Event policy management endpoints in the REST API
The following section provides a list of supported endpoints and an overview about running these endpoints. Before you run an endpoint, you must authenticate yourself. For more information, see Access and authentication for the REST API
Event policies
You can create, update, delete, retrieve, search, enable, and disable event policies by using REST APIs.
POST /event_policies
Create an event policy
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Parameter name | Value type | Located in | Mandatory | Description |
|---|---|---|---|---|
name | String | Body | Yes | The policy name. This value cannot be empty or null. |
description | String | Body | No | The policy description |
executionOrder | Integer | Body | Yes | The policy precedence Valid values: 0-9999 |
enabled | Boolean | Body | No | The option to enable the policy |
selectorCriteria | String | Body | Yes | The event selection criteria. The slot operator used in the criteria must be as per the data type of the slot. The value for slots, which have the date data type must be a timestamp value. |
selectorCriteriaList | String array | Body | Yes | The event selection criteria. Use this attribute to specify multiple classes in the event selection criteria. We recommend that you use the selectorCriteriaList attribute instead of the selectorCriteria attribute to specify the event selection criteria. If you specify values in both selectorCriteria and selectorCriteriaList, values in selectorCriteriaList are given preference. |
types | String array | Body | Yes | The policy type. This value cannot be empty or null. Valid values:
|
configurations | Array | Body | Yes | The policy configurations. This value cannot be empty or null. You cannot add multiple configurations for refinement, suppression or time-based policies. |
configOrder | Integer | Body | Yes | The order of configurations. This value must uniquely identify the list of policy configurations. |
definition | Object | Body | Yes | The policy definition |
type | String | Body | Yes | The policy type. This value cannot be empty or null. The value specified for this parameter in the list of policy configurations must be present in the policy types list. Valid values:
|
subType | String | Body | No | The policy sub type For example, dynamic enrichment is a subtype of an advanced enrichment policy. |
timeframeStatus | String | Body | No | The time frame status |
Request body
Single class in the event selection criteria of a single event policy
"name": "string",
"description": "string",
"executionOrder": integer,
"enabled": true,
"selectorCriteria": "string",
"types": [
"string"
],
"configurations": [
{
"configOrder": integer,
"definition": {},
"timeframeStatus": "string",
"type": "string",
"subType": "string"
}
]
}
Multiple classes in the event selection criteria of a single event policy
"name": "string",
"description": "string",
"executionOrder": 0,
"enabled": true,
"selectorCriteriaList": "string array",
"types": [
"string"
],
"configurations": [
{
"configOrder": 0,
"definition": {},
"timeframeStatus": "string",
"type": "string",
"subType": "string"
}
]
}
Example request body
Example: Refinement Policy
"name": "RefinePolicyEnrichHost",
"description": "TestingRefinePolicy",
"enabled": true,
"executionOrder": 247,
"types": [
"REFINE"
],
"configurations": [
{
"eventClass": null,
"type": "REFINE",
"configOrder": 1,
"definition": {
"type": "root",
"label": "refine",
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.status",
"value": "BLACKOUT",
"label": "enrich_label"
},
{
"children": [],
"type": "enrich",
"key": "$NEW.severity",
"value": "CRITICAL",
"label": "enrich_label"
},
{
"children": [],
"type": "enrich",
"key": "$NEW.source_hostname",
"value": "clm-pun-t8x5j7.bmc.com",
"label": "enrich_label"
}
]
}
}
],
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
]
}
Example: Basic Enrichment Policy
"name": "basic enrichment Policy",
"types": [
"BASIC_ENRICHMENT"
],
"description": "basic enrichment Policy",
"executionOrder": 9999,
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"enabled": false,
"configurations": [
{
"type": "BASIC_ENRICHMENT",
"configOrder": 1,
"definition": {
"processing_action": {
"category": "SLA_MANAGEMENT",
"priority": "PRIORITY_5",
"severity": "CRITICAL",
"location": "Pune ",
"msg": "policy for location %location%"
}
}
}
]
}
Example: Advanced Enrichment Policy
"name": "Advanced Enrichment Policy",
"types": [
"ADVANCED_ENRICHMENT"
],
"description": "Advanced Enrichment Policy",
"executionOrder": 837,
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"configurations": [
{
"type": "ADVANCED_ENRICHMENT",
"configOrder": 1,
"definition": {
"children": [
{
"type": "enrich",
"key": "$NEW.cdmclass",
"label": "cdmclass enrich",
"children": [
{
"children": [],
"type": "data",
"value": "$NEW.al_parameter_name"
}
]
},
{
"type": "if",
"label": "if outer",
"conditions": [
{
"slotName": "$NEW.al_parameter_threshold",
"slotOperator": "contains",
"conditionOrder": 0,
"conditionOperator": "",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "fLdxHe"
},
{
"slotName": "$NEW.status",
"slotOperator": "equals",
"conditionOrder": 1,
"conditionOperator": "AND",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "OPEN"
}
],
"children": [
{
"children": [],
"type": "enrich",
"value": "ACK",
"key": "$NEW.status",
"label": "enrich status"
},
{
"type": "if",
"label": "if inner",
"conditions": [
{
"slotName": "$NEW.severity",
"slotOperator": "greater_than",
"conditionOrder": 0,
"conditionOperator": "",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "MINOR"
},
{
"slotName": "$NEW.location",
"slotOperator": "contains",
"conditionOrder": 1,
"conditionOperator": "AND",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "tI749vH3"
}
],
"children": [
{
"children": [
{
"children": [
{
"children": [],
"type": "data",
"value": "$NEW.msg"
},
{
"children": [],
"type": "data",
"value": "if_if_then_criteria_matched"
}
],
"name": "Concat",
"type": "function"
}
],
"type": "enrich",
"value": null,
"key": "$NEW.msg",
"label": "enrich message "
},
{
"children": [],
"type": "enrich",
"value": "PRIORITY_1",
"key": "$NEW.priority",
"label": "enrich priority"
}
]
},
{
"type": "else",
"label": "inner else",
"children": [
{
"children": [
{
"children": [
{
"children": [],
"type": "data",
"value": "$NEW.msg"
},
{
"children": [],
"type": "data",
"value": "if_if_else_criteria_matched"
}
],
"name": "Concat",
"type": "function"
}
],
"type": "enrich",
"value": null,
"key": "$NEW.msg",
"label": "enrich message inner"
},
{
"children": [],
"type": "enrich",
"value": "PRIORITY_4",
"key": "$NEW.priority",
"label": "enrich priority inner"
}
]
}
]
},
{
"type": "else",
"label": "else outer",
"children": [
{
"type": "if",
"label": "else if inner",
"conditions": [
{
"slotName": "$NEW.priority",
"slotOperator": "greater_than",
"conditionOrder": 0,
"conditionOperator": "",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "PRIORITY_3"
},
{
"slotName": "$NEW.source_address",
"slotOperator": "contains",
"conditionOrder": 1,
"conditionOperator": "AND",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "bmc.com"
}
],
"children": [
{
"label": " enrich severity in outer else if",
"children": [],
"type": "enrich",
"value": "CRITICAL",
"key": "$NEW.severity"
}
]
},
{
"type": "else",
"label": "else else inner",
"children": [
{
"children": [],
"type": "enrich",
"value": "MINOR",
"key": "$NEW.severity",
"label": "enrich severity else"
}
]
}
]
}
],
"type": "root",
"label": "policy"
}
}
]
}
Example: Dynamic Enrichment Policy
"name": "Dynamic Enrichment Policy Test",
"description": "CXUDvqPwrx",
"enabled": true,
"executionOrder": 594,
"types": [
"ADVANCED_ENRICHMENT"
],
"configurations": [
{
"type": "ADVANCED_ENRICHMENT",
"subType": "DYNAMIC_ENRICHMENT",
"configOrder": 1,
"definition": {
"type": "root",
"label": "root_label",
"children": [
{
"type": "dynamicDataEnrichment",
"fieldSeparator": ",",
"matchTableID": "21de6df5-6c88-11ec-8a0d-9566b475af32",
"matchTableCount": "4",
"matchFields": [
"status",
"severity"
],
"matchPreference": "First",
"enrichFields": [
"msg",
"location"
],
"labels": {
"enrichFields": "Enrich",
"matchFields": "Match1",
"importData": "Import1"
}
}
]
}
}
],
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
]
}
matchTableID is the ID of the data table returned by the create data table endpoint.
To learn how to create a data table in a dynamic enrichment policy, see the POST/data_tables endpoint on the Dynamic-enrichment-policy-data-table-management-endpoints-in-the-REST-API page.
Example: Correlation Policy
"name": "Correlation Policy",
"types": [
"CORRELATION"
],
"description": "Correlation Policy",
"executionOrder": 3,
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"enabled": true,
"configurations": [
{
"type": "CORRELATION",
"configOrder": 1,
"definition": {
"children": [
{
"newEvent": {
"severity": "MAJOR",
"msg": "Policy Updated %msg%",
"location": "",
"priority": "PRIORITY_5",
"newEventClass": "ALARM",
"status": "OPEN"
},
"children": [],
"within": 15,
"minCount": 3,
"label": "",
"type": "aggregate",
"conditions": [
{
"slotName": "$NEW.msg",
"slotOperator": "equals",
"conditionOrder": 0,
"conditionOperator": "",
"conditionBracket": "(",
"endBracket": ")",
"slotValue": "$OLD.msg"
}
]
}
],
"label": "policy",
"type": "root"
}
}
]
}
You can specify a correlation duration ranging from 2 minutes to 720 minutes for the within attribute and a maximum of 100 events for the minCount attribute.
Example: Incident Notification Policy
"name": "Incident Notification Policy",
"types": [
"NOTIFICATION"
],
"description": "Incident Notification Policy",
"executionOrder": 1,
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"enabled": false,
"configurations": [
{
"type": "NOTIFICATION",
"configOrder": 1,
"definition": {
"processing_action": {
"notificationService": "incident"
}
}
}
]
}
Example: Email Notification Policy
"name": "Email Notification Policy",
"description": "Email Notification Policy",
"enabled": true,
"executionOrder": 9999,
"types": [
"NOTIFICATION"
],
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"configurations": [
{
"type": "NOTIFICATION",
"configOrder": 1,
"definition": {
"processing_action": {
"notificationService": "email",
"emailFrom": "",
"emailTo": "atech@test.com",
"emailSubject": "Notification Policy with severity %severity%",
"emailBody": "Automating Notification Policy where message is %msg%",
"autoAck": "false"
},
"update_events_filter_criteria": {
"eventClass": "ALARM,PATROL_EV",
"filterCriteria": [
{
"key": "when",
"criteria": [
{
"slot_name": "severity",
"slot_operator": "equals",
"slot_value": "CRITICAL"
},
{
"slot_name": "status",
"slot_operator": "within",
"slot_value": "[\"OPEN\"]"
}
]
}
]
}
}
}
],
"timeframes": [
"-1"
]
}
The system adds the classes that you specify in the selectorCriteriaList parameter to the eventClass attribute of the update_events_filter_criteria parameter as shown in the preceding payload.
You can specify static text, slot placeholders (%<slotname>%), and global variables in the following attributes:
- emailTo
- emailSubject
- emailBody
Example: Suppression Policy
"name": "Suppression Policy",
"types": [
"SUPPRESSION"
],
"description": "Suppression Policy",
"executionOrder": 1,
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"enabled": false,
"configurations": [
{
"type": "SUPPRESSION",
"configOrder": 1,
"definition": {
"processing_action": {},
"processing_post_action": {
"new_event_post_action": "drop",
"old_event_post_action": ""
}
}
}
]
}
Example: Time-based Policy
For a time-based policy, specify the duration attribute as a String value. You can specify the duration in one of the following ways:
- Static value
- Event slot
- Global variable
For example,
- "duration": "1800" (Static value)
- "duration": "$NEW.cust_duration" (Custom event slot)
- "duration": "$GV.time_reference.duration" (Global variable)
Single time-based policy configuration
"name": "Time Based Policy",
"types": [
"TIME_BASED"
],
"description": "Time Based Policy",
"executionOrder": 2,
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"enabled": false,
"configurations": [
{
"type": "TIME_BASED",
"configOrder": 1,
"definition": {
"label": "policy",
"children": [
{
"label": "Duration",
"children": [
{
"label": "check status and severity",
"children": [
{
"label": "Enrich Severity",
"children": [],
"type": "enrich",
"key": "$NEW.severity",
"value": "CRITICAL"
},
{
"label": "Enrich owner",
"children": [],
"type": "enrich",
"key": "$NEW.user_assigned",
"value": "Admin"
}
],
"type": "if",
"conditions": [
{
"conditionOrder": 0,
"conditionOperator": "",
"slotName": "$NEW.severity",
"slotOperator": "equals",
"slotValue": "MAJOR",
"conditionBracket": "",
"endBracket": ""
},
{
"conditionOrder": 1,
"conditionOperator": "AND",
"slotName": "$NEW.status",
"slotOperator": "equals",
"slotValue": "ASSIGNED",
"conditionBracket": "",
"endBracket": ""
}
]
},
{
"label": "",
"children": [],
"type": "else"
}
],
"type": "timeout",
"unit": "Seconds",
"duration": "1800",
"key": "",
"value": ""
}
],
"type": "root"
}
}
]
}
Multiple time-based policy configurations
"name": "Multiple time-based policy configurations",
"description": "Multiple time-based policy configurations",
"enabled": true,
"executionOrder": 273,
"timeframes": [
"-1"
],
"types": [
"TIME_BASED"
],
"configurations": [
{
"type": "TIME_BASED",
"configOrder": 1,
"definition": {
"type": "root",
"label": "root_label",
"children": [
{
"type": "timeout",
"label": "timeout condition",
"duration": 1,
"unit": "Minutes",
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.severity",
"value": "CRITICAL",
"label": "Enrich Severity"
}
]
}
]
}
},
{
"type": "TIME_BASED",
"configOrder": 2,
"definition": {
"type": "root",
"label": "root_label",
"children": [
{
"type": "timeout",
"label": "timeout condition",
"duration": 5,
"unit": "Minutes",
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.user_assigned",
"value": "Admin",
"label": "Enrich owner"
}
]
}
]
}
}
],
"selectorCriteriaList": [
"( msg contains 'CPU utilization exceeds 85%' )"
]
}
Example: Specifying multiple classes in the event selection criteria
"name": "enrich multiple class events",
"description": "DuHIMNKaKu",
"enabled": true,
"executionOrder": 433,
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"timeframes": [
"-1"
],
"types": [
"ADVANCED_ENRICHMENT"
],
"configurations": [
{
"eventClass": null,
"type": "ADVANCED_ENRICHMENT",
"configOrder": 1,
"definition": {
"type": "root",
"label": "root_label",
"children": [
{
"type": "enrich",
"key": "$NEW.cdmclass",
"value": null,
"children": [
{
"children": [],
"type": "data",
"value": "$NEW.al_parameter_name"
}
],
"label": "enrich_label"
},
{
"type": "if",
"conditions": [
{
"conditionOrder": 0,
"conditionOperator": "",
"slotName": "$NEW.al_parameter_threshold",
"slotOperator": "contains",
"slotValue": "MCzXdU",
"conditionBracket": "(",
"endBracket": ")"
},
{
"conditionOrder": 1,
"conditionOperator": "AND",
"slotName": "$NEW.status",
"slotOperator": "equals",
"slotValue": "OPEN",
"conditionBracket": "(",
"endBracket": ")"
}
],
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.status",
"value": "ACK",
"label": "enrich_label"
},
{
"type": "if",
"conditions": [
{
"conditionOrder": 0,
"conditionOperator": "",
"slotName": "$NEW.severity",
"slotOperator": "greater_than",
"slotValue": "MINOR",
"conditionBracket": "(",
"endBracket": ")"
},
{
"conditionOrder": 1,
"conditionOperator": "AND",
"slotName": "$NEW.location",
"slotOperator": "contains",
"slotValue": "NJy0abvT",
"conditionBracket": "(",
"endBracket": ")"
}
],
"children": [
{
"type": "enrich",
"key": "$NEW.msg",
"value": null,
"children": [
{
"type": "function",
"name": "Concat",
"children": [
{
"type": "data",
"value": "$NEW.msg",
"children": []
},
{
"type": "data",
"value": "if_if_then_criteria_matched",
"children": []
}
]
}
],
"label": "enrich_label"
},
{
"children": [],
"type": "enrich",
"key": "$NEW.priority",
"value": "PRIORITY_1",
"label": "enrich_label"
}
],
"label": "if_label"
},
{
"type": "else",
"children": [
{
"type": "enrich",
"key": "$NEW.msg",
"value": null,
"children": [
{
"type": "function",
"name": "Concat",
"children": [
{
"type": "data",
"value": "$NEW.msg",
"children": []
},
{
"type": "data",
"value": "if_if_else_criteria_matched",
"children": []
}
]
}
],
"label": "enrich_label"
},
{
"children": [],
"type": "enrich",
"key": "$NEW.priority",
"value": "PRIORITY_4",
"label": "enrich_label"
}
],
"label": "else_label"
}
],
"label": "if_label"
},
{
"type": "else",
"children": [
{
"type": "if",
"conditions": [
{
"conditionOrder": 0,
"conditionOperator": "",
"slotName": "$NEW.priority",
"slotOperator": "greater_than",
"slotValue": "PRIORITY_3",
"conditionBracket": "(",
"endBracket": ")"
},
{
"conditionOrder": 1,
"conditionOperator": "AND",
"slotName": "$NEW.source_address",
"slotOperator": "contains",
"slotValue": "bmc.com",
"conditionBracket": "(",
"endBracket": ")"
}
],
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.severity",
"value": "CRITICAL",
"label": "enrich_label"
}
],
"label": "if_label"
},
{
"type": "else",
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.severity",
"value": "MINOR",
"label": "enrich_label"
}
],
"label": "else_label"
}
],
"label": "else_label"
}
]
}
}
]
}
In this request, multiple classes are specified in the selectorCriteriaList parameter.
Successful response
"message": "Created event policy",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You do not specify a policy name.
{
"key": "400",
"level": "ERROR",
"message": "Name is a mandatory and cannot be null or empty.",
"additionalInfo": []
}
]
Scenario 2: You specify a slot name in the event selection criteria that is not present in the event class.
{
"key": "400",
"level": "ERROR",
"message": "Invalid EventSelectorCriteria: 1 Condition value is al_parameter_name.",
"additionalInfo": []
}
]
Scenario 3: You specify an invalid value for a slot having the ENUM data type.
{
"key": "400",
"level": "ERROR",
"message": "Invalid EventSelectorCriteria: 1 Invalid slotValue Minor.",
"additionalInfo": []
}
]
Scenario 4: You specify an invalid key in the enrich node definition for the configurations attribute.
Example 1
{
"key": "400",
"level": "ERROR",
"message": "Invalid key $NEW.source_port in enrich definition.$NEW.source_port can not be enriched.",
"additionalInfo": []
}
]
Example 2
{
"key": "400",
"level": "ERROR",
"message": "Invalid key $NEW.al_device_ipaddress in enrich definition.",
"additionalInfo": []
}
]
Scenario 5: You specify an invalid definition type for the configurations attribute.
{
"key": "400",
"level": "ERROR",
"message": "Invalid type in Refine definition.Expected type is 'root'.",
"additionalInfo": []
}
]
Scenario 6: You do not specify a definition label for the configurations attribute.
{
"key": "400",
"level": "ERROR",
"message": "label is mandatory in REFINE definition and cannot be null or empty.",
"additionalInfo": []
}
]
Scenario 7: You include the else definition without the if definition for the configurations attribute.
{
"key": "400",
"level": "ERROR",
"message": "Invalid type else without any if definition.",
"additionalInfo": []
}
]
Scenario 8: You specify an invalid type for the enrich node in the if definition for the configurations attribute.
{
"key": "400",
"level": "ERROR",
"message": "Invalid type enrich1 in if definition.",
"additionalInfo": []
}
]
Scenario 9: You specify a policy name that already exists.
{
"key": "POLICY_ALREADY_EXIST",
"level": "ERROR",
"message": "[Failed to create event policy, entry with same name already exists]",
"additionalInfo": [
[]
]
}
]
Scenario 10: The number of classes that you specify in the event selection criteria exceeds the maximum class limit.
{
"key": "400",
"level": "ERROR",
"message": "Maximum event selection criteria allowed is 5",
"additionalInfo": []
}
]
Scenario 11: You specify an event slot in the policy configuration that does not belong to any of the classes that you specified in the event selection criteria.
{
"key": "400",
"level": "ERROR",
"message": "Invalid value $NEW.custom_class_slot_1 in data definition.",
"additionalInfo": []
}
]
Scenario 12:
You specify | You do not specify |
|---|---|
The same duration value for multiple time-based policy configurations. | The duration for multiple time-based policy configurations in increasing order. |
{
"key": "INVALID_TIME_OUT_CONFIG_ORDER",
"level": "ERROR",
"message": "The duration order of the time-based policy configurations must be incremental.",
"additionalInfo": []
}
]
Scenario 13: The duration gap between two time-based policy configurations is less than two minutes.
{
"key": "INVALID_TIME_OUT_MIN_GAP",
"level": "ERROR",
"message": "The minimum duration gap between two time-based policy configurations must be 2 minutes.",
"additionalInfo": []
}
]
Scenario 14: You specify configurations that exceed the maximum limit of time-based policy configurations.
{
"key": "INVALID_TIME_OUT_POLICY_DEFINITION",
"level": "ERROR",
"message": "A maximum of 3 time-based policy configurations are allowed.",
"additionalInfo": []
}
]
Scenario 15: You specify a duration that exceeds the maximum duration limit.
{
"key": "INVALID_TIME_OUT_POLICY_DEFINITION",
"level": "ERROR",
"message": "Invalid key 10000000000 in timeout definition.",
"additionalInfo": []
}
]
POST /event_policies/search
Search for event policies
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Parameter name | Value type | Located in | Mandatory | Description |
|---|---|---|---|---|
query | String | Body | No | The conditions for searching the policy. You can specify the query conditions by using the following operators:
You can use a single column or a combination of the following columns to search a policy:
You can use the ANY operator in the query condition to compare a value to a set of values returned by a subquery. For example, 'ADVANCED_ENRICHMENT'=ANY(TYPES), here TYPES can have the following values:
|
recordsPerPage | Integer | Body | No | The number of search results on every page |
pageIndex | Integer | Body | No | The page index. The value for the index starts with 1. This parameter supports pagination. For example, There are a total of 50 records and the records listed on the first page are 25. To view records on the next page, specify the pageIndex as 2. |
sortCriteria | String | Body | No | The criteria to sort the event policies. You can use a single column or a combination of the following columns to sort policies:
|
Request body
"query": "string",
"recordsPerPage": integer,
"pageIndex": integer,
"sortCriteria": "string"
}
Example request body
"query": "enabled=false and name like '%Lookup123%' and ('ADVANCED_ENRICHMENT'=ANY(TYPES) or 'BASIC_ENRICHMENT'=ANY(TYPES))",
"recordsPerPage": 25,
"pageIndex": 1,
"sortCriteria": "modificationTime desc"
}
Successful response
"totalRecords": 2,
"policies": [
{
"tenantId": "1904152611",
"id": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"name": "test all",
"types": [
"SUPPRESSION",
"TIME_BASED"
],
"description": "",
"executionOrder": 9999,
"selector": "261ab58a-30d3-11ec-b5a6-076f20873c08",
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"owner": "admin",
"enabled": false,
"readOnly": false,
"creationTime": 1634644397766,
"modificationTime": 1634644397766,
"configurations": [
{
"tenantId": "1904152611",
"policyId": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"id": "261dc2cc-30d3-11ec-b5a6-5d980b426c68",
"type": "SUPPRESSION",
"configOrder": 1,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"processing_post_action": {
"old_event_post_action": "",
"new_event_post_action": "drop"
},
"processing_action": {}
},
"timeframeStatus": ""
},
{
"tenantId": "1904152611",
"policyId": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"id": "261dc2cd-30d3-11ec-b5a6-f1cf9e8bb3b4",
"type": "TIME_BASED",
"configOrder": 2,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"children": [
{
"duration": 1800,
"unit": "Minutes",
"children": [
{
"children": [],
"label": "enrich",
"type": "enrich",
"value": "applied",
"key": "$NEW.msg"
}
],
"label": "time",
"type": "timeout",
"value": "",
"key": ""
}
],
"label": "time based\n",
"type": "root"
},
"timeframeStatus": ""
}
]
},
{
"tenantId": "1904152611",
"id": "e3a81c55-2c00-11ec-aed2-37a037c9b426",
"name": "TestAshish",
"types": [
"NOTIFICATION"
],
"description": "",
"executionOrder": 9999,
"selector": "e2bf6a04-2c00-11ec-aed2-750996bd5bf1",
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"owner": "admin",
"enabled": false,
"readOnly": false,
"creationTime": 1634114289767,
"modificationTime": 1634551403181,
"configurations": [
{
"tenantId": "1904152611",
"policyId": "e3a81c55-2c00-11ec-aed2-37a037c9b426",
"id": "e3ab0286-2c00-11ec-aed2-c35f90611a75",
"type": "NOTIFICATION",
"configOrder": 1,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"processing_action": {
"notificationService": "incident"
}
},
"timeframeStatus": ""
}
]
}
]
}
Unsuccessful responses
Scenario 1: You specify an invalid column name in the sort criteria
{
"key": "400",
"level": "ERROR",
"message": "Invalid column name in sort criteria",
"additionalInfo": []
}
]
Scenario 2: You misspell a column name
{
"key": "400",
"level": "ERROR",
"message": "Invalid column name nam",
"additionalInfo": []
}
]
GET /event_policies/<id>
Get an event policy by ID
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Parameter name | Value type | Located in | Mandatory | Description |
|---|---|---|---|---|
id | String | Path | Yes | The event policy ID for which you want to retrieve the policy details. |
Successful responses
Successful response: Example 1
"policy": {
"tenantId": "1904152611",
"id": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"name": "test all",
"types": [
"SUPPRESSION",
"TIME_BASED"
],
"description": "",
"executionOrder": 9999,
"selector": "261ab58a-30d3-11ec-b5a6-076f20873c08",
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"owner": "admin",
"enabled": false,
"readOnly": false,
"creationTime": 1634644397766,
"modificationTime": 1634644397766,
"configurations": [
{
"tenantId": "1904152611",
"policyId": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"id": "261dc2cc-30d3-11ec-b5a6-5d980b426c68",
"type": "SUPPRESSION",
"configOrder": 1,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"processing_post_action": {
"old_event_post_action": "",
"new_event_post_action": "drop"
},
"processing_action": {}
},
"timeframeStatus": ""
},
{
"tenantId": "1904152611",
"policyId": "261dc2cb-30d3-11ec-b5a6-8b5aa8089475",
"id": "261dc2cd-30d3-11ec-b5a6-f1cf9e8bb3b4",
"type": "TIME_BASED",
"configOrder": 2,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"children": [
{
"duration": 1800,
"unit": "Minutes",
"children": [
{
"children": [],
"label": "enrich",
"type": "enrich",
"value": "applied",
"key": "$NEW.msg"
}
],
"label": "time",
"type": "timeout",
"value": "",
"key": ""
}
],
"label": "time based\n",
"type": "root"
},
"timeframeStatus": ""
}
]
}
}
Successful response: Example 2
"policy": {
"tenantId": "1938340890",
"id": "ff921989-9497-11ec-ab01-23d7965a32bd",
"name": "TestingRefinePolicy_122",
"types": [
"REFINE"
],
"description": "TestingRefinePolicy",
"executionOrder": 247,
"selector": "ff8e21e8-9497-11ec-ab01-ff2eda71b91a",
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"timeframes": [],
"owner": "admin",
"enabled": false,
"readOnly": false,
"creationTime": 1645614109040,
"modificationTime": 1646389197165,
"configurations": [
{
"tenantId": "1938340890",
"policyId": "ff921989-9497-11ec-ab01-23d7965a32bd",
"id": "a4173a3d-9ba4-11ec-b548-f1309743dcd6",
"type": "REFINE",
"subType": "",
"configOrder": 1,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"children": [
{
"children": [],
"label": "enrich_label",
"type": "enrich",
"value": "BLACKOUT",
"key": "$NEW.status"
},
{
"children": [],
"label": "enrich_label",
"type": "enrich",
"value": "CRITICAL",
"key": "$NEW.severity"
},
{
"children": [],
"label": "enrich_label",
"type": "enrich",
"value": "clom",
"key": "$NEW.source_address"
}
],
"label": "refine",
"type": "root"
},
"timeframeStatus": ""
}
]
}
}
Successful response: Example 3 (event policy with multiple classes in the event selection criteria)
"policy": {
"tenantId": "1003829062",
"id": "c4c23906-85de-11ed-89ad-81736aa2607a",
"name": "enrich multiple class events1",
"types": [
"ADVANCED_ENRICHMENT"
],
"description": "DuHIMNKaKu",
"executionOrder": 433,
"selector": "c4bfa0f5-85de-11ed-89ad-35cc0051cc0a",
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"owner": "admin",
"enabled": true,
"readOnly": false,
"creationTime": 1672142734867,
"modificationTime": 1672142812565,
"configurations": [
{
"tenantId": "1003829062",
"policyId": "c4c23906-85de-11ed-89ad-81736aa2607a",
"id": "f3113bd9-85de-11ed-89ad-3564cd4f3d4b",
"type": "ADVANCED_ENRICHMENT",
"configOrder": 1,
"creationTime": 0,
"modificationTime": 0,
"definition": {
"children": [
{
"children": [
{
"showDescription": false,
"children": [],
"valueType": null,
"placeholderText": null,
"label": null,
"id": null,
"type": "data",
"value": "$NEW.al_parameter_name"
}
],
"label": "enrich_label",
"id": null,
"type": "enrich",
"value": null,
"key": "$NEW.cdmclass"
},
{
"children": [
{
"children": [],
"label": "enrich_label",
"id": null,
"type": "enrich",
"value": "ACK",
"key": "$NEW.status"
},
{
"children": [
{
"children": [
{
"children": [
{
"showDescription": false,
"children": [],
"valueType": null,
"placeholderText": null,
"label": null,
"id": null,
"type": "data",
"value": "$NEW.msg"
},
{
"showDescription": false,
"children": [],
"valueType": null,
"placeholderText": null,
"label": null,
"id": null,
"type": "data",
"value": "if_if_then_criteria_matched"
}
],
"name": "Concat",
"label": null,
"id": null,
"type": "function"
}
],
"label": "enrich_label",
"id": null,
"type": "enrich",
"value": null,
"key": "$NEW.msg"
},
{
"children": [],
"label": "enrich_label",
"id": null,
"type": "enrich",
"value": "PRIORITY_1",
"key": "$NEW.priority"
}
],
"label": "if_label",
"id": null,
"type": "if",
"conditions": [
{
"slotName": "$NEW.severity",
"slotOperator": "greater_than",
"conditionOperator": "",
"conditionBracket": "(",
"conditionOrder": 0,
"endBracket": ")",
"slotValue": "MINOR"
},
{
"slotName": "$NEW.location",
"slotOperator": "contains",
"conditionOperator": "AND",
"conditionBracket": "(",
"conditionOrder": 1,
"endBracket": ")",
"slotValue": "NJy0abvT"
}
]
},
{
"children": [
{
"children": [
{
"children": [
{
"showDescription": false,
"children": [],
"valueType": null,
"placeholderText": null,
"label": null,
"id": null,
"type": "data",
"value": "$NEW.msg"
},
{
"showDescription": false,
"children": [],
"valueType": null,
"placeholderText": null,
"label": null,
"id": null,
"type": "data",
"value": "if_if_else_criteria_matched"
}
],
"name": "Concat",
"label": null,
"id": null,
"type": "function"
}
],
"label": "enrich_label",
"id": null,
"type": "enrich",
"value": null,
"key": "$NEW.msg"
},
{
"children": [],
"label": "enrich_label",
"id": null,
"type": "enrich",
"value": "PRIORITY_4",
"key": "$NEW.priority"
}
],
"label": "else_label",
"id": null,
"type": "else"
}
],
"label": "if_label",
"id": null,
"type": "if",
"conditions": [
{
"slotName": "$NEW.al_parameter_threshold",
"slotOperator": "contains",
"conditionOperator": "",
"conditionBracket": "(",
"conditionOrder": 0,
"endBracket": ")",
"slotValue": "MCzXdU"
},
{
"slotName": "$NEW.status",
"slotOperator": "equals",
"conditionOperator": "AND",
"conditionBracket": "(",
"conditionOrder": 1,
"endBracket": ")",
"slotValue": "OPEN"
}
]
},
{
"children": [
{
"children": [
{
"children": [],
"label": "enrich_label",
"id": null,
"type": "enrich",
"value": "CRITICAL",
"key": "$NEW.severity"
}
],
"label": "if_label",
"id": null,
"type": "if",
"conditions": [
{
"slotName": "$NEW.priority",
"slotOperator": "greater_than",
"conditionOperator": "",
"conditionBracket": "(",
"conditionOrder": 0,
"endBracket": ")",
"slotValue": "PRIORITY_3"
},
{
"slotName": "$NEW.source_address",
"slotOperator": "contains",
"conditionOperator": "AND",
"conditionBracket": "(",
"conditionOrder": 1,
"endBracket": ")",
"slotValue": "bmc.com"
}
]
},
{
"children": [
{
"children": [],
"label": "enrich_label",
"id": null,
"type": "enrich",
"value": "MINOR",
"key": "$NEW.severity"
}
],
"label": "else_label",
"id": null,
"type": "else"
}
],
"label": "else_label",
"id": null,
"type": "else"
}
],
"id": null,
"label": "root_label",
"type": "root"
},
"timeframeStatus": "",
"subType": ""
}
],
"timeframes": [
"-1"
],
"timeframe_state": []
}
}
The selectorCriteriaList parameter returns the multiple classes specified in the event selection criteria of an event policy.
Unsuccessful responses
Scenario 1: You specify an invalid policy ID format.
A valid policy ID does not exceed 36 characters. For example, 41f046ff-25ca-11ec-aa29-31654db26e83
"errorCode": 400,
"message": "Invalid id format"
}
Scenario 2: You specify a policy ID that does not exist.
{
"key": "Not Found",
"level": "ERROR",
"message": "No policy found matching input request!",
"additionalInfo": null
}
]
put /event_policies/<id>
Update an event policy
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Parameter name | Value type | Located in | Mandatory | Description |
|---|---|---|---|---|
id | String | Path | Yes | The event policy ID |
description | String | Body | No | The policy description |
executionOrder | Integer | Body | Yes | The policy precedence Valid values: 0-9999 |
enabled | Boolean | Body | No | The option to enable the policy |
selectorCriteria | String | Body | Yes | The event selection criteria. The slot operator used in the criteria must be as per the data type of the slot. The value for slots, which have the date data type must be a timestamp value. |
selectorCriteriaList | String array | Body | Yes | The event selection criteria. Use this attribute to specify multiple classes in the event selection criteria. We recommend that you use the selectorCriteriaList attribute instead of the selectorCriteria attribute to specify the event selection criteria. If you specify values in both selectorCriteria and selectorCriteriaList, values in selectorCriteriaList are given preference. |
types | String array | Body | Yes | The policy type. This value cannot be empty or null. Valid values:
|
configurations | Array | Body | Yes | The policy configurations. This value cannot be empty or null. You cannot add multiple configurations for refinement, suppression, or time-based policies. |
configOrder | Integer | Body | Yes | The order of configurations. This value must uniquely identify the list of policy configurations. |
policyId | String | Body | No | The event policy ID |
id | String | Body | No | The configuration ID for the policy |
definition | Object | Body | Yes | The policy definition |
type | String | Body | Yes | The policy type. This value cannot be empty or null. Valid values:
|
subType | String | Body | No | The policy sub type For example, dynamic enrichment is a subtype of an advanced enrichment policy. |
timeframeStatus | String | Body | No | The time frame status |
Request body
Single class in the event selection criteria
"description": "string",
"enabled": "boolean",
"executionOrder": "integer",
"selectorCriteria": "string",
"types": [
"string"
],
"configurations": [
{
"configOrder": "integer",
"definition": {},
"id": "string",
"policyId": "string",
"subType": "string",
"timeframeStatus": "string",
"type": "string"
}
]
}
Multiple classes in the event selection criteria
"enabled": true,
"executionOrder": 0,
"selector": "string",
"selectorCriteriaList": "string",
"timeframes": [
"string"
],
"types": [
"string"
],
"configurations": [
{
"configOrder": 0,
"definition": {},
"id": "string",
"policyId": "string",
"subType": "string",
"timeframeStatus": "string",
"type": "string"
}
]
}
Example request body
Example 1
"types": [
"BASIC_ENRICHMENT",
"ADVANCED_ENRICHMENT"
],
"description": "test updated",
"executionOrder": 9999,
"selector": "25bafc7f-30c3-11ec-b5a6-cfed7b409025",
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"enabled": false,
"configurations": [
{
"policyId": "25c13e10-30c3-11ec-b5a6-a94801032f38",
"id": "25c13e11-30c3-11ec-b5a6-7d177bd08a5b",
"type": "BASIC_ENRICHMENT",
"subType": "",
"configOrder": 1,
"definition": {
"processing_action": {
"severity": "CRITICAL"
}
},
"timeframeStatus": ""
},
{
"policyId": "25c13e10-30c3-11ec-b5a6-a94801032f38",
"id": "25c13e12-30c3-11ec-b5a6-bd4647d01a42",
"type": "ADVANCED_ENRICHMENT",
"configOrder": 2,
"definition": {
"children": [
{
"children": [],
"label": "var",
"type": "assignVar",
"value": "45",
"key": "$var"
}
],
"label": "test",
"type": "root"
},
"timeframeStatus": ""
}
]
}
Example 2
"description": "TestingRefinePolicy",
"enabled": true,
"executionOrder": 247,
"types": [
"REFINE"
],
"configurations": [
{
"eventClass": null,
"type": "REFINE",
"configOrder": 1,
"definition": {
"type": "root",
"label": "refine",
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.status",
"value": "BLACKOUT",
"label": "enrich_label"
},
{
"children": [],
"type": "enrich",
"key": "$NEW.severity",
"value": "CRITICAL",
"label": "enrich_label"
},
{
"children": [],
"type": "enrich",
"key": "$NEW.source_hostname",
"value": "<hostname>",
"label": "enrich_label1"
}
]
}
}
],
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
]
}
Multiple classes in the event selection criteria of a single event policy
"description": "DuHIMNKaKu",
"enabled": true,
"executionOrder": 433,
"selectorCriteriaList": [
"( class equals 'ALARM' ) AND ( al_parameter_name contains 'CPU' ) AND ( msg contains 'increasing' )",
"( class equals 'PATROL_EV' ) AND ( p_origin contains 'clm' ) AND ( msg contains 'increasing' )"
],
"timeframes": [
"-1"
],
"types": [
"ADVANCED_ENRICHMENT"
],
"configurations": [
{
"eventClass": null,
"type": "ADVANCED_ENRICHMENT",
"configOrder": 1,
"definition": {
"type": "root",
"label": "root_label",
"children": [
{
"type": "enrich",
"key": "$NEW.cdmclass",
"value": null,
"children": [
{
"children": [],
"type": "data",
"value": "$NEW.al_parameter_name"
}
],
"label": "enrich_label"
},
{
"type": "if",
"conditions": [
{
"conditionOrder": 0,
"conditionOperator": "",
"slotName": "$NEW.al_parameter_threshold",
"slotOperator": "contains",
"slotValue": "MCzXdU",
"conditionBracket": "(",
"endBracket": ")"
},
{
"conditionOrder": 1,
"conditionOperator": "AND",
"slotName": "$NEW.status",
"slotOperator": "equals",
"slotValue": "OPEN",
"conditionBracket": "(",
"endBracket": ")"
}
],
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.status",
"value": "ACK",
"label": "enrich_label"
},
{
"type": "if",
"conditions": [
{
"conditionOrder": 0,
"conditionOperator": "",
"slotName": "$NEW.severity",
"slotOperator": "greater_than",
"slotValue": "MINOR",
"conditionBracket": "(",
"endBracket": ")"
},
{
"conditionOrder": 1,
"conditionOperator": "AND",
"slotName": "$NEW.location",
"slotOperator": "contains",
"slotValue": "NJy0abvT",
"conditionBracket": "(",
"endBracket": ")"
}
],
"children": [
{
"type": "enrich",
"key": "$NEW.msg",
"value": null,
"children": [
{
"type": "function",
"name": "Concat",
"children": [
{
"type": "data",
"value": "$NEW.msg",
"children": []
},
{
"type": "data",
"value": "if_if_then_criteria_matched",
"children": []
}
]
}
],
"label": "enrich_label"
},
{
"children": [],
"type": "enrich",
"key": "$NEW.priority",
"value": "PRIORITY_1",
"label": "enrich_label"
}
],
"label": "if_label"
},
{
"type": "else",
"children": [
{
"type": "enrich",
"key": "$NEW.msg",
"value": null,
"children": [
{
"type": "function",
"name": "Concat",
"children": [
{
"type": "data",
"value": "$NEW.msg",
"children": []
},
{
"type": "data",
"value": "if_if_else_criteria_matched",
"children": []
}
]
}
],
"label": "enrich_label"
},
{
"children": [],
"type": "enrich",
"key": "$NEW.priority",
"value": "PRIORITY_4",
"label": "enrich_label"
}
],
"label": "else_label"
}
],
"label": "if_label"
},
{
"type": "else",
"children": [
{
"type": "if",
"conditions": [
{
"conditionOrder": 0,
"conditionOperator": "",
"slotName": "$NEW.priority",
"slotOperator": "greater_than",
"slotValue": "PRIORITY_3",
"conditionBracket": "(",
"endBracket": ")"
},
{
"conditionOrder": 1,
"conditionOperator": "AND",
"slotName": "$NEW.source_address",
"slotOperator": "contains",
"slotValue": "bmc.com",
"conditionBracket": "(",
"endBracket": ")"
}
],
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.severity",
"value": "CRITICAL",
"label": "enrich_label"
}
],
"label": "if_label"
},
{
"type": "else",
"children": [
{
"children": [],
"type": "enrich",
"key": "$NEW.severity",
"value": "MINOR",
"label": "enrich_label"
}
],
"label": "else_label"
}
],
"label": "else_label"
}
]
}
}
]
}
You can specify multiple classes in the selectorCriteriaList parameter.
When you update a time-based policy, you can specify the duration attribute value as an event slot or a global variable that represents an integer in the string format.
Successful response
"message": "Updated event policy",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You specify an invalid event selection criteria.
{
"key": "400",
"level": "ERROR",
"message": "Invalid EventSelectorCriteria: 1 Invalid Condition Name (msg.",
"additionalInfo": []
}
]
Scenario 2: You specify an invalid key in the enrich node definition for the configurations attribute.
Example 1
{
"key": "400",
"level": "ERROR",
"message": "Invalid key $NEW.source_port in enrich definition.$NEW.source_port can not be enriched.",
"additionalInfo": []
}
]
Example 2
{
"key": "400",
"level": "ERROR",
"message": "Invalid key $NEW.al_device_ipaddress in enrich definition.",
"additionalInfo": []
}
]
Scenario 3: You specify an invalid definition type for the configurations attribute.
{
"key": "400",
"level": "ERROR",
"message": "Invalid type in Refine definition.Expected type is 'root'.",
"additionalInfo": []
}
]
Scenario 4: You do not specify a definition label for the configurations attribute.
{
"key": "400",
"level": "ERROR",
"message": "label is mandatory in REFINE definition and cannot be null or empty.",
"additionalInfo": []
}
]
Scenario 5: You include the else definition without the if definition for the configurations attribute.
{
"key": "400",
"level": "ERROR",
"message": "Invalid type else without any if definition.",
"additionalInfo": []
}
]
Scenario 6: You specify an invalid type for the enrich node in the if definition for the configurations attribute.
{
"key": "400",
"level": "ERROR",
"message": "Invalid type enrich1 in if definition.",
"additionalInfo": []
}
]
Scenario 7: You attempt to update the policy name, which is non-editable.
{
"key": "validation.schema.additionalProperties",
"level": "ERROR",
"message": "Object instance has properties which are not allowed by the schema: [\"name\"]",
"additionalInfo": []
}
]
Scenario 8: You specify a policy ID that does not exist.
{
"key": "Not Found",
"level": "ERROR",
"message": "No policy found matching input request!",
"additionalInfo": null
}
]
Scenario 9: The number of classes that you specify in the event selection criteria exceeds the maximum class limit.
{
"key": "400",
"level": "ERROR",
"message": "Maximum event selection criteria allowed is 5",
"additionalInfo": []
}
]
Scenario 10: You specify an event slot in the policy configuration that does not belong to any of the classes that you specified in the event selection criteria.
{
"key": "400",
"level": "ERROR",
"message": "Invalid value $NEW.custom_class_slot_1 in data definition.",
"additionalInfo": []
}
]
POST /event_policies/delete
Delete multiple event policies
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Parameter name | Value type | Located in | Mandatory | Description |
|---|---|---|---|---|
ids | String | Body | Yes | Comma-separated list of policy IDs that you want to delete. |
Request body
"ids": [
"string"
]
}
Example request body
"ids": [
"d6d8863c-3df8-11eb-9812-a972fa20cf57",
"d32fc78e-3558-11eb-9812-c3cbbc933af7"
]
}
Successful response
"message": "Deleted event policies",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You specify multiple policy IDs out of which a few exist and a few do not.
"status": "207",
"succeeded": [
"5ec64ed1-14a4-11ed-b8d2-f56ae23d81b5"
],
"failed": [
{
"id": "76859e26-a101-11ec-86ff-b3fdef7f5366",
"message": "Failed to delete event policies, entry doesn't exist in database]"
},
{
"id": "76859e26-a101-11ec-86fd-b3fdef7f5366",
"message": "Failed to delete event policies, entry doesn't exist in database]"
}
]
}
Scenario 2: You specify an invalid policy ID.
{
"key": "400",
"level": "ERROR",
"message": "Bad Request : Invalid resource id specified: 11",
"additionalInfo": []
}
]
Scenario 3: The object instance has properties that are not allowed by the schema.
Example 1
{
"key": "validation.schema.additionalProperties",
"level": "ERROR",
"message": "Object instance has properties which are not allowed by the schema: [\"id\"]",
"additionalInfo": []
}
]
Example 2
{
"key": "validation.schema.additionalProperties",
"level": "ERROR",
"message": "Object instance has properties which are not allowed by the schema: [\"idType\",\"resources\"]",
"additionalInfo": []
}
]
Scenario 4: You attempt to delete multiple policies that do not exist.
{
"key": "POLICY_NOT_EXIST",
"level": "ERROR",
"message": "[Failed to delete policy, entry doesn't exist in database]",
"additionalInfo": [
[
"76859e26-a101-11ec-86ff-b3fdef7f5366",
"76859e26-a101-11ec-86fd-b3fdef7f5366"
]
]
}
]
Scenario 5: You specify a policy ID that does not exist.
{
"key": "POLICY_NOT_EXIST",
"level": "ERROR",
"message": "[Failed to delete policy, entry doesn't exist in database]",
"additionalInfo": [
[
"ff921989-9497-11ec-ab01-23d7965a32bc"
]
]
}
]
post /event_policies/enable
Enable multiple event policies
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Parameter name | Value type | Located in | Mandatory | Description |
|---|---|---|---|---|
ids | String | Body | Yes | Comma-separated list of policy IDs that you want to enable. |
Request body
"ids": [
"string"
]
}
Example request body
"ids": [
"d6d8863c-3df8-11eb-9812-a972fa20cf57",
"d32fc78e-3558-11eb-9812-c3cbbc933af7"
]
}
Successful response
"message": "Enabled event policies",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You do not specify a policy ID
{
"key": "400",
"level": "ERROR",
"message": "Bad Request : Property is null or empty : resources",
"additionalInfo": []
}
]
Scenario 2: You attempt to enable a policy that does not exist
{
"key": "404",
"level": "ERROR",
"message": "[Failed to enable policy, entry doesn't exist in database]",
"additionalInfo": [
[
"d32fc78e-3558-11eb-9812-c3cbbc933af7"
]
]
}
]
post /event_policies/disable
Disable multiple event policies
Authorization: Bearer <JWT_token>
For instructions on obtaining the JWT token, see Access and authentication for the REST API..
Parameter details
Parameter name | Value type | Located in | Mandatory | Description |
|---|---|---|---|---|
ids | String | Body | Yes | Comma-separated list of policy IDs that you want to disable. |
Request body
"ids": [
"string"
]
}
Example request body
"ids": [
"d6d8863c-3df8-11eb-9812-a972fa20cf57",
"d32fc78e-3558-11eb-9812-c3cbbc933af7"
]
}
Successful response
"message": "Disabled event policies",
"object": [
"696447ff-008d-4ef7-a417-2c506abad552"
]
}
Unsuccessful responses
Scenario 1: You do not specify a policy ID
{
"key": "400",
"level": "ERROR",
"message": "Bad Request : Property is null or empty : resources",
"additionalInfo": []
}
]
Scenario 2: You attempt to disable a policy that does not exist
{
"key": "404",
"level": "ERROR",
"message": "[Failed to disable policy, entry doesn't exist in database]",
"additionalInfo": [
[
"ab56eb68-9499-11ec-ab01-a798a9069314"
]
]
}
]