Importing Monitors from CSV
Organization administrators can create many monitors at once from a CSV file. In the monitor list, open the Create dropdown and choose Import CSV to open the import wizard.
The wizard guides you through three steps: Upload, Map columns, and Results.
CSV format
The first row must be a header row of column names — the next step matches those names to monitor fields (you can adjust the mapping by hand). Save the file as UTF-8 and follow standard CSV rules (RFC 4180): separate values with commas, and wrap any value that itself contains a comma in double quotes.
A few values behave in ways worth knowing up front:
escalationPolicyreferences an existing escalation policy by name or numeric id. A name must match exactly, so create the policy before importing.incidentMessageTemplateis the literal incident message, not a reference to a saved template.- For S7 Tag and OPC UA Node rows, you link the monitor to its parent endpoint monitor in one of two ways. Either set
endpointto the same value as the parent S7 Endpoint or OPC UA Endpoint, or setparentMonitorto the parent monitor's name or numeric id. The parent may appear earlier in the same file or already exist — so you can import child monitors on their own, without re-importing the parent. If a name matches more than one monitor, the row is rejected; use the numeric id to disambiguate.
To start from a working example, use Download example CSV on the upload step: it contains every supported column and one example row per monitor type.
Step 1 — Upload
Drag a CSV file onto the drop zone, or click to browse. A preview table shows the first rows so you can confirm the file was read correctly; use Replace to swap in a different file. Click Next to continue, or Cancel to close the wizard.
Step 2 — Map columns
Map each monitor field to a column from your CSV. The wizard auto-detects matching column names and pre-fills the mapping where it can. For every field you can:
- pick the CSV column whose values to use,
- choose Fixed value… to apply one value to every row (handy for shared settings such as the escalation policy), or
- leave it Not mapped — allowed only for optional fields.
Which fields are required depends on the monitor types detected in the file. The table lists every column, when it is required, and the values it accepts.
| Column | Required for | Valid values / format |
|---|---|---|
monitorType | All | s7_endpoint, s7_tag, opcua_endpoint, opcua_node, cve |
name | All | Free text |
escalationPolicy | All | Name (exact match) or numeric id of an existing escalation policy |
incidentMessageTemplate | Optional | Free text (the message itself) |
endpoint | S7 Endpoint, S7 Tag, OPC UA Endpoint, OPC UA Node | Host/IP or opc.tcp://…. For S7 Tag and OPC UA Node, links to the endpoint monitor with the same endpoint |
parentMonitor | Optional (S7 Tag, OPC UA Node) | Parent endpoint monitor's name or numeric id (alternative to matching on endpoint) |
rack | S7 Endpoint | Integer (e.g. 0) |
slot | S7 Endpoint | Integer (e.g. 1) |
address | S7 Tag | S7 address (e.g. DB1.DBW0) |
dataType | Optional (S7 Tag) | bit, byte, word, dword, int, dint, real |
opcuaNodeId | OPC UA Node | Node ID (e.g. ns=2;s=ProductionCounter) |
securityMode | Optional (OPC UA Endpoint) | none, sign, sign_and_encrypt (empty → none) |
securityPolicy | Optional (OPC UA Endpoint) | none, basic256, basic256sha256 (empty → none) |
aggregation | S7 Tag, OPC UA Node | min, max, sum, avg, count |
operation | S7 Tag, OPC UA Node | eq, neq, gt, gte, lt, lte |
operand | S7 Tag, OPC UA Node | Number |
duration | S7 Tag, OPC UA Node | Seconds (number) |
frequency | S7 Tag, OPC UA Node | Seconds (number) |
| vendor | CVE | Device vendor, e.g. Siemens | | orderCode | CVE | Device order code / MLFB, e.g. 6ES7516-3AN00-0AB0 | | firmware | Optional (CVE) | Firmware version, e.g. V2.9.2 (empty → matches all firmware versions) |
Heartbeat monitors cannot be created through CSV import.
TIP
aggregation, operation, operand, duration, and frequency together define a monitor's check condition. For S7 Tag and OPC UA Node monitors they are required as a set.
TIP
CVE monitors (cve) match published advisories against a device by vendor + orderCode (+ optional firmware). They have no endpoint, rack/slot, or check condition — the only CVE-specific columns are vendor, orderCode, and firmware. See CVE monitors for how matching works.
When every required field is mapped, click Run Import. To close and discard your work, click Cancel; to pause without losing your column mappings, use the × button in the header — the wizard resumes where you left off when you reopen it.
Step 3 — Results
A summary shows how many rows were imported successfully and how many failed. Each failed row is listed with the error that caused it. Click Download failed rows to export just those rows as a CSV, correct them, and import the file again.
Related
- Monitors — monitor types, configuration, and evaluation