Alarm Plugin Object
Create visually engaging, actionable email alerts for your business with Nodinite Alarm Plugins and an XSLT Stylesheet. This guide shows you how to leverage XML alarm data, custom metadata, and built-in functions to deliver clear, business-relevant notifications that drive action and keep your team informed.
✅ Style your alerts with XSLT for professional, branded HTML emails
✅ Use real alarm data and custom metadata for context-rich notifications
✅ Empower your team with actionable links and business insights
✅ Preview and test your stylesheets directly in Nodinite or Visual Studio
Understanding Alarm Plugin Data Formats
Nodinite supports multiple alarm plugin types, each with a distinct data format and transformation approach tailored to its purpose:
Email Alarm Plugins (2 types)
Data Format: XML (AlarmObject structure)
Stylesheet Support: XSLT transformation
Output: HTML emails via SMTP
Purpose: User-facing notifications with rich formatting and branding
The Email Alarm Plugins (E-mail and Email with Options) receive a comprehensive XML structure containing monitor views, resources, custom metadata, integrations, applications, and categories. XSLT stylesheets transform this XML into beautifully formatted HTML emails with custom branding, actionable links, and business-relevant context.
Webhook Alarm Plugin
Data Format: JSON (compressed or uncompressed)
Stylesheet Support: None (direct payload delivery)
Output: HTTP POST to external systems
Purpose: Integration layer for third-party tools (Jira, ServiceNow, Slack, etc.)
The Webhook Alarm Plugin receives a JSON payload and sends it directly to external systems via HTTP POST. No stylesheet transformation is available because the receiving system handles its own data formatting and presentation. This plugin is designed for API integrations, not user-facing notifications.
Event Log Alarm Plugin
Data Format: JSON (with SplitByResource wrapper)
Stylesheet Support: Liquid templates
Output: Windows Application Event Log entries
Purpose: SCOM/MOM integration for enterprise monitoring
The Event Log Alarm Plugin receives a JSON structure with the alarm object wrapped in a SplitByResource property. Liquid templates transform this JSON into Windows Event Log entries for integration with System Center Operations Manager (SCOM) and Microsoft Operations Manager (MOM).
Data Flow Architecture
The Monitoring Service (blue) feeds three plugin families: Email with XML and XSLT (purple), Webhook with JSON and no Stylesheet (teal), and Event Log with JSON and Liquid (orange).
Why These Different Approaches?
Email (XML + XSLT): XSLT provides powerful XML transformation capabilities for creating rich, branded HTML emails. XML's hierarchical structure naturally represents the complex alarm object with nested monitor views, resources, and metadata. XSLT's template matching and transformation rules make it ideal for generating business-ready email content.
Webhook (JSON, no stylesheet): External systems like Jira, ServiceNow, and Slack expect JSON payloads in their specific formats. No stylesheet transformation is needed because each external system handles its own data formatting, presentation, and business logic. The Webhook plugin acts as a pure integration layer, delivering structured data for the receiving API to process.
Event Log (JSON + Liquid): Windows Event Log entries require plain text messages, not HTML. Liquid provides lightweight, text-focused templating perfect for generating concise event log messages. JSON is the modern data format for APIs and integrations, making it easier to work with in contemporary monitoring tools like SCOM.
Email Plugin XML Data Structure
Note: The XML structure below is specific to Email Alarm Plugins. For other plugin formats, see the architecture overview above:
- Webhook plugin: JSON payload (compressed/uncompressed), no stylesheet
- Event Log plugin: JSON with Liquid templates
Below is an example of the XML data structure pushed in email alerts from the Nodinite Monitoring Service.
Use this data to customize the default Stylesheet for the Email Alarm Plugin. Preview your changes using the built-in tool in Nodinite or in Visual Studio for rapid iteration.
RAW data (XML)
<?xml version="1.0" encoding="utf-8" ?>
<AlarmObject xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<MonitorViews>
<MonitorView>
<MonitorViewId>1</MonitorViewId>
<Name>Test View</Name>
<Description>Simple unit testing view.</Description>
<StatusCode>
<StatusCode>0</StatusCode>
<Name>OK</Name>
</StatusCode>
<NumberOfMonitoredResources>2</NumberOfMonitoredResources>
<Integrations>
<Integration>
<IntegrationId>1</IntegrationId>
<Name>INT001 - Simple Integration</Name>
<Description>Integration for unit testing.</Description>
<WebSite>https://www.nodinite.com/</WebSite>
<CustomFields>
<CustomField>
<CustomFieldId>1</CustomFieldId>
<Name>SLA</Name>
<Description>SLA Level are Gold, Silver and Bronze</Description>
<WebSite>https://www.nodinite.com/SLA/</WebSite>
<ValueType>
<CustomFieldTypeId>1</CustomFieldTypeId>
<Name>Text</Name>
<Description>Custom Value are plain text values with optional Description and Web Site.</Description>
<WebSite></WebSite>
</ValueType>
<CustomValues>
<CustomValue>
<CustomValueId>1</CustomValueId>
<Value>Gold</Value>
<Description>Gold</Description>
<WebSite>https://www.nodinite.com/SLA/Gold</WebSite>
<ValueType>
<CustomFieldTypeId>1</CustomFieldTypeId>
<Name>Text</Name>
<Description>Custom Value are plain text values with optional Description and Web Site.</Description>
<WebSite></WebSite>
</ValueType>
</CustomValue>
</CustomValues>
</CustomField>
<CustomField>
<CustomFieldId>2</CustomFieldId>
<Name>INT Images</Name>
<Description>Images of the integrations</Description>
<WebSite></WebSite>
<ValueType>
<CustomFieldTypeId>2</CustomFieldTypeId>
<Name>File</Name>
<Description>Custom Value are represented as uploaded files with optional Description.</Description>
<WebSite></WebSite>
</ValueType>
<CustomValues>
<CustomValue>
<CustomValueId>4</CustomValueId>
<Value>home.png</Value>
<Description>Home for integration</Description>
<WebSite></WebSite>
<ValueType>
<CustomFieldTypeId>2</CustomFieldTypeId>
<Name>File</Name>
<Description>Custom Value are represented as uploaded files with optional Description.</Description>
<WebSite></WebSite>
</ValueType>
</CustomValue>
</CustomValues>
</CustomField>
</CustomFields>
</Integration>
</Integrations>
<ChangedResources>
<Resource>
<ResourceId>1</ResourceId>
<Name>First Resource - Send Port</Name>
<WebSite>https://www.nodinite.com/resource/send-port</WebSite>
<Source>
<SourceId>1</SourceId>
<Name>Test Monitoring Agent Configuration</Name>
<Description>Simple Monitoring Agent Configuration for testing purposes only.</Description>
<WebSite>https://www.nodinite.com/</WebSite>
</Source>
<Category>
<CategoryId>1</CategoryId>
<Name>Send Ports</Name>
<Description>Send ports category.</Description>
</Category>
<Application>
<ApplicationId>1</ApplicationId>
<Name>BizTalk System</Name>
<Description>Default biztalk application</Description>
<WebSite>https://www.nodinite.com/application/biztalk-system</WebSite>
</Application>
<StatusCode>
<StatusCode>0</StatusCode>
<Name>OK</Name>
</StatusCode>
<LogText>All OK!</LogText>
<CustomMetaDatas>
<CustomMetaData>
<CustomMetaDataId>4</CustomMetaDataId>
<Name>Log View Link</Name>
<Description />
<DataType>Link</DataType>
<CustomValues>
<CustomValue>
<CustomValueId>21</CustomValueId>
<Value>https://nodinite.com/</Value>
<Description />
<WebSite />
</CustomValue>
</CustomValues>
</CustomMetaData>
</CustomMetaDatas>
</Resource>
<Resource>
<ResourceId>2</ResourceId>
<Name>Second Resource - Receive Port</Name>
<Source>
<SourceId>1</SourceId>
<Name>Test Monitoring Agent Configuration</Name>
<Description>Simple Monitoring Agent Configuration for testing purposes only.</Description>
<WebSite>https://www.nodinite.com/</WebSite>
</Source>
<Category>
<CategoryId>2</CategoryId>
<Name>Receive Ports</Name>
<Description>Receive ports category.</Description>
<WebSite>https://www.nodinite.com/category/receive-ports</WebSite>
</Category>
<Application>
<ApplicationId>1</ApplicationId>
<Name>BizTalk System</Name>
<Description>Default biztalk application</Description>
<WebSite>https://www.nodinite.com/application/biztalk-system</WebSite>
</Application>
<StatusCode>
<StatusCode>0</StatusCode>
<Name>OK</Name>
</StatusCode>
<LogText>All OK!</LogText>
</Resource>
</ChangedResources>
</MonitorView>
<MonitorView>
<MonitorViewId>2</MonitorViewId>
<Name>Second View</Name>
<Description>Simple test view (second).</Description>
<WebSite>https://www.nodinite.com/</WebSite>
<StatusCode>
<StatusCode>2</StatusCode>
<Name>ERROR</Name>
</StatusCode>
<NumberOfMonitoredResources>2</NumberOfMonitoredResources>
<Integrations />
<ChangedResources>
<Resource>
<ResourceId>10</ResourceId>
<Name>LogAPI Queue</Name>
<Description>Queue for Nodinite's LogAPI.</Description>
<Source>
<SourceId>2</SourceId>
<Name>MSMQ</Name>
<Description>Monitoring Agent Configuration to monitor MSMQ queues.</Description>
<Server>IBSS-BUILD02</Server>
<Environment>Production</Environment>
<Version>1.0</Version>
</Source>
<Category>
<CategoryId>10</CategoryId>
<Name>MSMQ Queue</Name>
<Description>MSMQ Queues category</Description>
<WebSite>https://msdn.microsoft.com/en-us/library/ms711472%28v=vs.85%29.aspx</WebSite>
</Category>
<Application>
<ApplicationId>0</ApplicationId>
</Application>
<StatusCode>
<StatusCode>2</StatusCode>
<Name>ERROR</Name>
</StatusCode>
<LogText>Number of messages in queue exceeded error limit.</LogText>
</Resource>
<Resource>
<ResourceId>11</ResourceId>
<Name>LogAPI Test Queue</Name>
<Description />
<Source>
<SourceId>2</SourceId>
<Name>MSMQ</Name>
<Description>Monitoring Agent Configuration to monitor MSMQ queues.</Description>
<Server>IBSS-BUILD02</Server>
<Environment>Production</Environment>
<Version>1.0</Version>
</Source>
<Category>
<CategoryId>10</CategoryId>
<Name>MSMQ Queue</Name>
<Description>MSMQ Queues category</Description>
<WebSite>https://msdn.microsoft.com/en-us/library/ms711472%28v=vs.85%29.aspx</WebSite>
</Category>
<Application>
<ApplicationId>0</ApplicationId>
</Application>
<StatusCode>
<StatusCode>1</StatusCode>
<Name>WARNING</Name>
</StatusCode>
<LogText>Number of messages in queue exceeded warning limit, but not error limit.</LogText>
</Resource>
</ChangedResources>
</MonitorView>
</MonitorViews>
<Version>5.0.0.0</Version>
<Environment>Test</Environment>
<Customer>Nodinite</Customer>
<Created>2019-08-11T09:45:00.000000Z</Created>
<WebClientUrl>https://nodinite.contoso.com:40000/</WebClientUrl>
<IsRecurring>false</IsRecurring>
</AlarmObject>
Key XML Elements
The AlarmObject structure includes several important root-level elements for XSLT stylesheet development:
<MonitorViews>- Collection of monitor views with changed resources<Version>- Nodinite version number<Environment>- Environment name (Production, Test, Dev, etc.)<Customer>- Customer name from configuration<Created>- Timestamp when the alarm was triggered (ISO 8601 format with timezone)<WebClientUrl>- Base URL to the Nodinite Web Client<IsRecurring>New 7.x - Indicates if this is a recurring alarm (true) or the first alarm for this state (false). When a Monitor View's alert recurrence is configured to resend alerts, this flag helps distinguish between initial and subsequent notifications.
Tip
Use
<IsRecurring>for conditional logic: In your XSLT, you can use<xsl:if test="//IsRecurring = 'true'">to display different content for recurring alarms. For example, show "RECURRING ISSUE - Alert sent previously" or add escalation instructions for persistent problems that haven't been resolved.
How to use embedded scripts in XSLT
New 7.x
Note: XSLT stylesheets apply only to Email Alarm Plugins. For other plugin types, see the data format architecture above:
- Webhook plugin: JSON payload (no stylesheet support)
- Event Log plugin: JSON with Liquid templates
There are several built-in functions in Nodinite that you can use in your XSLT stylesheets. These functions are available in the Nodinite namespace and can be used to manipulate data, format dates, and more. For example, you can modify static data in Custom Metadata values to add business value to alerts.
Important
In Nodinite 7, custom scripts (
msxsl:scriptblocks) in XSLT Stylesheets are blocked by default: they run only when the StylesheetScriptsEnabled System Parameter istrue, and with the defaultfalsethe Stylesheet fails and an error is logged. Prefer the built-in functions in this section; they need no System Parameter change. If you have existing Stylesheets that use custom scripts, update them to use the built-in functions, or enable the parameter after reading its security warning.If you need a generic function that is missing, share the C# code with Nodinite. Generic functions can then be made available in the Nodinite namespace for all customers to use in their XSLT Stylesheets.
Built-in functions give all customers the same functionality without maintaining custom scripts, and reduce the risk of executing arbitrary code in XSLT Stylesheets.
Replace start and end date in a Log View
This example demonstrates how to create dynamic Log View links in alarm emails that automatically adjust the time range based on when the alarm was triggered. The built-in XsltExtensionHelper:editSearchApiUrl and XsltExtensionHelper:datenow functions enable you to replace static date parameters in Log View URLs with dynamic values calculated from the alarm's Created timestamp.
Tip
The XML example above is a sample of the data pushed in alerts (Alarms) from the Nodinite Monitoring Service. Use this data to customize the default Stylesheet for Email Alarm Plugin using the preview tool within Nodinite or Visual Studio if you prefer. The data can be used in this example as is to test the functionality replacing the start and end date in a Log View.
Custom Metadata link type on Resource
If not already present, add a new Custom Metadata field of Link type to the Resource with the name Log View Link and set the URL. This will be used in the e-mail alert to create a link to the Log View.
The Resource carries the Log View URL that the alert Stylesheet rewrites.
Copy the actual URL from the Log View in Nodinite and paste it into the Value field of the Custom Metadata. The URL should look like this: 'https://localhost:7139/Log/LogView/2?searchJson=%7B%22FilterGroups%22%3A%5B%5D%2C%22NumberOfItems%22%3A100%2C%22Page%22%3A1%2C%22From%22%3A%222025-07-11T22%3A00%3A00Z%22%2C%22To%22%3A%222025-07-18T21%3A59%3A59Z%22%2C%22PostGroupFilterGroups%22%3A%5B%5D%2C%22GroupSortByDescending%22%3Atrue%2C%22GroupHeaderLastEvent%22%3Atrue%2C%22DisplayGroupSummary%22%3Afalse%2C%22DataSource%22%3A%7B%7D%2C%22GroupCountFilter%22%3A%7B%22From%22%3A0%2C%22To%22%3A0%7D%7D'.
Note
Obviously, if you change the name of the Custom Metadata field, you must also change the name in the XSLT stylesheet.
XSLT Stylesheet
As you must modify the existing Stylesheet for any of the Email Alarm Plugins, ensure you are working with a copy. Whenever a new version of Nodinite is released, we may update the default stylesheets, and you will lose your changes if you have not made a copy.
The example below shows how to modify the <xsl:when test="DataType = 'Link'"> section of the XSLT stylesheet to dynamically replace the start and end dates in a Log View URL:
<xsl:when test="DataType = 'Link'">
<xsl:for-each select="CustomValues/CustomValue">
<xsl:sort order="ascending" select="Value"/>
<div>
<xsl:choose>
<xsl:when test="position() > 1">
<xsl:attribute name="style">
font-family:Arial,sans-serif;padding-top:0.62em; padding-bottom:0.62em; border-top: 0.0626em solid #ccc;
</xsl:attribute>
</xsl:when>
<xsl:otherwise>
<xsl:attribute name="style">
font-family:Arial,sans-serif;padding-top:0.62em; padding-bottom:0.62em;
</xsl:attribute>
</xsl:otherwise>
</xsl:choose>
<xsl:choose>
<xsl:when test="../../Name = 'Log View Link'">
<xsl:variable name="date" select="XsltExtensionHelper:datenow(//Created)" />
<a target="_blank" style="color: #e15046;">
<xsl:attribute name="href">
<xsl:value-of select="XsltExtensionHelper:editSearchApiUrl(Value, $date, 3600)" />
</xsl:attribute>
Name of Log View
</a>
</xsl:when>
<xsl:otherwise>
<a target="_blank" style="color: #e15046;">
<xsl:attribute name="href">
<xsl:value-of select="Value"/>
</xsl:attribute>
<xsl:value-of select="Value" />
</a>
</xsl:otherwise>
</xsl:choose>
<br/>
This code uses the XsltExtensionHelper:editSearchApiUrl function to replace the start and end dates in the URL with the actual dates from the Created element in the XML data. The datenow function is used to get the current date, which is then passed to the editSearchApiUrl function along with a time span of 3600 seconds (1 hour). This will create a new URL that points to the Log View with the correct start and end dates, in this case subtract one hour from the Created for start date and add one hour as end date.
Use the Stylesheet in an Alarm Plugin Entry
To use the modified Stylesheet, select it on the Basic tab of the Alarm Plugin entry, for example an Email with Options entry. Every Monitor View that selects that entry then uses your custom XSLT stylesheet; to use it for only some Monitor Views, add a separate entry and select it in those Monitor Views.
The stylesheet list at the bottom of the Basic tab selects the Stylesheet for the entry.
Next Steps
- Add or manage Stylesheet
- XML Passthrough - See the raw alarm XML before you build your Stylesheet
- Configure alert recurrence
Related Topics
Sample Stylesheets
Base64Decode XML from JSON - Decode base64-encoded XML in JSON with Liquid
XML to XML - Strip SOAP envelope and transform XML structure
XML Passthrough - Debug stylesheet to output raw XML unchanged in emails
Line break an EDIFACT - Format EDI messages for readable display in Log Views
Configuration & Components
Stylesheets - Manage XSLT and Liquid stylesheets
Stylesheet Examples - All XSLT and Liquid examples
StylesheetScriptsEnabled - System Parameter that allows embedded scripts
Monitor Views - Configure alarm notifications
Resources - Monitored resources in Nodinite
Custom Metadata - Add custom fields to resources and integrations
Time Intervals - Control how often recurring alerts are resent
Show who to call in alerts (Getting Started) - Scenario that puts Custom Metadata in alert emails
Alarm Plugins
Alarm Plugins - Overview of all notification channels
E-mail - Email alarm plugin
Email with Options - Email alarm plugin with advanced features (recommended)
HTTP Webhook - Webhook alarm plugin for external integrations
Event Log - Event Log alarm plugin for SCOM/MOM