Managing event policies with REST APIs
The following section provides a list of supported endpoints and an overview about running these endpoints. Before you run an endpoint, you must authenticate yourself. For more information, see Access and authentication for the REST API
Managing event policies
You can create, update, delete, retrieve, search, enable, and disable event policies by using REST APIs.
POST /event_policies
Create an event policy
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Request body
"name": "string",
"description": "string",
"executionOrder": integer,
"enabled": true,
"selectorCriteria": "string",
"types": [
"string"
],
"configurations": [
{
"configOrder": integer,
"definition": {},
"timeframeStatus": "string",
"type": "string",
"subType": "string"
}
]
}
Example request body
Example: Basic Enrichment Policy
"name": "basic enrichment Policy",
"types": [
"BASIC_ENRICHMENT"
],
"description": "basic enrichment Policy",
"executionOrder": 9999,
"selectorCriteria": "class equals 'EVENT' AND msg contains 'server1'",
"enabled": false,
"configurations": [
{
"type": "BASIC_ENRICHMENT",
"configOrder": 1,
"definition": {
"processing_action": {
"category": "SLA_MANAGEMENT",
"priority": "PRIORITY_5",
"severity": "CRITICAL",
"location": "Pune ",
"msg": "policy for location %location%"
}
}
}
]
}
Example: Advanced Enrichment Policy
"name": "Advanced Enrichment Policy",
"types": [
"ADVANCED_ENRICHMENT"
],
"description": "Advanced Enrichment Policy",
"executionOrder": 837,
"selectorCriteria": "( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'SBzHEs_nested_if' )",
"configurations": [
{
"type": "ADVANCED_ENRICHMENT",
"configOrder": 1,
"definition": {
"children": [
{
"type": "enrich",
"key": "$NEW.cdmclass",
"label": "cdmclass enrich",
"children": [
{
"children": [],
"type": "data",
"value": "$NEW.al_parameter_name"
}
]
},
{
"type": "if",
"label": "if outer",
"conditions": [
{
"slotName": "$NEW.al_parameter_threshold",
"slotOperator": "contains",
"conditionOrder": 0,
"conditionOperator": "",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "fLdxHe"
},
{
"slotName": "$NEW.status",
"slotOperator": "equals",
"conditionOrder": 1,
"conditionOperator": "AND",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "OPEN"
}
],
"children": [
{
"children": [],
"type": "enrich",
"value": "ACK",
"key": "$NEW.status",
"label": "enrich status"
},
{
"type": "if",
"label": "if inner",
"conditions": [
{
"slotName": "$NEW.severity",
"slotOperator": "greater_than",
"conditionOrder": 0,
"conditionOperator": "",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "MINOR"
},
{
"slotName": "$NEW.location",
"slotOperator": "contains",
"conditionOrder": 1,
"conditionOperator": "AND",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "tI749vH3"
}
],
"children": [
{
"children": [
{
"children": [
{
"children": [],
"type": "data",
"value": "$NEW.msg"
},
{
"children": [],
"type": "data",
"value": "if_if_then_criteria_matched"
}
],
"name": "Concat",
"type": "function"
}
],
"type": "enrich",
"value": null,
"key": "$NEW.msg",
"label": "enrich message "
},
{
"children": [],
"type": "enrich",
"value": "PRIORITY_1",
"key": "$NEW.priority",
"label": "enrich priority"
}
]
},
{
"type": "else",
"label": "inner else",
"children": [
{
"children": [
{
"children": [
{
"children": [],
"type": "data",
"value": "$NEW.msg"
},
{
"children": [],
"type": "data",
"value": "if_if_else_criteria_matched"
}
],
"name": "Concat",
"type": "function"
}
],
"type": "enrich",
"value": null,
"key": "$NEW.msg",
"label": "enrich message inner"
},
{
"children": [],
"type": "enrich",
"value": "PRIORITY_4",
"key": "$NEW.priority",
"label": "enrich priority inner"
}
]
}
]
},
{
"type": "else",
"label": "else outer",
"children": [
{
"type": "if",
"label": "else if inner",
"conditions": [
{
"slotName": "$NEW.priority",
"slotOperator": "greater_than",
"conditionOrder": 0,
"conditionOperator": "",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "PRIORITY_3"
},
{
"slotName": "$NEW.source_address",
"slotOperator": "contains",
"conditionOrder": 1,
"conditionOperator": "AND",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "bmc.com"
}
],
"children": [
{
"label": " enrich severity in outer else if",
"children": [],
"type": "enrich",
"value": "CRITICAL",
"key": "$NEW.severity"
}
]
},
{
"type": "else",
"label": "else else inner",
"children": [
{
"children": [],
"type": "enrich",
"value": "MINOR",
"key": "$NEW.severity",
"label": "enrich severity else"
}
]
}
]
}
],
"type": "root",
"label": "policy"
}
}
]
}
Example: Dynamic Enrichment Policy
"name": "Dynamic Enrichment Policy Test",
"description": "CXUDvqPwrx",
"enabled": true,
"executionOrder": 594,
"types": [
"ADVANCED_ENRICHMENT"
],
"configurations": [
{
"type": "ADVANCED_ENRICHMENT",
"subType": "DYNAMIC_ENRICHMENT",
"configOrder": 1,
"definition": {
"type": "root",
"label": "root_label",
"children": [
{
"type": "dynamicDataEnrichment",
"fieldSeparator": ",",
"matchTableID": "21de6df5-6c88-11ec-8a0d-9566b475af32",
"matchTableCount": "4",
"matchFields": [
"status",
"severity"
],
"matchPreference": "First",
"enrichFields": [
"msg",
"location"
],
"labels": {
"enrichFields": "Enrich",
"matchFields": "Match1",
"importData": "Import1"
}
}
]
}
}
],
"selectorCriteria": "( class equals 'EVENT' ) AND ( severity equals 'CRITICAL' ) AND ( msg contains 'eAnkcF_function_enrich' )"
}
matchTableID is the ID of the data table returned by the create data table endpoint.
To learn how to create a data table in a dynamic enrichment policy, see the POST/data_tables endpoint on the Managing-data-tables-in-dynamic-enrichment-policies-with-REST-APIs page.
Example: Correlation Policy
"name": "Correlation Policy",
"types": [
"CORRELATION"
],
"description": "Correlation Policy",
"executionOrder": 3,
"selectorCriteria": "class equals 'EVENT' AND msg contains 'server1'",
"enabled": true,
"configurations": [
{
"type": "CORRELATION",
"configOrder": 1,
"definition": {
"children": [
{
"newEvent": {
"severity": "MAJOR",
"msg": "Policy Updated %msg%",
"location": "",
"priority": "PRIORITY_5",
"newEventClass": "ALARM",
"status": "OPEN"
},
"children": [],
"within": 15,
"minCount": 3,
"label": "",
"type": "aggregate",
"conditions": [
{
"slotName": "$NEW.msg",
"slotOperator": "equals",
"conditionOrder": 0,
"conditionOperator": "",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "$OLD.msg"
}
]
}
],
"label": "policy",
"type": "root"
}
}
]
}
Example: Incident Notification Policy
"name": "Incident Notification Policy",
"types": [
"NOTIFICATION"
],
"description": "Incident Notification Policy",
"executionOrder": 1,
"selectorCriteria": "class equals 'EVENT' AND msg contains 'server1'",
"enabled": false,
"configurations": [
{
"type": "NOTIFICATION",
"configOrder": 1,
"definition": {
"processing_action": {
"notificationService": "incident"
},
"update_events_filter_criteria": {
"eventClass": "EVENT",
"filterCriteria": []
}
}
}
]
}
Example: Email Notification Policy
"name": "Email Notification Policy",
"description": "Email Notification Policy",
"enabled": true,
"executionOrder": 753,
"types": [
"NOTIFICATION"
],
"selectorCriteria": "class equals 'PATROL_EV' AND ( msg contains 'notify1' )",
"configurations": [
{
"type": "NOTIFICATION",
"configOrder": 1,
"definition": {
"processing_action": {
"notificationService": "email",
"emailBody": "Automating Notification Policy where message is %msg%",
"emailSubject": "Notification Policy with severity %severity%",
"emailTo": "atech@test.com",
"autoAck": "true"
},
"update_events_filter_criteria": {
"eventClass": "PATROL_EV",
"filterCriteria": [
{
"key": "when",
"criteria": [
{
"slot_name": "severity",
"slot_operator": "equals",
"slot_value": "MAJOR"
},
{
"slot_name": "status",
"slot_operator": "within",
"slot_value": "[\"OPEN\"]"
}
]
}
]
}
}
}
]
}
Example: Suppression Policy
"name": "Suppression Policy",
"types": [
"SUPPRESSION"
],
"description": "Suppression Policy",
"executionOrder": 1,
"selectorCriteria": "class equals 'EVENT' AND msg contains 'server1'",
"enabled": false,
"configurations": [
{
"type": "SUPPRESSION",
"configOrder": 1,
"definition": {
"processing_action": {},
"processing_post_action": {
"new_event_post_action": "drop",
"old_event_post_action": ""
}
}
}
]
}
Example: Time-based Policy
"name": "Time Based Policy",
"types": [
"TIME_BASED"
],
"description": "Time Based Policy",
"executionOrder": 2,
"selectorCriteria": "class equals 'EVENT' AND msg contains 'server1'",
"enabled": false,
"configurations": [
{
"type": "TIME_BASED",
"configOrder": 1,
"definition": {
"label": "policy",
"children": [
{
"label": "Duration",
"children": [
{
"label": "check status and severity",
"children": [
{
"label": "Enrich Severity",
"children": [],
"type": "enrich",
"key": "$NEW.severity",
"value": "CRITICAL"
},
{
"label": "Enrich owner",
"children": [],
"type": "enrich",
"key": "$NEW.user_assigned",
"value": "Admin"
}
],
"type": "if",
"conditions": [
{
"conditionOrder": 0,
"conditionOperator": "",
"slotName": "$NEW.severity",
"slotOperator": "equals",
"slotValue": "MAJOR",
"conditionBracket": "",
"endBracket": ""
},
{
"conditionOrder": 1,
"conditionOperator": "AND",
"slotName": "$NEW.status",
"slotOperator": "equals",
"slotValue": "ASSIGNED",
"conditionBracket": "",
"endBracket": ""
}
]
},
{
"label": "",
"children": [],
"type": "else"
}
],
"type": "timeout",
"unit": "Hours",
"duration": 21600,
"key": "",
"value": ""
}
],
"type": "root"
}
}
]
}
Successful response
"message": "Created event policy",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You do not specify a policy name
{
"key": "400",
"level": "ERROR",
"message": "Name is a mandatory and cannot be null or empty.",
"additionalInfo": []
}
]
Scenario 2: You specify a slot name in the event selection criteria that is not present in the event class
{
"key": "400",
"level": "ERROR",
"message": "Invalid EventSelectorCriteria: 1 Condition value is al_parameter_name.",
"additionalInfo": []
}
]
Scenario 3: You specify an invalid value for a slot having the ENUM data type
{
"key": "400",
"level": "ERROR",
"message": "Invalid EventSelectorCriteria: 1 Invalid slotValue Minor.",
"additionalInfo": []
}
]
POST /event_policies/search
Search for event policies
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Request body
"query": "string",
"recordsPerPage": integer,
"pageIndex": integer,
"sortCriteria": "string"
}
Example request body
"query": "enabled=false and name like '%Lookup123%' and ('ADVANCED_ENRICHMENT'=ANY(TYPES) or 'BASIC_ENRICHMENT'=ANY(TYPES))",
"recordsPerPage": 25,
"pageIndex": 1,
"sortCriteria": "modificationTime desc"
}
Successful response
"totalRecords": 2,
"policies": [
{
"tenantId": "1904152611",
"id": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"name": "test all",
"types": [
"SUPPRESSION",
"TIME_BASED"
],
"description": "",
"executionOrder": 9999,
"selector": "261ab58a-30d3-11ec-b5a6-076f20873c08",
"selectorCriteria": "class equals 'EVENT'",
"owner": "admin",
"enabled": false,
"readOnly": false,
"creationTime": 1634644397766,
"modificationTime": 1634644397766,
"configurations": [
{
"tenantId": "1904152611",
"policyId": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"id": "261dc2cc-30d3-11ec-b5a6-5d980b426c68",
"type": "SUPPRESSION",
"configOrder": 1,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"processing_post_action": {
"old_event_post_action": "",
"new_event_post_action": "drop"
},
"processing_action": {}
},
"timeframeStatus": ""
},
{
"tenantId": "1904152611",
"policyId": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"id": "261dc2cd-30d3-11ec-b5a6-f1cf9e8bb3b4",
"type": "TIME_BASED",
"configOrder": 2,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"children": [
{
"duration": 1800,
"unit": "Minutes",
"children": [
{
"children": [],
"label": "enrich",
"type": "enrich",
"value": "applied",
"key": "$NEW.msg"
}
],
"label": "time",
"type": "timeout",
"value": "",
"key": ""
}
],
"label": "time based\n",
"type": "root"
},
"timeframeStatus": ""
}
]
},
{
"tenantId": "1904152611",
"id": "e3a81c55-2c00-11ec-aed2-37a037c9b426",
"name": "TestAshish",
"types": [
"NOTIFICATION"
],
"description": "",
"executionOrder": 9999,
"selector": "e2bf6a04-2c00-11ec-aed2-750996bd5bf1",
"selectorCriteria": "class equals 'ALARM' AND object_class within 'AZ'",
"owner": "admin",
"enabled": false,
"readOnly": false,
"creationTime": 1634114289767,
"modificationTime": 1634551403181,
"configurations": [
{
"tenantId": "1904152611",
"policyId": "e3a81c55-2c00-11ec-aed2-37a037c9b426",
"id": "e3ab0286-2c00-11ec-aed2-c35f90611a75",
"type": "NOTIFICATION",
"configOrder": 1,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"update_events_filter_criteria": {
"filterCriteria": [],
"eventClass": "ALARM"
},
"processing_action": {
"notificationService": "incident"
}
},
"timeframeStatus": ""
}
]
}
]
}
Unsuccessful responses
Scenario 1: You specify an invalid column name in the sort criteria
{
"key": "400",
"level": "ERROR",
"message": "Invalid column name in sort criteria",
"additionalInfo": []
}
]
Scenario 2: You misspell a column name
{
"key": "400",
"level": "ERROR",
"message": "Invalid column name nam",
"additionalInfo": []
}
]
GET /event_policies/<id>
Get an event policy by ID
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Successful responses
"policy": {
"tenantId": "1904152611",
"id": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"name": "test all",
"types": [
"SUPPRESSION",
"TIME_BASED"
],
"description": "",
"executionOrder": 9999,
"selector": "261ab58a-30d3-11ec-b5a6-076f20873c08",
"selectorCriteria": "class equals 'EVENT'",
"owner": "admin",
"enabled": false,
"readOnly": false,
"creationTime": 1634644397766,
"modificationTime": 1634644397766,
"configurations": [
{
"tenantId": "1904152611",
"policyId": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"id": "261dc2cc-30d3-11ec-b5a6-5d980b426c68",
"type": "SUPPRESSION",
"configOrder": 1,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"processing_post_action": {
"old_event_post_action": "",
"new_event_post_action": "drop"
},
"processing_action": {}
},
"timeframeStatus": ""
},
{
"tenantId": "1904152611",
"policyId": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"id": "261dc2cd-30d3-11ec-b5a6-f1cf9e8bb3b4",
"type": "TIME_BASED",
"configOrder": 2,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"children": [
{
"duration": 1800,
"unit": "Minutes",
"children": [
{
"children": [],
"label": "enrich",
"type": "enrich",
"value": "applied",
"key": "$NEW.msg"
}
],
"label": "time",
"type": "timeout",
"value": "",
"key": ""
}
],
"label": "time based\n",
"type": "root"
},
"timeframeStatus": ""
}
]
}
}
Unsuccessful response
Scenario 1: You specify an invalid policy ID format
"errorCode": 400,
"message": "Invalid id format"
}
put /event_policies/<id>
Update an event policy
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Request body
"description": "string",
"enabled": true,
"executionOrder": integer,
"selector": "string",
"selectorCriteria": "string",
"types": [
"string"
],
"configurations": [
{
"configOrder": integer,
"definition": {},
"id": "string",
"policyId": "string",
"subType": "string",
"timeframeStatus": "string",
"type": "string"
}
]
}
Example request body
"types": [
"BASIC_ENRICHMENT",
"ADVANCED_ENRICHMENT"
],
"description": "test updated",
"executionOrder": 9999,
"selector": "25bafc7f-30c3-11ec-b5a6-cfed7b409025",
"selectorCriteria": "class equals 'EVENT",
"enabled": false,
"configurations": [
{
"policyId": "25c13e10-30c3-11ec-b5a6-a94801032f38",
"id": "25c13e11-30c3-11ec-b5a6-7d177bd08a5b",
"type": "BASIC_ENRICHMENT",
"subType": "",
"configOrder": 1,
"definition": {
"processing_action": {
"severity": "CRITICAL"
}
},
"timeframeStatus": ""
},
{
"policyId": "25c13e10-30c3-11ec-b5a6-a94801032f38",
"id": "25c13e12-30c3-11ec-b5a6-bd4647d01a42",
"type": "ADVANCED_ENRICHMENT",
"configOrder": 2,
"definition": {
"children": [
{
"children": [],
"label": "var",
"type": "assignVar",
"value": "45",
"key": "$var"
}
],
"label": "test",
"type": "root"
},
"timeframeStatus": ""
}
]
}
Successful response
"message": "Updated event policy",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You specify an invalid event selection criteria
{
"key": "400",
"level": "ERROR",
"message": "Invalid EventSelectorCriteria: 1 Invalid Condition Name (msg.",
"additionalInfo": []
}
]
POST /event_policies/delete
Delete multiple event policies
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Request body
"ids": [
"string"
]
}
Example request body
"ids": [
"d6d8863c-3df8-11eb-9812-a972fa20cf57",
"d32fc78e-3558-11eb-9812-c3cbbc933af7"
]
}
Successful response
"message": "Deleted event policies",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You specify a policy ID that does not exist
"status": "207",
"succeeded": [
"696447ff-008d-4ef7-a417-2c506abad552"
],
"failed": [
{
"id": "696447ff-008d-4ef7-a417-2c506abad552",
"message": "Failed to delete event policies, entry doesn't exist in database]"
}
]
}
Scenario 2: You specify an invalid policy ID
{
"key": "400",
"level": "ERROR",
"message": "Bad Request : Invalid resource id specified: 11",
"additionalInfo": []
}
]
post /event_policies/enable
Enable multiple event policies
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Request body
"ids": [
"string"
]
}
Example request body
"ids": [
"d6d8863c-3df8-11eb-9812-a972fa20cf57",
"d32fc78e-3558-11eb-9812-c3cbbc933af7"
]
}
Successful response
"message": "Enabled event policies",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You do not specify a policy ID
{
"key": "400",
"level": "ERROR",
"message": "Bad Request : Property is null or empty : resources",
"additionalInfo": []
}
]
Scenario 2: You specify an invalid policy ID
{
"key": "400",
"level": "ERROR",
"message": "Bad Request : Invalid resource id specified: 11",
"additionalInfo": []
}
]
post /event_policies/disable
Disable multiple event policies
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Request body
"ids": [
"string"
]
}
Example request body
"ids": [
"d6d8863c-3df8-11eb-9812-a972fa20cf57",
"d32fc78e-3558-11eb-9812-c3cbbc933af7"
]
}
Successful response
"message": "Disabled event policies",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You do not specify a policy ID
{
"key": "400",
"level": "ERROR",
"message": "Bad Request : Property is null or empty : resources",
"additionalInfo": []
}
]
Scenario 2: You specify an invalid policy ID
{
"key": "400",
"level": "ERROR",
"message": "Bad Request : Invalid resource id specified: 11",
"additionalInfo": []
}
]