Thank you very much for your very detailed support. It works perfect. 

Regards,
cserzs

I would suggest the following scheme:

Create events (of course you can name them any way you want):

TRAP_RAW (normal severity)
TRAP_INFO (normal severity)
TRAP_WARNING (warning severity)
TRAP_CRITICAL (critical severity)
TRAP_CLOSE (normal severity)

Create SNMP trap mapping for trap .1.3.6.1.4.1.23986.1.4.1 with the following varbind mapping:
#2 - .1.3.6.1.4.1.23986.1.2.3.1.9.200083
#3 - .1.3.6.1.4.1.23986.1.3.4.1.6.2368
#4 - .1.3.6.1.4.1.23986.1.3.4.1.8.2368  (this is needed if you want to pass message as parameter to event)

Create server action that will call the following NXSL script from library:

if ($event->parameters[2] == 2)
{
   switch($event->parameters[3])
   {
      case 3:
         evt = "TRAP_CRITICAL";
         break;
      case 2:
         evt = "TRAP_WARNING";
         break;
      default:
         evt = "TRAP_INFO";
         break;
   }
   PostEvent($node, evt, null, $event->parameters[4]);  // pass message as first parameter to generated event
}
else
{
   PostEvent($node, "TRAP_CLOSE");
}

Then create the following rules in event processing policy:

event is TRAP_RAW

action: call script and stop processing

event is TRAP_INFO, TRAP_WARNING, or TRAP_CRITICAL

action: create alarm with some key

event is TRAP_CLOSE

action: terminate alarm with key used in rule #2

Please note that message extracted from trap will be available as %1 in message template for generated events and alarms.

Best regards,
Victor