Skip to main content
Connect Zabbix to let CloudThinker agents triage active problems, read host metrics and log items, review triggers, templates, and dashboards, and, if you allow it, acknowledge events or schedule maintenance. The connection signs in to the Zabbix API with an API token or a username and password, and agents can do only what that Zabbix user is allowed to do.

​
Prerequisites

  • A Zabbix frontend reachable from CloudThinker over the internet, such as https://zabbix.example.com. If a firewall guards it, or it must stay private, see Reaching private services.
  • A Zabbix Super admin who can create a user, a user group, and an API token.
  • Zabbix 5.4 or later if you want to use an API token. Older versions use username and password.
  • The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

​
Setup

1

Create a role with API access

Go to Users → User roles (in Zabbix 6.x, Administration → User roles) and click Create user role. Name it CloudThinker, set User type to User (or Admin for writes, see Required permissions), make sure Access to API is enabled, and click Add.
2

Create a user group with host group access

Go to Users → User groups (in 6.x, Administration → User groups) and click Create user group. Name it CloudThinker. On the Host permissions tab (Permissions in 6.x), select the host groups agents should see, choose Read, and click Add.
3

Create the user

Go to Users → Users (in 6.x, Administration → Users) and create a user named cloudthinker in the CloudThinker group. On the Permissions tab, pick the CloudThinker role, then click Add.
4

Create an API token (Zabbix 5.4+)

Go to Users → API tokens (in Zabbix 5.4 to 6.x, Administration → General → API tokens) and click Create API token. Select the cloudthinker user, set Expires at to match your rotation schedule, and click Add. Copy the token. Zabbix shows it only once.On a version older than 5.4, skip this step and use the user’s password instead.
5

Add the connection in CloudThinker

In the sidebar, click More → Workspace settings → Connections, select Zabbix, and fill in:
  • ZABBIX_URL: your Zabbix frontend URL, such as https://zabbix.example.com.
  • ZABBIX_AUTH_TYPE: switch it to API Token. The default is Username & Password, but a token can expire and be revoked without changing a password.
  • ZABBIX_TOKEN, or ZABBIX_USERNAME and ZABBIX_PASSWORD: the credentials from the steps above. CloudThinker shows only the fields for the auth type you picked.
Click Connect. CloudThinker signs in and lists hosts to check the credentials.Success state: the connection shows a Connected status. That only proves the sign-in, so run the prompt in Verify the connection in a new chat to check that the hosts you expect are visible.

​
Connection details

The form shows these field names as they are written below.

​
Required permissions

Zabbix decides access in two places: the user’s role (what kind of user it is, and whether it can use the API) and its user group (which host groups it can read or change). Agents see only hosts in host groups the user group can read.
Avoid Super admin. It ignores host group permissions and can create and change users, so one mistaken approval, by a person or by AI judgment, can reach every host and account. If you must use it, choose Manual so a person approves every change. Once CloudThinker turns on Rule enforcement for your workspace, a Deny Rule for Zabbix user creation can block that one operation outright.
Start with a User-type role and Read on the host groups you care about. Every write still goes through Approvals, but a read-only Zabbix user means no approval, mistaken or automatic, can change anything.

​
Agent capabilities

Agents use Zabbix’s severity scale: Not classified, Information, Warning, Average, High, Disaster. Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself. So on the default mode, an agent could create a maintenance window, delete a host, or create a user without a person seeing it. Choose Manual so a person approves every change — that is the control that works today. Once CloudThinker turns on Rule enforcement for your workspace, an Ask first Rule can narrow the wait to just those operations: in a chat, type /create-policy Ask first for maintenance windows, host deletes and user creation on the Zabbix connection, then accept it under Approvals → Rules → Needs review.
A maintenance window created by an agent starts immediately, and alerts for those hosts stay suppressed until it ends. You can’t give it a future start time, so ask when the work begins. Check the host list and duration in the approval request before you approve it. Deleting a host or unlinking a template with its data can’t be undone.

​
Verify the connection

Ask CloudThinker in a new chat:
Expect the Zabbix server version, a host count with a sample, your host groups, and active problems grouped by severity. If hosts are missing, the user’s group can’t read their host group.

​
Example prompts

The last prompt needs an Admin-type role with Read-write on that host group, and it goes through your Approvals first. On Manual it waits for a person; on the default Auto mode, AI judgment can let it run without asking.

​
Troubleshooting

CloudThinker couldn’t sign in or list hosts. Check that ZABBIX_URL is the frontend address and reachable from CloudThinker, that ZABBIX_AUTH_TYPE matches the credentials you entered, and that the user’s role has API access enabled.
The token expired or was deleted, or the password changed. Create a new token under API tokens and update ZABBIX_TOKEN, or update the password.
The user’s group has no permission on that host group, so Zabbix leaves those hosts out. Grant Read on the host group in the user group’s permissions.
The user is a User-type role or has only Read on the host group. Change the role to Admin type and grant Read-write if you want agents to make that change.
The Zabbix API is rate limiting, failing, or in maintenance. Wait a minute, then ask a narrower question scoped to one host or host group.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Prefer an API token: a token belongs to one user, carries its own expiry, and can be revoked without changing a password.
  • Scope by host group: give the CloudThinker user group permissions only on the host groups agents need.

Approval rules

Decide which Zabbix writes run, wait for a person, or are refused.

Webhook integrations

Send Zabbix alerts into Resolve as incidents.