@jbrines Here you are - full credit to @grantjenkins.
Hopefully this gets what you're looking for. Note that I've just got a manual trigger and storing the JSON directly in the Compose for this example.
See full flow below. I'll go into each of the actions.
Compose contains the JSON data you sent through. You would already have this as part of the trigger attachment content.
XML is a Compose that converts the JSON data to XML so we can apply XPath expressions. Note that I've also added a root element to ensure it's valid XML. The expression used is:
xml(json(concat('{"root": ', outputs('Compose'), '}')))
//Your expression would likely look like the following:
xml(json(concat('{"root": ', triggerBody()?['attachments'][0]['content'], '}')))
Condition checks to see if any items within any of the facts arrays have a name containing 'Monitor status' and a value containing 'DOWN'. If at least one item is returned, then the Condition will return true and would run your Reply in channel with a message in the Yes branch. The expression for the condition is:
length(xpath(outputs('XML'), '//sections/facts[contains(name, "Monitor status") and contains(value, "DOWN")]'))
