db-6032ed2e7a05","type":"esl_hung","group":"security"},"fields":["aps"]},{"key":"missing_vlan","display":"Missing VLAN","group":"marvis","severity":"critical","marvis_suggestion_category":"switch","default_enabled":true,"example":{"severity":"critical","timestamp":1629760130,"last_seen":1629760130,"status":"resolved","license_requirement":"VNA","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","count":1,"id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","action_id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","suggestion":"config_vlan","category":"switch","details":{"action":"config_vlan","category":"switch","status":"open","symptom":"missing_vlan"},"impacted_entities":[{"entity_type":"switch","entity_mac":"1a2b3c4d5e6f","entity_name":"EXAMPLE SWITCH","port_id":"ge-0/0/10","missing_vlan_id":"109"}],"type":"MISSING_VLAN","group":"marvis"},"fields":["port_ids","entity_macs","missing_vlan_ids"]},{"key":"bad_cable","display":"Bad cable","group":"marvis","severity":"critical","marvis_suggestion_category":"switch","default_enabled":true,"example":{"severity":"critical","timestamp":1629760130,"last_seen":1629760130,"org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"[MIST CSQA] QA Org [Staging]","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"jing","status":"open","suggestion":"test_replace_cable","count":1,"id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","alert_id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","category":"layer_1","impacted_entities":[{"entity_mac":"544b8c18fa66","entity_name":"sw_2300_48mp","entity_type":"switch","port_id":"ge-0/0/1"}],"details":{"action":"test_replace_cable","category":"layer_1","status":"open","symptom":"bad_cable"},"type":"bad_cable","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"switch_offline","display":"Switch Offline","group":"marvis","severity":"critical","marvis_suggestion_category":"switch","default_enabled":true,"example":{"severity":"critical","timestamp":1629760130,"last_seen":1629760130,"org_id":"8dc44280-48cc-4f40-bc9a-fdb446409620","org_name":"[MIST CSQA] QA Org [Staging]","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"mocked_site_name","status":"open","suggestion":"check_switch_offline","count":1,"id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","alert_id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","category":"switch","impacted_entities":[{"entity_mac":"544b8c18fa66","entity_name":"sw_2300_48mp","entity_type":"switch"}],"details":{"action":"check_switch_offline","category":"switch","status":"open","symptom":"sw_offline"},"type":"sw_offline","group":"marvis"},"fields":["entity_macs"]},{"key":"port_flap","display":"Port flap","group":"marvis","severity":"warn","marvis_suggestion_category":"switch","default_enabled":true,"example":{"severity":"warn","timestamp":1631853846,"last_seen":1631853846,"org_id":"1688605f-916a-47a1-8c68-f19618300a08","org_name":"[MIST CSQA] Mist Office","site_id":"ec3b5624-73f1-4ed3-b3fd-5ba3ee40368a","site_name":"Wired Assurance","count":1,"category":"switch","id":"8f3ad435-5e0d-4178-a4e9-a7bf887b916b","alert_id":"8f3ad435-5e0d-4178-a4e9-a7bf887b916b","status":"open","details":{"action":"check_port","category":"switch","status":"open","symptom":"port_flap"},"impacted_entities":[{"entity_mac":"f07cc7667014","entity_name":"unknown","entity_type":"switch","port_id":"ge-1/0/28","connected_device_mac":"","connected_device_name":"","vlan_id":"100,110","interface_mode":"access"}],"type":"port_flap","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"port_stuck","display":"Port Stuck","group":"marvis","severity":"critical","marvis_suggestion_category":"switch","default_enabled":true,"example":{"severity":"critical","timestamp":1629760130,"last_seen":1629760130,"status":"resolved","license_requirement":"VNA","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","count":1,"id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","action_id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","suggestion":"check_port_stuck","category":"switch","details":{"action":"check_port_stuck","category":"switch","status":"open","symptom":"port_stuck"},"impacted_entities":[{"entity_type":"switch","entity_mac":"f4bfa816f66d","entity_name":"EX3400-48P-3","port_id":"ge-0/0/45","connected_device_mac":"001a070cd008","connected_device_name":"Vision-CAM-07","connected_device_manufacture":"Arecont Vision","vlan_id":"298"}],"type":"port_stuck","group":"marvis"},"fields":["port_ids","entity_macs","connected_device_manufactures","vlan_ids"]},{"key":"gw_bad_cable","display":"Bad cable","group":"marvis","severity":"critical","marvis_suggestion_category":"gateway","default_enabled":true,"example":{"severity":"critical","timestamp":1629760130,"last_seen":1629760130,"org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"[MIST CSQA] Mist Office","site_id":"ec3b5624-73f1-4ed3-b3fd-5ba3ee40368a","site_name":"Wired Assurance","count":1,"category":"layer_1","id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","alert_id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","details":{"action":"test_replace_cable","category":"layer_1","status":"open","symptom":"bad_cable"},"impacted_entities":[{"entity_mac":"544b8c18fa66","entity_name":"sw_2300_48mp","entity_type":"gateway","port_id":"ge-0/0/1"}],"status":"open","suggestion":"test_replace_cable","type":"gw_bad_cable","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"authentication_failure","display":"Authentication failure (Marvis)","group":"marvis","severity":"critical","marvis_suggestion_category":"connectivity","default_enabled":true,"example":{"severity":"critical","timestamp":1631854164,"last_seen":1631854164,"category":"connectivity","org_id":"1688605f-916a-47a1-8c68-f19618300a08","org_name":"unknown org","site_id":"ec3b5624-73f1-4ed3-b3fd-5ba3ee40368a","site_name":"jing","details":{"action":"check_radius_offline","category":"connectivity","status":"open","symptom":"auth_failure"},"impacted_entities":[{"entity_id":"84281ac7-4321-4db9-a893-bb520b976717","entity_name":"unknown wlan","entity_type":"wlan"}],"count":1,"id":"bb1aa333-b2c8-4afa-8a43-103f94919be6","alert_id":"bb1aa333-b2c8-4afa-8a43-103f94919be6","root_cause":"wlan_site","status":"open","suggestion":"check_auth_failure","type":"authentication_failure","group":"marvis"},"fields":["impacted_client_count","entity_ips"]},{"key":"dhcp_failure","display":"DHCP failure (Marvis)","group":"marvis","severity":"critical","marvis_suggestion_category":"connectivity","default_enabled":true,"example":{"severity":"critical","timestamp":1629741600,"last_seen":1629741600,"category":"connectivity","org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"unknown org","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"jing","count":1,"id":"05ecabab-5d4c-499f-9142-00c5fa73b6cc","alert_id":"05ecabab-5d4c-499f-9142-00c5fa73b6cc","details":{"action":"check_dhcp","category":"connectivity","status":"reoccured","symptom":"dhcp_failure"},"impacted_entities":[{"entity_ip":"172.16.0.27","entity_type":"dhcp server"},{"entity_ip":"172.16.0.26","entity_type":"dhcp server"}],"root_cause":"dhcpserver_site","status":"reoccured","suggestion":"check_dhcp_failure","type":"psk_failure","group":"marvis"},"fields":["entity_ips"]},{"key":"minis_dhcp_failure","display":"DHCP failure (Marvis-Minis)","group":"marvis","severity":"critical","marvis_suggestion_category":"connectivity","default_enabled":true,"example":{"action_id":"179da528-f173-3dd1-a4d9-f40553a27900","status":"open","license_requirement":"VNA","org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"","When":1742859053,"type":"MINIS_DHCP_FAILURE","suggestion":"check_DHCP_Failure","category":"connectivity","details":{"action":"check_DHCP_Failure","symptom":"dhcp_failure","category":"connectivity","status":"open"},"impacted_entities":[{"entity_type":"dhcp_server","entity_ip":"server ip"},{"entity_type":"impacted_vlans","entity_name":"vlan","entity_id":"1"}]},"fields":["entity_ids","entity_ips"]},{"key":"arp_failure","display":"ARP failure (Marvis)","group":"marvis","severity":"critical","marvis_suggestion_category":"connectivity","default_enabled":true,"example":{"severity":"critical","timestamp":1631854164,"last_seen":1631854164,"category":"connectivity","org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"unknown org","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"jing","count":1,"id":"bb1aa333-b2c8-4afa-8a43-103f94919be6","alert_id":"bb1aa333-b2c8-4afa-8a43-103f94919be6","details":{"action":"check_arp","category":"connectivity","status":"open","symptom":"arp_failure"},"impacted_entities":[{"entity_mac":"ac23160da124","entity_name":"ac:23:16:0d:a1:24","entity_type":"ap"}],"root_cause":"ap","status":"open","suggestion":"check_arp_failure","type":"arp_failure","group":"marvis"},"fields":["entity_ips"]},{"key":"minis_arp_failure","display":"ARP failure (Marvis-Minis)","group":"marvis","severity":"critical","marvis_suggestion_category":"connectivity","default_enabled":true,"example":{"action_id":"87040836-5732-3eca-8037-cb232119fa46","status":"open","license_requirement":"VNA","org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"","When":1742859053,"type":"MINIS_ARP_FAILURE","suggestion":"check_ARP_Failure","category":"connectivity","details":{"action":"check_ARP_Failure","symptom":"arp_failure","category":"connectivity","status":"open"},"impacted_entities":[{"entity_type":"arp_server","entity_ip":"172.16.255.254"},{"entity_type":"impacted_vlans","entity_name":"vlan","entity_id":"1"}]},"fields":["entity_ids","entity_ips"]},{"key":"dns_failure","display":"DNS failure (Marvis)","group":"marvis","severity":"critical","marvis_suggestion_category":"connectivity","default_enabled":true,"example":{"severity":"critical","timestamp":1631854255,"last_seen":1631854255,"category":"connectivity","org_id":"1688605f-916a-47a1-8c68-f19618300a08","org_name":"unknown org","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"jing","count":1,"id":"bb1aa333-b2c8-4afa-8a43-103f94919be6","alert_id":"bb1aa333-b2c8-4afa-8a43-103f94919be6","details":{"action":"check_dns","category":"connectivity","status":"open","symptom":"dns_failure"},"group":"marvis","impacted_entities":[{"entity_ip":"8.8.4.4","entity_type":"dns server"}],"root_cause":"dnsserver_site","status":"open","suggestion":"check_dns_failure","type":"dns_failure"},"fields":["entity_ips"]},{"key":"minis_dns_failure","display":"DNS failure (Marvis-Minis)","group":"marvis","severity":"critical","marvis_suggestion_category":"connectivity","default_enabled":true,"example":{"action_id":"db23301c-2b04-31a6-9d6f-2e8cebd7f524","status":"open","license_requirement":"VNA","org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"","When":1742859053,"type":"MINIS_DNS_FAILURE","suggestion":"check_DNS_Failure","category":"connectivity","details":{"action":"check_DNS_Failure","symptom":"dns_failure","category":"connectivity","status":"open"},"impacted_entities":[{"entity_type":"dns_server","entity_ip":"8.8.8.8"},{"entity_type":"dns_server","entity_ip":"1.1.1.1"},{"entity_type":"dns_server","entity_ip":"10.2.61.254"},{"entity_type":"impacted_vlans","entity_name":"vlan","entity_id":"1"},{"entity_type":"impacted_urls","entity_url":"https://teams.microsoft.com"},{"entity_type":"impacted_urls","entity_url":"https://connectivitycheck.gstatic.com/generate_204"}]},"fields":["entity_urls","entity_ids","entity_ips"]},{"key":"minis_application_reachability_failure","display":"Application Reachability Failure (Marvis-Minis)","group":"marvis","severity":"critical","marvis_suggestion_category":"application","default_enabled":true,"example":{"action_id":"cf8ef3df-a326-38fc-abcb-75694dfa3640","license_requirement":"VNA","status":"open","org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"","When":1745152599,"type":"MINIS_APPLICATION_REACHABILITY_FAILURE","suggestion":"check_url_connectivity","category":"application","details":"{\"action\":\"check_url_connectivity\",\"symptom\":\"reachability_failure\",\"category\":\"application\",\"status\":\"open\"}","impacted_entities":[{"entity_type":"impacted_vlans","entity_name":"vlan","entity_id":"1"},{"entity_type":"impacted_vlans","entity_name":"vlan","entity_id":"2"},{"entity_type":"impacted_urls","entity_url":"https://teams.microsoft.com"},{"entity_type":"impacted_urls","entity_url":"https://connectivitycheck.gstatic.com/generate_204"},{"entity_type":"impacted_urls","entity_url":"https://office.com"},{"entity_type":"impacted_aps","entity_mac":"000000000000"},{"entity_type":"impacted_aps","entity_mac":"000000000001"}]},"fields":["entity_macs","entity_urls","entity_ids"]},{"key":"sw_negotiation_incomplete","display":"Negotiation Incomplete","group":"marvis","severity":"critical","marvis_suggestion_category":"switch","default_enabled":true,"example":{"severity":"critical","timestamp":1629396230,"last_seen":1629396230,"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","org_name":"[MIST CSQA] QA Org [Staging]","site_id":"57b2f891-09c1-4dcc-8ff1-2f9fb3ff7d39","site_name":"jing","category":"switch","count":1,"id":"15c43e5d-9524-40d0-a566-bb3a80ce44f5","action_id":"15c43e5d-9524-40d0-a566-bb3a80ce44f5","details":{"action":"check_interface_config","category":"switch","status":"open","symptom":"negotiation_incomplete"},"impacted_entities":[{"entity_mac":"24fc4e840b7a","entity_name":"sw_f_24p","entity_type":"switch","port_id":"ge-0/0/10"},{"entity_mac":"24fc4e840b7a","entity_name":"sw_f_24p","entity_type":"switch","port_id":"ge-0/0/0"}],"status":"open","suggestion":"check_interface_config","type":"sw_negotiation_incomplete","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"sw_mtu_mismatch","display":"MTU Mismatch","group":"marvis","severity":"critical","marvis_suggestion_category":"switch","default_enabled":true,"example":{"severity":"critical","timestamp":1629396230,"last_seen":1629396230,"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","org_name":"[MIST CSQA] QA Org [Staging]","site_id":"57b2f891-09c1-4dcc-8ff1-2f9fb3ff7d39","site_name":"jing","category":"switch","count":1,"id":"15c43e5d-9524-40d0-a566-bb3a80ce44f5","action_id":"15c43e5d-9524-40d0-a566-bb3a80ce44f5","details":{"action":"check_interface_config","category":"switch","status":"open","symptom":"mtu_mismatch"},"impacted_entities":[{"entity_mac":"24fc4e840b7a","entity_name":"sw_f_24p","entity_type":"switch","port_id":"ge-0/0/10"},{"entity_mac":"24fc4e840b7a","entity_name":"sw_f_24p","entity_type":"switch","port_id":"ge-0/0/0"}],"status":"open","suggestion":"check_interface_config","type":"sw_mtu_mismatch","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"gw_negotiation_mismatch","display":"Negotiation mismatch","group":"marvis","severity":"critical","marvis_suggestion_category":"gateway","default_enabled":true,"example":{"severity":"critical","timestamp":1629396230,"last_seen":1629396230,"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","org_name":"[MIST CSQA] QA Org [Staging]","site_id":"57b2f891-09c1-4dcc-8ff1-2f9fb3ff7d39","site_name":"jing","category":"switch","count":1,"id":"15c43e5d-9524-40d0-a566-bb3a80ce44f5","alert_id":"15c43e5d-9524-40d0-a566-bb3a80ce44f5","details":{"action":"check_interface_config","category":"gateway","status":"open","symptom":"negotiation_mismatch"},"impacted_entities":[{"entity_mac":"24fc4e840b7a","entity_name":"sw_f_24p","entity_type":"gateway","port_id":"ge-0/0/10"},{"entity_mac":"24fc4e840b7a","entity_name":"sw_f_24p","entity_type":"gateway","port_id":"ge-0/0/0"}],"status":"open","suggestion":"check_interface_config","type":"gw_negotiation_mismatch","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"gw_mtu_mismatch","display":"MTU mismatch","group":"marvis","severity":"critical","marvis_suggestion_category":"gateway","default_enabled":true,"example":{"severity":"critical","timestamp":1629396230,"last_seen":1629396230,"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","org_name":"[MIST CSQA] QA Org [Staging]","site_id":"57b2f891-09c1-4dcc-8ff1-2f9fb3ff7d39","site_name":"jing","category":"gateway","count":1,"id":"15c43e5d-9524-40d0-a566-bb3a80ce44f5","alert_id":"15c43e5d-9524-40d0-a566-bb3a80ce44f5","details":{"action":"check_interface_config","category":"gateway","status":"open","symptom":"gw_mtu_mismatch"},"impacted_entities":[{"entity_mac":"24fc4e840b7a","entity_name":"sw_f_24p","entity_type":"gateway","port_id":"ge-0/0/10"},{"entity_mac":"24fc4e840b7a","entity_name":"sw_f_24p","entity_type":"gateway","port_id":"ge-0/0/0"}],"status":"open","suggestion":"check_interface_config","type":"gw_mtu_mismatch","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"ap_offline","display":"Offline (Marvis)","group":"marvis","marvis_suggestion_category":"ap","severity":"critical","default_enabled":true,"example":{"severity":"critical","timestamp":1629821184,"last_seen":1629821184,"resolved_time":1629822184,"license_requirement":"VNA","status":"resolved","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","count":1,"id":"8ae9914e-6108-46fd-999d-8f8a2344d6cb","action_id":"8ae9914e-6108-46fd-999d-8f8a2344d6cb","suggestion":"check_disconnected_ap","details":{"action":"check_disconnected_ap","category":"ap","status":"resolved","symptom":"ap_disconnect"},"impacted_entity_count":1,"impacted_entities":[{"entity_type":"ap","entity_mac":"aa2b3c4d5e6f","entity_name":"EXAMPLE AP","connected_switch_mac":"1a2b3c4d5e6f","connected_switch_name":"EXAMPLE SWITCH","port_id":"ge-1"}],"category":"ap","type":"ap_offline","group":"marvis"},"fields":["port_ids","entity_macs","connected_switch_macs"]},{"key":"ap_offline_isp_site_down","display":"Site Offline (ISP)","group":"marvis","marvis_suggestion_category":"ap","severity":"critical","default_enabled":true,"example":{"severity":"critical","timestamp":1629821184,"last_seen":1629821184,"license_requirement":"VNA","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","count":1,"id":"8ae9914e-6108-46fd-999d-8f8a2344d6cb","action_id":"8ae9914e-6108-46fd-999d-8f8a2344d6cb","suggestion":"check_isp","details":{"action":"check_isp","category":"ap","status":"open","symptom":"ap_disconnect"},"isp_details":{"isp_asn":"AS208905","isp_city":"Ramat Gan","isp_region":"TA","isp_name":"Tamares Telecom Ltd"},"impacted_ap_count":14,"impacted_entities":[{"entity_type":"site","entity_id":"e4ce4dd7-134c-40e1-adcb-e0a8465ea86f","entity_name":"mocked_site_name"}],"category":"ap","type":"ap_offline_isp_site_down","group":"marvis"},"fields":["entity_ids"]},{"key":"non_compliant","display":"Non-compliant","group":"marvis","marvis_suggestion_category":"ap","severity":"critical","default_enabled":true,"example":{"severity":"critical","timestamp":1629755015,"last_seen":1629755015,"status":"open","license_requirement":"VNA","id":"5168b980-640b-43d8-85b8-ecee9eb17647","action_id":"5168b980-640b-43d8-85b8-ecee9eb17647","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","details":{"action":"firmware_upgrade","category":"ap","status":"open","symptom":"non_compliant"},"impacted_entities":[{"entity_type":"ap","entity_mac":"aa2b3c4d5e6f","entity_name":"EXAMPLE AP","connected_switch_mac":"1a2b3c4d5e6f","connected_switch_name":"EXAMPLE SWITCH","entity_version":"0.10.24200","port_id":"40","recommended_version":"0.6.19032"},{"entity_type":"ap","entity_mac":"bb2b3c4d5e6f","entity_name":"EXAMPLE AP 2","connected_switch_mac":"112b3c4d5e6f","connected_switch_name":"EXAMPLE SWITCH 2","entity_version":"0.6.19032","port_id":"24","recommended_version":"0.10.24200"}],"suggestion":"firmware_upgrade","category":"ap","count":1,"type":"non_compliant","group":"marvis"},"fields":["port_ids","entity_macs","connected_switch_macs"]},{"key":"ap_bad_cable","display":"Bad cable","group":"marvis","severity":"critical","marvis_suggestion_category":"ap","default_enabled":true,"example":{"severity":"critical","timestamp":1631853846,"last_seen":1631853846,"license_requirement":"VNA","status":"open","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","count":1,"id":"5168b980-640b-43d8-85b8-ecee9eb17647","action_id":"5168b980-640b-43d8-85b8-ecee9eb17647","suggestion":"test_replace_cable","category":"layer_1","details":{"action":"test_replace_cable","category":"layer_1","status":"open","symptom":"bad_cable"},"impacted_entities":[{"entity_type":"ap","entity_mac":"aa2b3c4d5e6f","entity_name":"EXAMPLE AP","connected_switch_mac":"1a2b3c4d5e6f","connected_switch_name":"EXAMPLE SWITCH","port_id":"517"}],"type":"ap_bad_cable","group":"marvis"},"fields":["port_ids","entity_macs","connected_switch_macs"]},{"key":"ap_loop_by_switch_port_flap","display":"AP Loop due to Switch Port Flap","group":"marvis","severity":"warn","marvis_suggestion_category":"ap","default_enabled":true,"example":{"severity":"warn","timestamp":1631853846,"last_seen":1631853846,"org_id":"1688605f-916a-47a1-8c68-f19618300a08","org_name":"[MIST CSQA] Mist Office","site_id":"ec3b5624-73f1-4ed3-b3fd-5ba3ee40368a","site_name":"Wired Assurance","count":1,"category":"switch","id":"8f3ad435-5e0d-4178-a4e9-a7bf887b916b","alert_id":"8f3ad435-5e0d-4178-a4e9-a7bf887b916b","status":"open","details":{"action":"check_port","category":"switch","status":"open","symptom":"ap_loop"},"impacted_aps":[{"ap_id":"d4dc09a03240","port_id":"ge-0/0/1","switch_id":"us-sfo1-as1-1-2.tome.app","switch_name":"us-sfo1-as1-1-2.tome.app","ap_name":"new_ap"}],"impacted_entities":[{"entity_type":"switch","entity_mac":"4c710c00c500","entity_name":"mocked_switch_name","port_id":"ge/0/0/0"},{"entity_type":"switch","entity_mac":"mocked_core_device_mac","entity_name":"mocked_switch_name","port_id":"ge/0/0/1"}],"type":"ap_loop_by_switch_port_flap","group":"marvis"},"fields":["port_ids","entity_macs","entity_names","impacted_aps"]},{"key":"ap_loop_by_duplicate_wlan_paths","display":"AP Loop due to duplicated WLAN paths","group":"marvis","severity":"warn","marvis_suggestion_category":"ap","default_enabled":true,"example":{"severity":"warn","timestamp":1631853846,"last_seen":1631853846,"org_id":"1688605f-916a-47a1-8c68-f19618300a08","org_name":"[MIST CSQA] Mist Office","site_id":"ec3b5624-73f1-4ed3-b3fd-5ba3ee40368a","site_name":"Wired Assurance","count":1,"category":"ap","id":"8f3ad435-5e0d-4178-a4e9-a7bf887b916b","alert_id":"8f3ad435-5e0d-4178-a4e9-a7bf887b916b","status":"open","details":{"action":"check_wlan_forwarding","category":"ap","status":"open","symptom":"ap_loop"},"impacted_aps":[{"ap_id":"5c5b353e0dc5","port_id":"ge-0/0/6","switch_id":"KR-Site-02-EX2300","switch_name":"KR-Site-02-EX2300","ap_name":"5c:5b:35:3e:0d:c5"}],"impacted_entities":[{"problematic_vlan_id":"30","wlan_id":"ffe6640d-dfa4-4992-9f7a-ef2b66bdd4a6","forwarding":["local"],"ssid":"Test-vlan-30","vlan_id":[30]},{"problematic_vlan_id":"30","wlan_id":"33a925f6-43d2-415c-8882-0c4f0ff21195","forwarding":["mxtunnel"],"ssid":"Test-T1-Vlan-30","vlan_id":[30]},{"problematic_vlan_id":"30","wlan_id":"e7faef07-946e-41c8-97db-9c2c11319e21","forwarding":["mxtunnel"],"ssid":"Test-T2-Vlan-30","vlan_id":[30]}],"type":"ap_loop_by_duplicated_wlan_paths","group":"marvis"},"fields":["impacted_aps","impacted_switch_macs","ssids","problematic_vlan_ids"]},{"key":"ap_loop_by_duplicate_tunnels","display":"AP Loop due to duplicate Tunnels paths","group":"marvis","severity":"warn","marvis_suggestion_category":"ap","default_enabled":true,"example":{"severity":"warn","timestamp":1631853846,"last_seen":1631853846,"org_id":"1688605f-916a-47a1-8c68-f19618300a08","org_name":"[MIST CSQA] Mist Office","site_id":"ec3b5624-73f1-4ed3-b3fd-5ba3ee40368a","site_name":"Wired Assurance","count":1,"category":"ap","id":"8f3ad435-5e0d-4178-a4e9-a7bf887b916b","alert_id":"8f3ad435-5e0d-4178-a4e9-a7bf887b916b","status":"open","details":{"action":"check_wlan_forwarding","category":"ap","status":"open","symptom":"ap_loop"},"impacted_aps":[{"ap_id":"5c5b353e0dc5","port_id":"ge-0/0/6","switch_id":"KR-Site-02-EX2300","switch_name":"KR-Site-02-EX2300","ap_name":"5c:5b:35:3e:0d:c5"}],"impacted_entities":[{"tunnel_id":"c383f972-8b1d-4deb-ae3d-2eaa1a03d759","peer":"192.168.10.253","vlan_id":"30"},{"tunnel_id":"fd58ba9e-1f1e-4cd3-9190-9dbe934ff966","peer":"192.168.10.253","vlan_id":"30"}],"type":"ap_loop_by_duplicate_tunnels","group":"marvis"},"fields":["impacted_aps","tunnel_ids","vlan_ids","peers"]},{"key":"ssid_injection","display":"SSID Injection detected","group":"security","severity":"warn","default_enabled":false,"example":{"severity":"warn","ssids":["Rive%dell"],"timestamp":1628121407,"last_seen":1628121407,"aps":["d420b00146cc"],"hostnames":["AP_NAME"],"org_id":"9c3e516c-397d-11e6-ae35-0242ac110008","site_id":"27ea2f07-6fe6-4eab-be1b-b8e3ce083d67","count":1,"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","type":"ssid_injection","group":"security"},"fields":["aps","ssids","hostnames"]},{"key":"url_blocked","display":"URL blocked","group":"security","severity":"warn","default_enabled":false,"example":{"When":1652729904,"last_seen":1652729904,"type":"url_blocked","group":"security","severity":"warn","org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","site_id":"9f5e5761-420a-4680-87c9-d9f876363bcc","id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","count":2,"gateways":["001122334455"],"domains":["abc.com","xyz.com"],"urls":["http://abc.com/x/y/z","http://xyz.com/a/b/c"],"applications":["app-abc","app-xyz"],"categories":["cat-abc","cat-xyz"],"sub_categories":["subcat-abc","subcat-xyz"],"client_ips":["1.2.3.4","5.6.7.8"]},"fields":["categories","sub_categories","applications","urls","client_ips","domains"]},{"key":"idp_attack_detected","display":"IDP attack detected","group":"security","severity":"warn","default_enabled":false,"example":{"When":1652729904,"last_seen":1652729904,"type":"idp_attack_detected","group":"security","severity":"warn","org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","site_id":"9f5e5761-420a-4680-87c9-d9f876363bcc","id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","count":1,"gateways":["001122334455"],"attacks":["attack-xyz"],"cve_ids":["CVE-2022-0102"],"ingress_ports":["eth0"],"attacker_ips":["192.168.1.2"],"protocols":["tcp"],"application":["app-xyz"]},"fields":["attacker_ips","protocols","cve_ids","ingress_ports","applications","attacks"]},{"key":"health_check_failed","display":"AP health check failed","group":"marvis","marvis_suggestion_category":"ap","severity":"critical","default_enabled":true,"example":{"severity":"critical","timestamp":1629755015,"last_seen":1629755015,"license_requirement":"VNA","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","count":1,"id":"8ae9914e-6108-46fd-999d-8f8a2344d6cb","action_id":"8ae9914e-6108-46fd-999d-8f8a2344d6cb","suggestion":"firmware_upgrade","details":{"action":"firmware_upgrade","category":"ap","status":"open","symptom":"health_check"},"impacted_entity_count":1,"impacted_entities":[{"entity_type":"ap","entity_mac":"aa2b3c4d5e6f","entity_name":"EXAMPLE AP"}],"category":"ap","type":"health_check_failed","group":"marvis"},"fields":["entity_macs"]},{"key":"vc_master_changed","display":"Virtual Chassis - New device elected for Active Role","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","reasons":["CHASSISD_VCHASSIS_MEMBER_UPDATE_NOTICE: Membership update: Member 1->1, Mode Backup->Master, 1M -1B, Master Detected, Members Changed"],"timestamp":1629911533,"last_seen":1629911533,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":1,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"149c5c99-d3ab-46db-bc4f-4431377d1b20","type":"vc_master_changed","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"vc_backup_failed","display":"Virtual Chassis - Backup Member Elected","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","reasons":["CHASSISD_VCHASSIS_MEMBER_UPDATE_NOTICE: Membership update: Member 1->1, Mode Master->Master, 1M 0B, Master Unchanged, Members Changed"],"timestamp":1629911533,"last_seen":1629911533,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":1,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"149c5c99-d3ab-46db-bc4f-4431377d1b20","type":"vc_backup_failed","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"vc_member_added","display":"Virtual Chassis Member Added","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["CHASSISD_VCHASSIS_MEMBER_OP_NOTICE: Member change: vc add of member 2"],"timestamp":1628697343,"last_seen":1628697389,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":2,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"f718c381-05eb-4399-8c01-a3e0b3e6b50b","type":"vc_member_added","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"vc_member_deleted","display":"Virtual Chassis Member Deleted","group":"infrastructure","severity":"critical","default_enabled":true,"example":{"severity":"critical","reasons":["CHASSISD_VCHASSIS_MEMBER_OP_NOTICE: Member change: vc delete of member 2"],"timestamp":1628697377,"last_seen":1628697424,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":2,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"4b019796-46b9-4c70-b943-0665676669f8","type":"vc_member_deleted","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"vc_member_restarted","display":"Virtual Chassis Member Restarted","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["vc restart of member 1"],"timestamp":1628697377,"last_seen":1628697424,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":2,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"4b019796-46b9-4c70-b943-0665676669f8","type":"vc_member_restarted","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_poe","display":"Switch PoE Alarm","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["PoE voltage injection in Interface ge-1/0/6"],"last_seen":1630475624,"switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":1,"type":"sw_alarm_chassis_poe","timestamp":1630475624,"unacked_time":1631011042.68707,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"0bb3e001-2f98-4c51-aecd-d45d870a7c58","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_poe_clear","display":"Switch PoE Alarm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["Alarm cleared: (SW_ALARM_CHASSIS_POE) PoE voltage injection in Interface ge-1/0/6"],"last_seen":1630475624,"switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":1,"type":"sw_alarm_chassis_poe_clear","timestamp":1630475624,"unacked_time":1631011042.68707,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"0bb3e001-2f98-4c51-aecd-d45d870a7c58","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_poe_controller_fail","display":"Switch POE Controller Device Failure","group":"infrastructure","severity":"critical","default_enabled":true,"example":{"severity":"critical","reasons":["POE controller 1 status is DEVICE FAIL"],"last_seen":1630475624,"switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":1,"type":"sw_alarm_poe_controller_fail","timestamp":1630475624,"unacked_time":1631011042.68707,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"0bb3e001-2f98-4c51-aecd-d45d870a7c58","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_pem","display":"Switch PEM Alarm","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["FPC 1 PEM 1 is not powered"],"timestamp":1628186625,"last_seen":1628186625,"org_id":"41f579e0-5a00-4164-92f3-662b53ae8c66","switches":["4c6d58fb8640"],"hostnames":["SW_NAME"],"count":1,"site_id":"c475d117-b152-445d-8117-2248046f58f7","id":"0537c687-6f85-4ba3-8be6-0f3302e7e74a","type":"sw_alarm_chassis_pem","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_pem_clear","display":"Switch PEM Alarm CLEAR","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["Alarm cleared: (SW_ALARM_CHASSIS_PEM) FPC 1 PEM 1 is not powered"],"timestamp":1628186625,"last_seen":1628186625,"org_id":"41f579e0-5a00-4164-92f3-662b53ae8c66","switches":["4c6d58fb8640"],"hostnames":["SW_NAME"],"count":1,"site_id":"c475d117-b152-445d-8117-2248046f58f7","id":"0537c687-6f85-4ba3-8be6-0f3302e7e74a","type":"sw_alarm_chassis_pem_clear","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_psu","display":"Switch Power Supply Alarm","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","reasons":["FPC 0 PSU Sensor too Warm"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["e8a2453e5a77"],"hostnames":["SW_NAME"],"count":1,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"6ee3267b-122c-4b07-85ad-94174ec3974e","type":"sw_alarm_chassis_psu","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_psu_clear","display":"Switch Power Supply Alarm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["Alarm cleared: (SW_ALARM_CHASSIS_PSU) FPC 0 PSU Sensor too Warm"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["e8a2453e5a77"],"hostnames":["SW_NAME"],"count":1,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"6ee3267b-122c-4b07-85ad-94174ec3974e","type":"sw_alarm_chassis_psu_clear","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_fan","display":"Switch Fan Alarm","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"warn","reasons":["Side Fan Tray 7 Failure"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["e8a2453e5a77"],"hostnames":["SW_NAME"],"count":1,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"6ee3267b-122c-4b07-85ad-94174ec3974e","type":"sw_alarm_chassis_fan","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_fan_clear","display":"Switch Fan Alarm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["Alarm cleared: (SW_ALARM_CHASSIS_FAN) Side Fan Tray 7 Failure"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["e8a2453e5a77"],"hostnames":["SW_NAME"],"count":1,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"6ee3267b-122c-4b07-85ad-94174ec3974e","type":"sw_alarm_chassis_fan_clear","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_hot","display":"Switch High Temperature","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["FPC 0 Thermal board Sensor 3 too Hot"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","switches":["c81337b55d00"],"hostnames":["SVL_NUC_CORE"],"count":1,"site_id":"64aa3a71-92cd-4e83-9ab1-d8f9680f4977","id":"6ee3267b-122c-4b07-85ad-94174ec3974e","type":"sw_alarm_chassis_hot","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_hot_clear","display":"Switch High Temperature Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["Alarm cleared: (SW_ALARM_CHASSIS_HOT) FPC 0 Thermal board Sensor 3 too Hot"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","switches":["c81337b55d00"],"hostnames":["SVL_NUC_CORE"],"count":1,"site_id":"64aa3a71-92cd-4e83-9ab1-d8f9680f4977","id":"6ee3267b-122c-4b07-85ad-94174ec3974e","type":"sw_alarm_chassis_hot_clear","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"gw_alarm_chassis_hot","display":"WAN Edge Chassis Hot","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","gateways":["4c9614625500"],"reasons":["Host 0 Temperature Hot"],"hostnames":["IXE"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"99ad81cc-850f-4b5e-b3b9-eab8ea6a9482","count":1,"site_id":"234865ee-775c-4898-896a-afd78eafbcc6","id":"6ee3787b-122c-3b07-85ad-94122ec3974e","type":"gw_alarm_chassis_hot","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"sw_ip_conflict","display":"Switch IP conflict detected","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","reasons":["KERN_ARP_DUPLICATE_ADDR: duplicate IP address 56.56.56.111! sent from address: d8:53:9a:65:55:c0 (error count = 1982)"],"first_seen":1729584321.693986,"timestamp":1729584326.836789,"switches":["c81337b55d00"],"org_id":"99ad81cc-850f-4b5e-b3b9-eab8ea6a9482","count":5,"site_id":"234865ee-775c-4898-896a-afd78eafbcc6","id":"6ee3787b-122c-3b07-85ad-94122ec3974e","type":"sw_ip_conflict","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_mac_limit_exceeded","display":"Switch MAC Limit Exceeded","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","reasons":["L2ALD_MAC_LIMIT_EXCEEDED_IF: Limit on learned MAC addresses exceeded for ge-0/0/2.0; current count is 2 DROPPING THE PACKET with mac address: 5c:5b:35:c6:1c:02"],"first_seen":1729584321.693986,"timestamp":1729584326.836789,"switches":["c81337b55d00"],"port_id":"ge-0/0/2.0","org_id":"99ad81cc-850f-4b5e-b3b9-eab8ea6a9482","site_id":"234865ee-775c-4898-896a-afd78eafbcc6","id":"6ee3787b-122c-3b07-85ad-94122ec3974e","type":"sw_mac_limit_exceeded","group":"infrastructure"},"fields":["switches","reasons"]},{"key":"gw_alarm_chassis_hot_clear","display":"WAN Edge Chassis Hot Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["4c9614625500"],"reasons":["Alarm cleared: (GW_ALARM_CHASSIS_HOT) Host 0 Temperature Hot"],"hostnames":["IXE"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"99ad81cc-850f-4b5e-b3b9-eab8ea6a9482","count":1,"site_id":"234865ee-775c-4898-896a-afd78eafbcc6","id":"6ee3787b-122c-3b07-85ad-94122ec3974e","type":"gw_alarm_chassis_hot_clear","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_warm","display":"WAN Edge Chassis Warm","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["4c9614625500"],"reasons":["Host 0 Temperature Warm"],"hostnames":["IXE"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"99ad81cc-850f-4b5e-b3b9-eab8ea6a9482","count":1,"site_id":"234865ee-775c-4898-896a-afd78eafbcc6","id":"6ee3787b-122c-3b07-85ad-94122ec3974e","type":"gw_alarm_chassis_warm","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_warm_clear","display":"WAN Edge Chassis Warm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["4c9614625500"],"reasons":["Alarm cleared: (GW_ALARM_CHASSIS_WARM) Host 0 Temperature Warm"],"hostnames":["IXE"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"99ad81cc-850f-4b5e-b3b9-eab8ea6a9482","count":1,"site_id":"234865ee-775c-4898-896a-afd78eafbcc6","id":"6ee3787b-122c-3b07-85ad-94122ec3974e","type":"gw_alarm_chassis_warm_clear","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"sw_alarm_chassis_partition","display":"Switch Storage Partition Alarm","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["RE 0 /var partition usage is high","FPC 1 /var partition usage is high"],"timestamp":1629909702,"last_seen":1629909338,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":2,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"767451b1-e172-42ef-b370-7219ae1a8623","type":"sw_alarm_chassis_partition","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_partition_clear","display":"Switch Storage Partition Alarm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["Alarm cleared: (SW_ALARM_CHASSIS_PARTITION) RE 0 /var partition usage is high"],"timestamp":1629909702,"last_seen":1629909338,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","switches":["f4bfa806c96c"],"hostnames":["SW_NAME"],"count":2,"site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","id":"767451b1-e172-42ef-b370-7219ae1a8623","type":"sw_alarm_chassis_partition_clear","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_cpu_board_sensor_failed","display":"Switch CPU Board Sensor","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["FPC 0 CPU Board Sensor Left Failed"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"98272e44-d31d-4e9a-b52d-18ae2183446e","switches":["aca09d90f880"],"hostnames":["SW_NAME"],"count":1,"site_id":"872b7b80-aa81-4a8d-90d6-a5763bb86348","id":"6ee3267b-122c-4b07-85ad-94174ec3975e","type":"sw_alarm_chassis_cpu_board_sensor_failed","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_cpu_board_sensor_failed_clear","display":"Switch CPU Board Sensor Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["Alarm cleared: (SW_ALARM_CHASSIS_CPU_BOARD_SENSOR_FAILED) FPC 0 CPU Board Sensor Left Failed"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"98272e44-d31d-4e9a-b52d-18ae2183446e","switches":["aca09d90f880"],"hostnames":["SW_NAME"],"count":1,"site_id":"872b7b80-aa81-4a8d-90d6-a5763bb86348","id":"6ee3267b-122c-4b07-85ad-94174ec3975e","type":"sw_alarm_chassis_cpu_board_sensor_failed_clear","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_humidity","display":"Switch High Humidity","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["FPC 0 Humidity Sensor 1 high humidity alert, triggered at 100 RH"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"98272e44-d31d-4e9a-b52d-18ae2183446e","switches":["aca09d90f880"],"hostnames":["SW_NAME"],"count":1,"site_id":"872b7b80-aa81-4a8d-90d6-a5763bb86348","id":"6ee3267b-122c-4b07-85ad-94174ec3975e","type":"sw_alarm_chassis_humidity","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_alarm_chassis_humidity_clear","display":"Switch High Humidity Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","reasons":["Alarm cleared: (SW_ALARM_CHASSIS_HUMIDITY) FPC 0 Humidity Sensor 1 high humidity alert, triggered at 100 RH"],"timestamp":1628869549,"last_seen":1628869549,"org_id":"98272e44-d31d-4e9a-b52d-18ae2183446e","switches":["aca09d90f880"],"hostnames":["SW_NAME"],"count":1,"site_id":"872b7b80-aa81-4a8d-90d6-a5763bb86348","id":"6ee3267b-122c-4b07-85ad-94174ec3975e","type":"sw_alarm_chassis_humidity_clear","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_dhcp_pool_exhausted","display":"Switch DHCP Pool Exhausted","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","reasons":["DHCP Pool vlan_215 is exhausted"],"timestamp":1630682731,"last_seen":1630682731,"org_id":"9a1cd5a1-fab8-4cae-a852-97f2f292af93","switches":["182ad34a63b2"],"hostnames":["SW_NAME"],"count":1,"site_id":"ba99c1aa-39ac-4664-b6cb-68e0e8627ce4","id":"8e3caa90-9478-4972-aa8a-110c5c3139be","type":"sw_dhcp_pool_exhausted","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"gw_dhcp_pool_exhausted","display":"WAN Edge DHCP Pool Exhausted","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","gateways":["020001bcb18d"],"reasons":["@@@@@@DHCP"],"hostnames":["AP_NAME"],"timestamp":1628904286,"last_seen":1628904286,"org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","count":1,"site_id":"ed999514-a0a5-4218-ab75-468113645c86","id":"ad7fc567-2894-42fd-9131-662ab43680c4","type":"gw_dhcp_pool_exhausted","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"sw_rogue_dhcp_server_detected","display":"Rogue DHCP Server Detected","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["AS_PKT_DHCP_DROPPED: DHCP Packet Drop: Packet src ip/mac 90.90.90.1/5c:45:27:de:81:63, dst ip/mac 255.255.255.255/ff:ff:ff:ff:ff:ff, udp_src_port 67, udp_dst_port 68, interface ge-0/0/9.0 [index 583], vlan-id 90, option82: No"],"timestamp":1630682731,"first_seen":1630682731,"org_id":"174260d5-cb22-4ea8-badb-c77a89acb0a9","switches":["544b8c167179"],"models":["EX2300-48MP"],"site_id":"f46b3193-b242-456e-b203-5224adb52c62","port_id":"ge-0/0/9.0","id":"8e3caa90-9478-4972-aa8a-110c5c3158ad","type":"sw_rogue_dhcp_server_detected","group":"infrastructure"},"fields":["switches","reasons","models"]},{"key":"gw_src_nat_pool_threshold_exceeded","display":"WAN Edge Source NAT Pool Threshold Exceeded","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","gateways":["020001bcb18d"],"reasons":["Source NAT Pool p1 Resource Usage Exceeded Threshold. Current Usage: 100%, Threshold: 100%."],"hostnames":["4c9614136200"],"timestamp":1628904286,"last_seen":1628904286,"org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","count":1,"site_id":"ed999514-a0a5-4218-ab75-468113645c86","id":"ad7fc567-2894-42fd-9131-662ab43680c4","type":"gw_src_nat_pool_threshold_exceeded","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"sw_evpn_duplicate_mac","display":"EVPN detected a duplicate MAC address","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","reasons":["EVPN_DUPLICATE_MAC: Duplicate MAC address default-switch::10308::c0:3c:59:2f:30:2d detected"],"last_seen":1705453221,"switches":["b0eb7f1ca620"],"hostnames":["SW_NAME"],"count":1,"type":"evpn_duplicate_mac","timestamp":1705453221,"org_id":"a6bff957-8f84-41fb-92b4-776dcba3b736","site_id":"4eab30e2-3897-41fe-a6ee-e096199285a0","id":"709a5568-8213-4fbc-bc91-52464f4e028d","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_bgp_neighbor_state_changed","display":"BGP Neighbor State Changed","group":"infrastructure","severity":"info","default_enabled":true,"example":{"severity":"warn","last_seen":1632422441,"switches":["8403280eacde"],"hostnames":["SW_NAME"],"count":2,"type":"sw_bgp_neighbor_state_changed","timestamp":1632421901,"port_ids":["xe-0/2/0"],"org_id":"7321309e-a3d4-44fd-96e8-ee4f6a94d20e","site_id":"71caad65-d0c2-48f0-81cd-dec0c71efe18","id":"cb39a587-312e-4993-ab28-6eb6f70aa27e","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_bad_optics","display":"Switch Bad Optics","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","reasons":["xe-0/2/0: RX power of optical interface is low (-10.58 dBm)","xe-0/2/0: LaserBiasCurrent of optical interface is low (4.5 mA) < (5.0 mA)"],"last_seen":1632422441,"switches":["8403280eacde"],"hostnames":["SW_NAME"],"count":2,"type":"sw_bad_optics","timestamp":1632421901,"port_ids":["xe-0/2/0"],"org_id":"7321309e-a3d4-44fd-96e8-ee4f6a94d20e","site_id":"71caad65-d0c2-48f0-81cd-dec0c71efe18","id":"cb39a587-312e-4993-ab28-6eb6f70aa27e","group":"infrastructure"},"fields":["port_ids","switches","reasons","hostnames"]},{"key":"sw_bpdu_error","display":"Switch BPDU Error","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","reasons":["L2CPD_RECEIVE_BPDU_BLOCK_ENABLED: BPDU_PROTECT: Interface ge-0/0/8 is DOWN: BPDU error detected"],"timestamp":1632336187,"last_seen":1632336187,"port_ids":["ge-0/0/8"],"org_id":"769e964c-127d-49ad-b3ed-5665d274a3da","switches":["fc9643bf6873"],"hostnames":["SW_NAME"],"count":1,"site_id":"3306cd0a-8352-43bc-97f0-801ceb80d5d9","id":"0d111c63-6afe-46dd-bb39-07bf39c0fbaf","type":"sw_bpdu_error","group":"infrastructure"},"fields":["port_ids","switches","reasons","hostnames"]},{"key":"bad_wan_uplink","display":"Bad WAN Uplink","group":"marvis","severity":"critical","marvis_suggestion_category":"gateway","default_enabled":true,"example":{"severity":"critical","timestamp":1629760130,"last_seen":1629760130,"category":"gateway","org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"[MIST CSQA] QA Org [Staging]","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"vk-we-spoke","count":1,"id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","alert_id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","details":{"action":"check_wan_link","category":"gateway","status":"open","symptom":"intermittent_wan_connectivity"},"impacted_entities":[{"entity_mac":"02000187f553","entity_name":"spoke_we_vk","entity_type":"gateway","entity_version":"6.0.0-14","port_id":"ge-0-0-2","recommended_version":""}],"root_cause":"poor_lte_signal","impacted_entity_count":1,"status":"open","suggestion":"CHECK_WAN_LINK","type":"intermittent_wan_connectivity","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"intermittent_wan_connectivity","display":"Intermittent WAN Connectivity","group":"marvis","severity":"critical","marvis_suggestion_category":"gateway","example":{"severity":"critical","timestamp":1629760130,"last_seen":1629760130,"category":"gateway","org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"[MIST CSQA] QA Org [Staging]","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"vk-we-spoke","count":1,"id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","alert_id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","details":{"action":"check_wan_link","category":"gateway","status":"open","symptom":"bad_wan_link"},"impacted_entities":[{"entity_mac":"02000187f553","entity_name":"spoke_we_vk","entity_type":"gateway","entity_version":"6.0.0-14","port_id":"ge-0-0-2","recommended_version":""}],"root_cause":"isp_dhcp_failure","impacted_entity_count":1,"status":"open","suggestion":"CHECK_WAN_LINK","type":"bad_wan_uplink","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"vpn_path_down","display":"VPN Path Down","group":"marvis","severity":"critical","marvis_suggestion_category":"gateway","default_enabled":true,"example":{"severity":"critical","timestamp":1629760130,"last_seen":1629760130,"count":1,"action_id":"aae12c7c-7634-3fc5-a91c-91b75ff0b227","id":"aae12c7c-7634-3fc5-a91c-91b75ff0b227","license_requirement":"VNA","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","suggestion":"check_vpn_path","category":"gateway","details":"{\"action\": \"check_vpn_path\", \"symptom\": \"vpn_path_down\", \"category\": \"gateway\", \"status\": \"open\"}","impacted_entities":[{"entity_type":"gateway","entity_mac":"bb2b3c4d5e6f","entity_name":"SPOKE GATEWAY","entity_version":"5.2.1-0.202105271544.release","port_id":"west_inet2","hub_site_id":"ddddeeff-0000-1111-aaaa-123456abcdef","hub_site_name":"EXAMPLE SITE 1","hub_gateway_mac":"cc2b3c4d5e6f","hub_gateway_name":"HUB GATEWAY","hub_port_id":"port-1"}],"root_cause":"vpn_path_flip_flopping","email_content":{"status":"open","impacted_tuple":[{"gateway_id":"bb2b3c4d5e6f","port_id":"west_inet2"},{"gateway_id":"bb2b3c4d5e6f","port_id":"west_inet2"}]},"status":"open","type":"VPN_PATH_DOWN","group":"marvis"},"fields":["port_ids","entity_macs"]},{"key":"switch_stp_loop","display":"Switch STP Loop","group":"marvis","severity":"critical","marvis_suggestion_category":"switch","default_enabled":true,"example":{"severity":"critical","timestamp":1629396230,"last_seen":1629396230,"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"57b2f891-09c1-4dcc-8ff1-2f9fb3ff7d39","count":1,"id":"15c43e5d-9524-40d0-a566-bb3a80ce44f5","type":"switch_stp_loop","group":"marvis"},"fields":["entity_macs"]},{"key":"insufficient_coverage","display":"AP insufficient coverage","group":"marvis","marvis_suggestion_category":"ap","severity":"critical","default_enabled":true,"example":{"severity":"critical","category":"ap","timestamp":1629755015,"last_seen":1629755015,"org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"unknown org","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"Mist-office","status":"open","suggestion":"check_coverage","count":1,"id":"5168b980-640b-43d8-85b8-ecee9eb17647","alert_id":"5168b980-640b-43d8-85b8-ecee9eb17647","details":{"action":"check_coverage","category":"ap","status":"open","symptom":"insufficient_coverage"},"impacted_entities":[{"entity_mac":"ac2316fc00c3","entity_type":"ap"}],"type":"insufficient_coverage","group":"marvis"},"fields":["entity_macs","bands"]},{"key":"insufficient_capacity","display":"AP insufficient capacity","group":"marvis","marvis_suggestion_category":"ap","severity":"critical","default_enabled":true,"example":{"severity":"critical","timestamp":1629755015,"last_seen":1629755015,"category":"ap","org_id":"9747a50a-23f8-4ca5-83c4-102e807874de","org_name":"unknown org","site_id":"8d2e354a-8340-4432-ac1b-e3c3bab680ab","site_name":"Mist-office","status":"open","suggestion":"check_capacity","count":1,"id":"5168b980-640b-43d8-85b8-ecee9eb17647","alert_id":"5168b980-640b-43d8-85b8-ecee9eb17647","details":{"action":"check_capacity","category":"ap","status":"open","symptom":"insufficient_capacity"},"impacted_entities":[{"band":24,"entity_mac":"ac2316fc00c3","entity_type":"ap"}],"type":"insufficient_capacity","group":"marvis"},"fields":["entity_macs","bands"]},{"key":"sw_critical_port_up","display":"Critical Switch Port Up","group":"infrastructure","severity":"info","default_enabled":true,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","switches":["f4bfa806c96c"],"reasons":["ifIndex 534, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-0/0/18"],"count":2,"hostnames":["switch_vc"],"id":"badb2358-53c3-413d-adba-c45436a3296f","type":"sw_port_up","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_critical_port_down","display":"Critical Switch Port Down","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","switches":["f4bfa806c96c"],"reasons":["ifIndex 564, ifAdminStatus up(1), ifOperStatus down(2), ifName ae0"],"count":2,"hostnames":["switch_vc"],"id":"badb2358-53c3-413d-adba-c45436a3396f","type":"sw_port_down","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_port_storm_control","display":"Storm Control in Effect on Switch port","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","timestamp":1575922629,"last_seen":1575922624,"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"f688779c-e335-4f88-8d7c-9c5e9964528b","switches":["1c9c8cba2e7f"],"models":["EX2300-C-12P"],"reasons":["L2ALD_ST_CTL_IN_EFFECT: ge-0/0/1.0: storm control in effect on the port"],"port_id":"ge-0/0/1","id":"badb2358-53c3-413d-adba-c45436a33400","type":"sw_port_storm_control","group":"infrastructure"},"fields":["switches","reasons","models"]},{"key":"gw_critical_port_up","display":"Critical WAN Edge Port Up","group":"infrastructure","severity":"info","default_enabled":true,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","gateways":["f4bfa806c96c"],"reasons":["ifIndex 534, ifAdminStatus up(1), ifOperStatus up(1), ifName ge-0/0/18"],"count":2,"hostnames":["gateway_1"],"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"gw_port_up","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_critical_port_down","display":"Critical WAN Edge Port Down","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","gateways":["f4bfa806c96c"],"reasons":["ifIndex 564, ifAdminStatus up(1), ifOperStatus down(2), ifName ae0"],"count":2,"hostnames":["gateway_1"],"id":"badb2358-53c3-413d-adba-c45436a3596f","type":"gw_port_down","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"sw_vc_port_down","display":"Virtual Chassis Port Down","group":"infrastructure","severity":"critical","default_enabled":true,"example":{"severity":"critical","timestamp":1629918879,"last_seen":1629918873,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","gateways":["f4bfa806c96c"],"reasons":["Lost adjacency to 74e7.98ca.8a6c on vcp-255/1/0.32768, reason: Interface down"],"count":2,"hostnames":["switch_1"],"id":"badb2358-53c3-413d-adba-c45436a35970","type":"sw_vc_port_down","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_vc_port_up","display":"Virtual Chassis Port Up","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918879,"last_seen":1629918873,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","switches":["f4bfa806c96c"],"reasons":["New adjacency to 544b.8c1b.3e6b on vcp-0/1/0.32768"],"count":2,"hostnames":["switch_1"],"id":"badb2358-53c3-413d-adba-c45436a35970","type":"sw_vc_port_up","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_bgp_neighbor_down","display":"BGP Neighbor Down","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","switches":["80db17b58780"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"931abf56-31a1-4850-a1e7-5aa2e1a08782","count":609,"site_id":"59a29961-7591-4a3f-bee3-6e2092ffff4b","id":"bdbee805-4d69-466f-93a1-74ad09c4e53f","reasons":["BGP peer 10.255.240.14 (External AS 104) changed state from Established to Idle (event BfdDown) (instance master)"],"hostnames":["Core-1"],"type":"sw_bgp_neighbor_down","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_bgp_neighbor_up","display":"BGP Neighbor Up","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","switches":["80db17b58780"],"timestamp":1629755232,"last_seen":1629755840,"org_id":"931abf56-31a1-4850-a1e7-5aa2e1a08782","count":609,"site_id":"59a29961-7591-4a3f-bee3-6e2092ffff4b","id":"bdbee805-4d69-466f-93a1-74ad09c4e53g","reasons":["BGP peer 10.255.240.14 (External AS 104) changed state from OpenConfirm to Established (event RecvKeepAlive) (instance master)"],"hostnames":["Core-1"],"type":"sw_bgp_neighbor_up","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"cellular_edge_connected_to_ncm","display":"Cellular Edge Connected to NCM","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_CONNECTED_TO_NCM","group":"infrastructure"},"fields":["cellular_edges","vendors","models"]},{"key":"cellular_edge_disconnected_from_ncm","display":"Cellular Edge Disconnected from NCM","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"reasons":["Reasons for disconnecting from NCM: xyz"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_DISCONNECTED_FROM_NCM","group":"infrastructure"},"fields":["cellular_edges","reasons","vendors","models"]},{"key":"cellular_edge_ethernet_wan_connected","display":"Cellular Edge WAN Ethernet Connected","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_ETHERNET_WAN_CONNECTED","group":"infrastructure"},"fields":["cellular_edges","vendors","models"]},{"key":"cellular_edge_ethernet_wan_disconnected","display":"Cellular Edge WAN Ethernet Disconnected","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"reasons":["Reasons for ethernet WAN device no longer being active: xyz"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_ETHERNET_WAN_DISCONNECTED","group":"infrastructure"},"fields":["cellular_edges","reasons","vendors","models"]},{"key":"cellular_edge_ethernet_wan_plugged","display":"Cellular Edge WAN Ethernet Plugged","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_ETHERNET_WAN_PLUGGED","group":"infrastructure"},"fields":["cellular_edges","vendors","models"]},{"key":"cellular_edge_ethernet_wan_unplugged","display":"Cellular Edge WAN Ethernet Unplugged","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"reasons":["Reasons for ethernet WAN device being removed: xyz"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_ETHERNET_WAN_UNPLUGGED","group":"infrastructure"},"fields":["cellular_edges","reasons","vendors","models"]},{"key":"cellular_edge_firmware_upgraded","display":"Cellular Edge Firmware Upgraded","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_FIRMWARE_UPGRADED","group":"infrastructure"},"fields":["cellular_edges","vendors","models"]},{"key":"cellular_edge_login_failed","display":"Cellular Edge Login Failure","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"reasons":["Reasons for login failure: xyz"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_LOGIN_FAILED","group":"infrastructure"},"fields":["cellular_edges","reasons","vendors","models"]},{"key":"cellular_edge_login_succeeded","display":"Cellular Edge Login Success","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_LOGIN_SUCCEEDED","group":"infrastructure"},"fields":["cellular_edges","vendors","models"]},{"key":"cellular_edge_modem_wan_connected","display":"Cellular Edge WAN Cellular Connected","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_MODEM_WAN_CONNECTED","group":"infrastructure"},"fields":["cellular_edges","vendors","models"]},{"key":"cellular_edge_modem_wan_disconnected","display":"Cellular Edge WAN Cellular Disconnected","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"reasons":["Reasons for moden WAN link going down: xyz"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_MODEM_WAN_DISCONNECTED","group":"infrastructure"},"fields":["cellular_edges","reasons","vendors","models"]},{"key":"cellular_edge_rebooted","display":"Cellular Edge Rebooted","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"reasons":["Reasons router was rebooted: xyz"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_REBOOTED","group":"infrastructure"},"fields":["cellular_edges","reasons","vendors","models"]},{"key":"cellular_edge_sim_door_opened","display":"Cellular Edge SIM Door Opened","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_SIM_DOOR_OPENED","group":"infrastructure"},"fields":["cellular_edges","vendors","models"]},{"key":"cellular_edge_sim_door_closed","display":"Cellular Edge SIM Door Closed","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_SIM_DOOR_CLOSED","group":"infrastructure"},"fields":["cellular_edges","vendors","models"]},{"key":"cellular_edge_wan_service_type_changed","display":"Cellular Edge WAN Cellular Service Type Changed","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"reasons":["Reasons for service type change: xyz"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_WAN_SERVICE_TYPE_CHANGED","group":"infrastructure"},"fields":["cellular_edges","reasons","vendors","models"]},{"key":"cellular_edge_wan_mtu_low","display":"Cellular Edge WAN MTU Low","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","timestamp":1629918779,"last_seen":1629918773,"org_id":"a751df9c-897b-4065-9f34-d784c083dd0d","site_id":"819b44b2-42ef-459d-8e59-29c5577b2330","cellular_edges":["0030444f50c4"],"reasons":["Low MTU (500) detected on WAN network interface Internal 5GC (SIM1)"],"vendors":["cradlepoint"],"models":["W1850"],"count":2,"id":"badb2358-53c3-413d-adba-c45436a3496f","type":"CELLULAR_EDGE_WAN_MTU_LOW","group":"infrastructure"},"fields":["cellular_edges","reasons","vendors","models"]},{"key":"wan_device_problem","display":"Device Problem","group":"marvis","severity":"critical","marvis_suggestion_category":"gateway","default_enabled":true,"example":{"severity":"critical","timestamp":1688738190,"last_seen":1688738190,"category":"device_health","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","count":1,"id":"faf2de33-41cc-4f05-b52c-be2f1f0ddddddd","alert_id":"faf2de33-41cc-4f05-b52c-be2f1f0ddddd","details":{"action":"Please send WAN Edge logs to Mist and contact customer support for further assistance.","category":"device_health","status":"open","symptom":"device_problem"},"impacted_entities":[{"entity_mac":"bb2b3c4d5e6f","entity_model":"SSR120","entity_name":"MY GATEWAY","entity_type":"gateway","entity_version":"6.1.0-28"}],"root_cause":"malicious_driver_detection","impacted_entity_count":1,"status":"open","suggestion":"Please send WAN Edge logs to Mist and contact customer support for further assistance.","type":"DEVICE_PROBLEM","group":"marvis"},"fields":["entity_macs"]},{"key":"gw_non_compliant","display":"Non-compliant","group":"marvis","severity":"critical","marvis_suggestion_category":"gateway","default_enabled":true,"example":{"severity":"critical","timestamp":1688738190,"last_seen":1688738190,"category":"device_health","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","count":1,"id":"faf2de33-41cc-4f05-b52c-be2f1f0ddddddd","alert_id":"faf2de33-41cc-4f05-b52c-be2f1f0ddddd","details":{"action":"backup_partition_must_match_with_primary","category":"gateway","status":"open","symptom":"non_compliant"},"impacted_entities":[{"entity_mac":"bb2b3c4d5e6f","entity_model":"SSR120","entity_name":"MY GATEWAY","entity_type":"gateway","entity_version":"6.1.0-28"}],"impacted_entity_count":1,"status":"open","suggestion":"backup_partition_must_match_with_primary","type":"GW_NON_COMPLIANT","group":"marvis"},"fields":["entity_macs"]},{"key":"mist_edge_connected","display":"Mist Edge connected to cloud","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_connected","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_disconnected","display":"Mist Edge disconnected from cloud","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_disconnected","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_restarted","display":"Mist Edge was restarted","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_restarted","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_misconfigured","display":"Mist Edge configuration apply failed","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_misconfigured","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_service_crashed","display":"Mist Edge service crashed","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"services":["radsecproxy"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_service_crashed","group":"infrastructure"},"fields":["mxcluster_ids","services","hostnames","mxedge_ids"]},{"key":"mist_edge_service_failed","display":"Mist Edge service failed to start","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"services":["radsecproxy"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_service_failed","group":"infrastructure"},"fields":["mxcluster_ids","services","hostnames","mxedge_ids"]},{"key":"mist_edge_redsecproxy_server_not_responding","display":"Mist Edge primary radius server unresponsive","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_redsecproxy_server_not_responding","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_distro_upgrade_completed","display":"Mist Edge upgrade completed","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_distro_upgrade_completed","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_distro_upgrade_failed","display":"Mist Edge upgrade failed","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_distro_upgrade_failed","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_disk_usage_high","display":"Mist Edge disk usage high","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_disk_usage_high","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_cpu_usage_high","display":"Mist Edge cpu usage high","group":"infrastructure","severity":"critical","default_enabled":true,"example":{"severity":"critical","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_cpu_usage_high","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_memory_usage_high","display":"Mist Edge memory usage high","group":"infrastructure","severity":"critical","default_enabled":true,"example":{"severity":"critical","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_memory_usage_high","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"tt_port_last_dropped_from_lacp","display":"Last data port dropped from LACP","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"lags":["lacp0"],"port_ids":["ge-0/0/8"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"tt_port_last_dropped_from_lacp","group":"infrastructure"},"fields":["mxcluster_ids","lags","port_ids","hostnames","mxedge_ids"]},{"key":"tt_ports_all_dropped_from_lacp","display":"All data ports dropped from LACP","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"lags":["lacp0"],"port_ids":["ge-0/0/8"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"tt_ports_all_dropped_from_lacp","group":"infrastructure"},"fields":["mxcluster_ids","lags","port_ids","hostnames","mxedge_ids"]},{"key":"tt_tunnels_lost","display":"All tunnels are disconnected","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"tt_tunnels_lost","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"tt_tunnels_up","display":"New tunnel(s) formed","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"tt_tunnels_up","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"tt_inactive_vlans","display":"Inactive vlan(s) detected on tunnel port","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"vlans":[1010],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"tt_inactive_vlans","group":"infrastructure"},"fields":["vlans","mxcluster_ids","hostnames","mxedge_ids"]},{"key":"tt_monitored_resource_failed","display":"Tunnel Monitored resource is unresponsive","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"reasons":"Probe vlan101\u2192arp:1.1.1.1 failed; Tunterm has stopped for 00000000-0000-0000-1000-544553540000","timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"tt_monitored_resource_failed","group":"infrastructure"},"fields":["mxcluster_ids","reasons","hostnames","mxedge_ids"]},{"key":"tt_monitored_resource_recovered","display":"Tunnel Monitored resource reachability restored","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["00000000-0000-0000-1000-0200000bf045"],"mxcluster_ids":["e7831140-20da-4df5-8c38-0d08e809d403"],"hostnames":["MX-101"],"reasons":"Probe vlan101\u2192arp:1.1.1.1 recovered; Tunterm is running again for 00000000-0000-0000-1000-544553540000","timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"tt_monitored_resource_recovered","group":"infrastructure"},"fields":["mxcluster_ids","reasons","hostnames","mxedge_ids"]},{"key":"mist_edge_psu_plugged","display":"Mist Edge plugged to power","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["387804a7-3474-85ce-15a2-f9a9684c9c90"],"mxcluster_ids":["ed4665ed-c9ad-4835-8ca5-dda642765ad3"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_psu_plugged","group":"infrastructure"},"fields":["mxcluster_ids","component","hostnames","mxedge_ids"]},{"key":"mist_edge_psu_unplugged","display":"Mist Edge unplugged from power","group":"infrastructure","severity":"critical","default_enabled":true,"example":{"severity":"critical","mxedge_ids":["387804a7-3474-85ce-15a2-f9a9684c9c90"],"mxcluster_ids":["ed4665ed-c9ad-4835-8ca5-dda642765ad3"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_psu_unplugged","group":"infrastructure"},"fields":["mxcluster_ids","component","hostnames","mxedge_ids"]},{"key":"mist_edge_powerinput_connected","display":"Mist Edge power input connected","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["387804a7-3474-85ce-15a2-f9a9684c9c90"],"mxcluster_ids":["ed4665ed-c9ad-4835-8ca5-dda642765ad3"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_powerinput_connected","group":"infrastructure"},"fields":["mxcluster_ids","component","hostnames","mxedge_ids"]},{"key":"mist_edge_powerinput_disconnected","display":"Mist Edge power input disconnected","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","mxedge_ids":["387804a7-3474-85ce-15a2-f9a9684c9c90"],"mxcluster_ids":["ed4665ed-c9ad-4835-8ca5-dda642765ad3"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_powerinput_disconnected","group":"infrastructure"},"fields":["mxcluster_ids","component","hostnames","mxedge_ids"]},{"key":"mist_edge_memory_usage_normal","display":"Mist Edge memory usage normal","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["387804a7-3474-85ce-15a2-f9a9684c9c90"],"mxcluster_ids":["ed4665ed-c9ad-4835-8ca5-dda642765ad3"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_memory_usage_normal","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_cpu_usage_normal","display":"Mist Edge cpu usage normal","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["387804a7-3474-85ce-15a2-f9a9684c9c90"],"mxcluster_ids":["ed4665ed-c9ad-4835-8ca5-dda642765ad3"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_cpu_usage_normal","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"mist_edge_disk_usage_normal","display":"Mist Edge disk usage normal","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","mxedge_ids":["387804a7-3474-85ce-15a2-f9a9684c9c90"],"mxcluster_ids":["ed4665ed-c9ad-4835-8ca5-dda642765ad3"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_disk_usage_normal","group":"infrastructure"},"fields":["mxcluster_ids","hostnames","mxedge_ids"]},{"key":"gw_flow_count_threshold_exceeded","display":"WAN Edge Flow Count Threshold Exceeded","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","gateways":["020001bcb18d"],"reasons":["Flow Resource Count exceeded threshold of 90%, current 2800000, max 2748574"],"hostnames":["gateway_1"],"timestamp":1628904286,"last_seen":1628904286,"org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","count":1,"site_id":"ed999514-a0a5-4218-ab75-468113645c86","id":"ad7fc567-2894-42fd-9131-662ab43680c4","type":"gw_flow_count_threshold_exceeded","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_fib_count_threshold_exceeded","display":"WAN Edge Forwarding Information Base Count Threshold Exceeded","group":"infrastructure","severity":"warn","default_enabled":true,"example":{"severity":"warn","gateways":["020001bcb18d"],"reasons":["FIB Resource Count exceeded threshold of 90%, current 367000, max: 366215"],"hostnames":["gateway_1"],"timestamp":1628904286,"last_seen":1628904286,"org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","count":1,"site_id":"ed999514-a0a5-4218-ab75-468113645c86","id":"ad7fc567-2894-42fd-9131-662ab43680c4","type":"gw_fib_count_threshold_exceeded","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_flow_count_returned_to_normal","display":"WAN Edge Flow Count Returned to Normal","group":"infrastructure","severity":"info","default_enabled":true,"example":{"severity":"info","gateways":["020001bcb18d"],"reasons":["Flow Resource Count is back under the threshold of 90%. Current 2800000, Max 2748574"],"hostnames":["gateway_1"],"timestamp":1628904286,"last_seen":1628904286,"org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","count":1,"site_id":"ed999514-a0a5-4218-ab75-468113645c86","id":"ad7fc567-2894-42fd-9131-662ab43680c4","type":"gw_flow_count_returned_to_normad","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_fib_count_returned_to_normal","display":"WAN Edge Forwarding Information Base Count Returned to Normal","group":"infrastructure","severity":"info","default_enabled":true,"example":{"severity":"info","gateways":["020001bcb18d"],"reasons":["FIB Resource Count is back under the threshold of 90%. Current 329000, Max 366215"],"hostnames":["gateway_1"],"timestamp":1628904286,"last_seen":1628904286,"org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","count":1,"site_id":"ed999514-a0a5-4218-ab75-468113645c86","id":"ad7fc567-2894-42fd-9131-662ab43680c4","type":"gw_fib_count_returned_to_normal","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"mist_edge_fan_plugged","display":"Mist Edge Fan Plugged","group":"infrastructure","severity":"normal","default_enabled":false,"example":{"severity":"normal","mxedge_ids":["387804a7-3474-85ce-15a2-f9a9684c9c90"],"mxcluster_ids":["ed4665ed-c9ad-4835-8ca5-dda642765ad3"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_fan_plugged","group":"infrastructure"},"fields":["mxcluster_ids","component","hostnames","mxedge_ids"]},{"key":"mist_edge_fan_unplugged","display":"Mist Edge Fan Unplugged","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","mxedge_ids":["387804a7-3474-85ce-15a2-f9a9684c9c90"],"mxcluster_ids":["ed4665ed-c9ad-4835-8ca5-dda642765ad3"],"hostnames":["MX-101"],"timestamp":1629913390,"last_seen":1629913390,"org_id":"bb2fb165-0931-49c7-a1b8-9b5814326b7d","site_id":"908a97c0-b728-493a-b4d4-36660e1bbdfc","count":1,"id":"c0fef1e2-18c6-40e2-835d-148e557e58e1","type":"mist_edge_fan_unplugged","group":"infrastructure"},"fields":["mxcluster_ids","component","hostnames","mxedge_ids"]},{"key":"sw_ddos_protocol_violation_set","display":"Switch DDoS Protocol Violation Set","group":"security","severity":"warn","default_enabled":false,"example":{"protocol_name":"Virtual-Chassis:aggregate","org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"9ea31a50-0aa1-4471-bf61-4ac3593566b1","ev_type":"SW_DDOS_PROTOCOL_VIOLATION_SET","switches":["4c16fccc6e14"],"models":["EX4300-48MP"],"details":["DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception  Virtual-Chassis:aggregate exceeded its allowed bandwidth at fpc 0 for 512 times, started at 2022-07-01 06:26:07 UTC"],"device_type":"switch","version":"21.4R2.10","mac":"4c16fccc6e14","type":"sw_ddos_protocol_violation_set","id":"cb39a587-312e-4993-ab28-6eb6f70aa27e","group":"security"},"fields":["switches","details","models"]},{"key":"sw_ddos_protocol_violation_clear","display":"Switch DDoS Protocol Violation Clear","group":"security","severity":"info","default_enabled":false,"example":{"protocol_name":"Virtual-Chassis:aggregate","org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"9ea31a50-0aa1-4471-bf61-4ac3593566b1","ev_type":"SW_DDOS_PROTOCOL_VIOLATION_CLEAR","switches":["4c16fccc6e14"],"models":["EX4300-48MP"],"details":["DDOS_PROTOCOL_VIOLATION_CLEAR: INFO: Host-bound traffic for protocol/exception Virtual-Chassis:aggregate has returned to normal. Its allowed bandwidth was exceeded at fpc 0 for 511 times, from 2022-07-01 06:11:11 UTC to 2022-07-01 06:16:37 UTC"],"device_type":"switch","version":"21.4R2.10","mac":"4c16fccc6e14","type":"sw_ddos_protocol_violation_clear","id":"cb39a587-312e-4993-ab28-6eb6f70aa27e","group":"security"},"fields":["switches","details","models"]},{"key":"client_mac_spoofing","display":"Client MAC Spoofing","group":"security","severity":"warn","default_enabled":false,"example":{"org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","site_id":"5ca47c9b-b637-4935-958e-10d7e39a697c","type":"client_mac_spoofing","group":"security","wcid":["68784276-c0b7-0238-47ff-0d5bd3624cdd"],"reasons":["Client likely spoofed - device changed between fundamentally different operating systems."]},"fields":["reasons","wcids"]},{"key":"mistnac_server_cert_expired","display":"Mist Access Assurance Server Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":true,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"mistnac_server_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"Mist Access Assurance Server certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/setting"},"fields":["cert_subject","cert_expiry"]},{"key":"mistnac_server_cert_expiring","display":"Mist Access Assurance Server Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":true,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"mistnac_server_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"Mist Access Assurance Server certificate is expiring in 30 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/setting"},"fields":["cert_subject","cert_expiry"]},{"key":"mistnac_ca_cert_expired","display":"Mist Access Assurance CA Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":true,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"mistnac_ca_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"Mist Access Assurance CA certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/setting"},"fields":["cert_subject","cert_expiry"]},{"key":"mistnac_ca_cert_expiring","display":"Mist Access Assurance CA Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":true,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"mistnac_ca_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"Mist Access Assurance CA certificate is expiring in 15 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/setting"},"fields":["cert_subject","cert_expiry"]},{"key":"radsec_ca_cert_expired","display":"RadSec CA Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"radsec_ca_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"RadSec CA certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/setting"},"fields":["cert_subject","cert_expiry"]},{"key":"radsec_ca_cert_expiring","display":"RadSec CA Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"radsec_ca_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"RadSec CA certificate is expiring in 30 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/setting"},"fields":["cert_subject","cert_expiry"]},{"key":"radsec_device_cert_expired","display":"RadSec Device Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"radsec_device_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"RadSec Device certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/setting"},"fields":["cert_subject","cert_expiry"]},{"key":"radsec_device_cert_expiring","display":"RadSec Device Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"radsec_device_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"RadSec Device certificate is expiring in 30 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/setting"},"fields":["cert_subject","cert_expiry"]},{"key":"sso_idp_cert_expired","display":"SSO IdP Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"sso_idp_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"SSO IdP certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/ssos/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"sso_idp_cert_expiring","display":"SSO IdP Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":true,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"sso_idp_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"SSO IdP certificate is expiring in 30 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/ssos/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"sso_ldap_ca_cert_expired","display":"SSO LDAP CA Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":true,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"sso_ldap_ca_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"SSO LDAP CA certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/ssos/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"sso_ldap_ca_cert_expiring","display":"SSO LDAP CA Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"sso_ldap_ca_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"SSO LDAP CA certificate is expiring in 30 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/ssos/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"sso_ldap_client_cert_expired","display":"SSO LDAP Client Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"sso_ldap_client_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"SSO LDAP Client certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/ssos/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"sso_ldap_client_cert_expiring","display":"SSO LDAP Client Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"sso_ldap_client_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"SSO LDAP Client certificate is expiring in 30 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/ssos/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"psk_portal_idp_cert_expired","display":"PSK Portal IdP Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"psk_portal_idp_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"PSK Portal IdP certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/pskportals/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"psk_portal_idp_cert_expiring","display":"PSK Portal IdP Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"psk_portal_idp_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"PSK Portal IdP certificate is expiring in 30 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/pskportals/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"nac_portal_idp_cert_expired","display":"NAC Portal IdP Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"nac_portal_idp_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"NAC Portal IdP certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/nacportals/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"nac_portal_idp_cert_expiring","display":"NAC Portal IdP Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"nac_portal_idp_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"NAC Portal IdP certificate is expiring in 30 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/nacportals/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"wlan_sso_idp_cert_expired","display":"WLAN SSO IdP Certificate Expired","group":"certificate_expiry","severity":"critical","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"wlan_sso_idp_cert_expired","group":"certificate_expiry","severity":"critical","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"WLAN SSO IdP certificate has expired","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/wlans/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"wlan_sso_idp_cert_expiring","display":"WLAN SSO IdP Certificate Expiring","group":"certificate_expiry","severity":"warn","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"wlan_sso_idp_cert_expiring","group":"certificate_expiry","severity":"warn","timestamp":1733295183,"last_seen":1733295183,"cert_subject":["CN=cd328d30-642e-4504-9c78-00b09843c4ca,OU=OrgCA,O=Mist,C=US"],"cert_expiry":[1742465261],"text":"WLAN SSO IdP certificate is expiring in 30 days","obj_url":"/api/v1/orgs/2818e386-8dec-2562-9ede-5b8a0fbbdc71/wlans/1d969bf9-31d0-82f2-07c2-da8d51f31b18"},"fields":["cert_subject","cert_expiry"]},{"key":"cradlepoint_maintenance_scheduled","display":"Cradlepoint maintenance scheduled","group":"infrastructure","severity":"info","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"CRADLEPOINT_MAINTENANCE_SCHEDULED","group":"infrastructure","severity":"info","timestamp":1733295183,"last_seen":1733295183,"text":"Scheduled maintenance for xx/xx/xxxx."},"fields":["text"]},{"key":"cradlepoint_maintenance_started","display":"Cradlepoint maintenance started","group":"infrastructure","severity":"info","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"CRADLEPOINT_MAINTENANCE_STARTED","group":"infrastructure","severity":"info","timestamp":1733295183,"last_seen":1733295183,"text":"Scheduled maintenance is currently in progress. We will provide updates as necessary."},"fields":["text"]},{"key":"cradlepoint_maintenance_completed","display":"Cradlepoint maintenance completed","group":"infrastructure","severity":"info","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"CRADLEPOINT_MAINTENANCE_COMPLETED","group":"infrastructure","severity":"info","timestamp":1733295183,"last_seen":1733295183,"text":"Scheduled maintenance is complete"},"fields":["text"]},{"key":"cradlepoint_incident_resolved","display":"Cradlepoint incident resolved","group":"infrastructure","severity":"info","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"CRADLEPOINT_INCIDENT_RESOLVED","group":"infrastructure","severity":"info","timestamp":1733295183,"last_seen":1733295183,"text":"The incident causing issues in connectivity has been resolved."},"fields":["text"]},{"key":"cradlepoint_incident_identified","display":"Cradlepoint incident identified","group":"infrastructure","severity":"info","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"CRADLEPOINT_INCIDENT_IDENTIFIED","group":"infrastructure","severity":"info","timestamp":1733295183,"last_seen":1733295183,"text":"Incident identified. Proceeding with implementing a fix."},"fields":["text"]},{"key":"cradlepoint_incident_investigation_started","display":"Cradlepoint incident investigation started ","group":"infrastructure","severity":"info","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"CRADLEPOINT_INCIDENT_INVESTIGATION_STARTED","group":"infrastructure","severity":"info","timestamp":1733295183,"last_seen":1733295183,"text":"Investigation incident causing issues in service"},"fields":["text"]},{"key":"cradlepoint_sync_failed","display":"Failed to sync cradlepoint devices","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"id":"2c8ecff0-d3d9-4910-9612-33c7ef7f3356","org_id":"2818e386-8dec-2562-9ede-5b8a0fbbdc71","type":"CRADLEPOINT_SYNC_FAILED","group":"infrastructure","severity":"info","timestamp":1733295183,"last_seen":1733295183,"text":"authentication failed, API key invalid"},"fields":["text"]},{"key":"sw_ospf_neighbor_up","display":"Switch OSPF Neighbor Up","group":"infrastructure","severity":"info","default_enabled":false,"example":{"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"9ea31a50-0aa1-4471-bf61-4ac3593566b1","ev_type":"SW_OSPF_NEIGHBOR_UP","switches":["68ed573ab1e0"],"models":["EX4650-48Y"],"reasons":["RPD_OSPF_NBRUP: OSPF neighbor 10.255.186.237 (realm ospf-v2 irb.3023 area 0.0.0.0) state changed from Exchange to Full due to ExchangeDone (event reason: DBD exchange of slave completed)"],"device_type":"switch","version":"23.4R2-S4.11","mac":"68ed573ab1e0","type":"sw_ospf_neighbor_up","id":"cb39a587-312e-4993-ab28-6eb6f70aa27e","group":"infrastructure"},"fields":["switches","reasons","models"]},{"key":"sw_ospf_neighbor_down","display":"Switch OSPF Neighbor Down","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"9ea31a50-0aa1-4471-bf61-4ac3593566b1","ev_type":"SW_OSPF_NEIGHBOR_DOWN","switches":["68ed573ab1e0"],"models":["EX4650-48Y"],"reasons":["RPD_OSPF_NBRDOWN: OSPF neighbor 10.255.186.237 (realm ospf-v2 irb.3023 area 0.0.0.0) state changed from Full to Init due to 1WayRcvd (event reason: neighbor is in one-way mode)"],"device_type":"switch","version":"23.4R2-S4.11","mac":"68ed573ab1e0","type":"sw_ospf_neighbor_down","id":"cb39a587-312e-4993-ab28-6eb6f70aa27e","group":"infrastructure"},"fields":["switches","reasons","models"]},{"key":"sw_ospf_neighbor_adjacency_failed","display":"Switch OSPF Neighbor Adjacency Failed ","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"9ea31a50-0aa1-4471-bf61-4ac3593566b1","ev_type":"SW_OSPF_NEIGHBOR_ADJACENCY_FAILED","switches":["68ed573ab1e0"],"models":["EX4650-48Y"],"reasons":["OSPF mtu mismatch error is detected"],"device_type":"switch","version":"23.4R2-S4.11","mac":"68ed573ab1e0","type":"sw_ospf_neighbor_adjacency_failed","id":"cb39a587-312e-4993-ab28-6eb6f70aa27e","group":"infrastructure"},"fields":["switches","reasons","models"]},{"key":"sw_high_cpu_usage","display":"High CPU Usage","group":"marvis","severity":"critical","marvis_suggestion_category":"switch","default_enabled":true,"example":{"severity":"critical","timestamp":1629760130,"last_seen":1629760130,"status":"resolved","license_requirement":"VNA","org_id":"aabbccdd-0000-1111-aaaa-123456abcdef","org_name":"EXAMPLE ORG","site_id":"ccddeeff-0000-1111-aaaa-123456abcdef","site_name":"EXAMPLE SITE","count":1,"id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","action_id":"faf2de33-41cc-4f05-b52c-be2f1f0d1368","suggestion":"check_switch_cpu_usage","category":"switch","details":{"action":"check_switch_cpu_usage","category":"switch","status":"open","symptom":"high_cpu_usage"},"impacted_entities":[{"entity_type":"switch","entity_mac":"f4bfa816f66d","entity_name":"EX3400-48P-3","port_id":"ge-0/0/45","connected_device_mac":"001a070cd008","connected_device_name":"Vision-CAM-07","connected_device_manufacture":"Arecont Vision","vlan_id":"298"}],"type":"sw_high_cpu_usage","group":"marvis"},"fields":["entity_macs"]},{"key":"sw_lldp_duplicate_chassis_detected","display":"Switch port loop detected","group":"infrastructure","severity":"critical","default_enabled":false,"example":{"severity":"critical","reasons":["Switch port loop detected between port ge-0/0/6 and port ge-0/0/7."],"last_seen":1705453221,"switches":["b0eb7f1ca620"],"hostnames":["SW_NAME"],"count":1,"type":"lldp_duplicate_chassis_detected","timestamp":1705453221,"org_id":"a6bff957-8f84-41fb-92b4-776dcba3b736","site_id":"4eab30e2-3897-41fe-a6ee-e096199285a0","id":"709a5568-8213-4fbc-bc91-52464f4e028d","group":"infrastructure"},"fields":["switches","reasons","hostnames"]},{"key":"sw_upgrade_failed","display":"Switch upgrade failed","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"9ea31a50-0aa1-4471-bf61-4ac3593566b1","ev_type":"SW_UPGRADE_FAILED","switches":["68ed573ab1e0"],"models":["EX4650-48Y"],"reasons":["Unable to install package. Cannot unpack /tmp/junos-arm-32-23.4R2-S2.1.tgz: insufficient space in /packages"],"device_type":"switch","version":"23.4R2-S4.11","mac":"68ed573ab1e0","type":"sw_upgrade_failed","id":"cb39a587-312e-4993-ab28-6eb6f70aa27e","group":"infrastructure"},"fields":["switches","reasons","models"]},{"key":"gw_alarm_chassis_poe","display":"WAN Edge PoE Alarm","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["94f7add12c6f"],"reasons":["PoE voltage injection in Interface ge-0/0/8"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"76bd3d9a-48b8-468f-83c1-6fb2544f7815","count":1,"site_id":"f3ae6cdc-2304-452c-b13a-98a036b56803","id":"ilfeFZsBJYsDt8Dp2auq","type":"gw_alarm_chassis_poe","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_poe_clear","display":"WAN Edge PoE Alarm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["94f7add12c6f"],"reasons":["Alarm cleared: (GW_ALARM_CHASSIS_POE) PoE voltage injection in Interface ge-0/0/8"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"76bd3d9a-48b8-468f-83c1-6fb2544f7815","count":1,"site_id":"f3ae6cdc-2304-452c-b13a-98a036b56803","id":"mX5RIZsBJYsDt8DpHtO7","type":"gw_alarm_chassis_poe_clear","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_pem","display":"WAN Edge PEM Alarm","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["08767111de80"],"reasons":["FPC 1 PEM 0 is not powered"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"c6ecb511-815a-4342-9f02-abf549fa98e0","count":1,"site_id":"ae1e2cf4-9e30-4a73-ad8b-4a773a539a00","id":"X7tmIZsBsp0oYOVbPL-V","type":"gw_alarm_chassis_pem","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_pem_clear","display":"WAN Edge PEM Alarm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"warn","gateways":["08767111de80"],"reasons":["Alarm cleared: (GW_ALARM_CHASSIS_PEM) FPC 1 PEM 0 is not powered"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"c6ecb511-815a-4342-9f02-abf549fa98e0","count":1,"site_id":"ae1e2cf4-9e30-4a73-ad8b-4a773a539a00","id":"X7tmIZsBsp0oYOVbPL-V","type":"gw_alarm_chassis_pem","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_psu","display":"WAN Edge PSU Alarm","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["28b82942477e"],"reasons":["FPC 0 PSU Sensor too Warm"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"e7ac44d5-f8c3-4da1-8156-5a3f6c84d199","count":1,"site_id":"d05c49a0-7282-4043-a22b-6faaa2862f76","id":"ITTgH5sBuoxVWc-U0cWF","type":"gw_alarm_chassis_psu","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_psu_clear","display":"WAN Edge PSU Alarm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["28b82942477e"],"reasons":["Alarm cleared: (GW_ALARM_CHASSIS_PSU) FPC 0 PSU Sensor too Warm"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"e7ac44d5-f8c3-4da1-8156-5a3f6c84d199","count":1,"site_id":"d05c49a0-7282-4043-a22b-6faaa2862f76","id":"HDThH5sBuoxVWc-UF8si","type":"gw_alarm_chassis_psu_clear","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_fan","display":"WAN Edge Fan Alarm","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["b41678092901"],"reasons":["FPC 0 Fan 1 Spinning Overspeed"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"56227618-e6b8-444f-842a-a60ae727b31f","count":1,"site_id":"3c9badf5-1f83-4e94-af83-7f2b0f7aeb7c","id":"IeWelZoBuoxVWc-UZA03","type":"gw_alarm_chassis_fan","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_fan_clear","display":"WAN Edge Fan Alarm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["b41678092901"],"reasons":["Alarm cleared: (GW_ALARM_CHASSIS_FAN) FPC 0 Fan 1 Spinning Overspeed"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"56227618-e6b8-444f-842a-a60ae727b31f","count":1,"site_id":"3c9badf5-1f83-4e94-af83-7f2b0f7aeb7c","id":"IeWelZoBuoxVWc-UZA05","type":"gw_alarm_chassis_fan_clear","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_partition","display":"WAN Edge Partition Alarm","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["407f5fe57d80"],"reasons":["RE 0 /var partition usage is high"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"47afed2a-f882-469c-afb9-79551840178c","count":1,"site_id":"7993748e-1e46-4f32-aeb6-2a799418cca4","id":"yCePB5sBJYsDt8DpUIyO","type":"gw_alarm_chassis_partition","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_partition_clear","display":"WAN Edge Partition Alarm Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["407f5fe57d80"],"reasons":["Alarm cleared: (GW_ALARM_CHASSIS_PARTITION) RE 0 /var partition usage is high"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"47afed2a-f882-469c-afb9-79551840178c","count":1,"site_id":"7993748e-1e46-4f32-aeb6-2a799418cca4","id":"0zYsDJsBJYsDt8DpadMN","type":"gw_alarm_chassis_partition_clear","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_mgmt_link_down","display":"WAN Edge Fpc Management Ethernet Link Down","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["aca09d543700"],"reasons":["FPC Management0 Ethernet Link Down"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"98272e44-d31d-4e9a-b52d-18ae2183446e","count":1,"site_id":"37b52f98-ffae-4b8a-a357-d4e246f7a747","id":"v39uIZsBJYsDt8DpCS5o","type":"gw_alarm_chassis_mgmt_link_down","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_mgmt_link_down_clear","display":"WAN Edge Fpc Management Ethernet Link Down Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["aca09d543700"],"reasons":["Alarm cleared: (GW_ALARM_CHASSIS_MGMT_LINK_DOWN) FPC Management0 Ethernet Link Down"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"98272e44-d31d-4e9a-b52d-18ae2183446e","count":1,"site_id":"37b52f98-ffae-4b8a-a357-d4e246f7a747","id":"v39uIZsBJYsDt8DpCS5o","type":"gw_alarm_chassis_mgmt_link_down","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_humidity","display":"WAN Edge High Humidity","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"severity":"warn","gateways":["b41678092901"],"reasons":["FPC 0 Humidity Sensor 1 high humidity alert, triggered at 100 RH"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"56227618-e6b8-444f-842a-a60ae727b31f","count":1,"site_id":"3c9badf5-1f83-4e94-af83-7f2b0f7aeb7c","id":"IeWelZoBuoxVWc-UZA09","type":"gw_alarm_chassis_humidity","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"gw_alarm_chassis_humidity_clear","display":"WAN Edge High Humidity Clear","group":"infrastructure","severity":"info","default_enabled":false,"example":{"severity":"info","gateways":["b41678092901"],"reasons":["Alarm cleared: (GW_ALARM_CHASSIS_HUMIDITY) FPC 0 Humidity Sensor 1 high humidity alert, triggered at 100 RH"],"timestamp":1742976443,"last_seen":1742976443,"org_id":"56227618-e6b8-444f-842a-a60ae727b31f","count":1,"site_id":"3c9badf5-1f83-4e94-af83-7f2b0f7aeb7c","id":"IeWelZoBuoxVWc-UZA10","type":"gw_alarm_chassis_humidity_clear","group":"infrastructure"},"fields":["hostnames","gateways","nodes","reasons"]},{"key":"sw_config_reverted","display":"Switch config reverted","group":"infrastructure","severity":"warn","default_enabled":false,"example":{"org_id":"b4e16c72-d50e-4c03-a952-a3217e231e2c","site_id":"9ea31a50-0aa1-4471-bf61-4ac3593566b1","ev_type":"SW_CONFIG_REVERTED","switches":["68ed573ab1e0"],"models":["EX4650-48Y"],"reasons":["The last configuration change caused a loss of cloud connectivity (NoDefaultGateway after applying the config)\\nConfiguration was reverted to the last working config after the configuration revert timer. Please fix the configuration and retry."],"device_type":"switch","version":"23.4R2-S4.11","mac":"68ed573ab1e0","type":"sw_config_reverted","id":"e2a1b7c4-8f2d-4e1a-9b3c-7f8d2e1c4b5a","group":"infrastructure"},"fields":["switches","reasons","models"]},{"key":"gw_aamw_threat_detected","display":"AAMW threat detected","group":"security","severity":"warn","default_enabled":false,"example":{"timestamp":1629754258,"last_seen":1652729904,"type":"gw_aamw_threat_detected","group":"security","severity":"warn","org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","site_id":"9f5e5761-420a-4680-87c9-d9f876363bcc","id":"3d9fcaa1-e4ea-5b21-a723-44d8fg8h4467","gateways":["68ed573ab1e0"],"urls":["http://malicious-site.com"],"src_ips":["22.22.22.2"],"dst_ips":["1.4.145.244"]},"fields":["dst_ips","gateways","src_ips","urls"]},{"key":"gw_av_malware_detected","display":"Antivirus malware detected","group":"security","severity":"warn","default_enabled":false,"example":{"timestamp":1629754258,"last_seen":1652729904,"type":"gw_av_malware_detected","group":"security","severity":"warn","org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","site_id":"9f5e5761-420a-4680-87c9-d9f876363bcc","id":"4e0gdbb2-f5fb-6c32-b834-55e9gh9i5578","gateways":["68ed573ab1e0"],"files":["suspicious-file.exe"],"src_ips":["22.22.22.2"],"dst_ips":["1.4.145.244"]},"fields":["dst_ips","gateways","src_ips","files"]},{"key":"gw_secintel_threat_detected","display":"SecIntel threat detected","group":"security","severity":"warn","default_enabled":false,"example":{"timestamp":1629754258,"last_seen":1652729904,"type":"gw_secintel_threat_detected","severity":"warn","group":"security","org_id":"0c160b7f-1027-4cd1-923b-744534c4b070","site_id":"9f5e5761-420a-4680-87c9-d9f876363bcc","id":"5e1hccf3-g6hc-7d43-c945-66f0hi0j6689","gateways":["68ed573ab1e0"],"src_ips":["22.22.22.2"],"dst_ips":["1.4.145.244"]},"fields":["dst_ips","gateways","src_ips"]}]