CEP rule object

The following objects are directly related to the ceprule API.

CEP rule

The CEP rule object has the following properties.

Property Type Description
cep_ruleid ID ID of the CEP rule.

Property behavior:
- read-only
- required for update operations
name string Name of the CEP rule.

Property behavior:
- required for create operations
window_type integer Time window type:

0 - (default) None
1 - Simple (multiple);
2 - Cause and symptom grouping;
3 - Simple (once);
4 - Event pattern match.
stop integer Possible values:

0 - (default) Continue with the next CEP rule according to sort order;
1 - Stop after executing this rule.
sortorder integer Execution order of the CEP rule.
description string Description of the CEP rule.
status integer Whether the CEP rule is enabled or disabled.

Possible values:
0 - (default) enabled;
1 - disabled.
error string Error text if the CEP rule processing failed on rule level.

Property behavior:
- read-only

CEP rule filter

The CEP rule filter object defines a set of conditions that must be met for events to be processed by CEP rule. It has the following properties.

Property Type Description
conditions array Set of filter conditions to use for filtering results. The conditions will be sorted in the order of their placement in the formula.

Property behavior:
- required
evaltype integer Filter condition evaluation method.

Possible values:
0 - And/Or;
1 - And;
2 - Or;
3 - Custom expression.

Property behavior:
- required
eval_formula string Generated expression that will be used for evaluating filter conditions. The expression contains IDs that reference specific filter conditions by its formulaid. The value of eval_formula is equal to the value of formula for filters with a custom expression.

Property behavior:
- read-only
formula string User-defined expression to be used for evaluating conditions of filters with a custom expression. The expression must contain IDs that reference specific filter conditions by its formulaid. The IDs used in the expression must exactly match the ones defined in the filter conditions: no condition can remain unused or omitted.

Property behavior:
- required if evaltype is set to "custom expression"

CEP rule filter condition

The CEP rule filter condition object defines a specific condition that must be checked before processing events by the CEP rule.

Property Type Description
type integer Type of condition.

Possible values:
3 - event name;
4 - severity;
6 - time period;
25 - tag name;
26 - tag value;
36 - host visible name;
37 - host group name.

Property behavior:
- required
operator integer Condition operator.

Possible values:
0 - equals (default);
1 - does not equal;
2 - contains;
3 - does not contain;
4 - in;
5 - is greater than or equals;
6 - is less than or equals;
7 - not in.

Property behavior:
- required.
event_name string Event name for a specific operation type.

Property behavior:
- required if type is set to "event name"
severity string Event severity for a specific operation type.

Property behavior:
- required if type is set to "severity"
time_period string Time period for a specific operation type.

Property behavior:
- required if type is set to "time period"
tag string Tag name for a specific operation type.

Property behavior:
- required if type is set to "tag name" or "tag value"
tag_value string Tag value for a specific operation type.

Property behavior:
- required if type is set to "tag value"
event_severity string Event severity for a specific operation type.

Property behavior:
- required if type is set to "severity"
host_name string Host name for a specific operation type.

Property behavior:
- required if type is set to "host visible name"
host_group_name string Host group name for a specific operation type.

Property behavior:
- required if type is set to "host group name"
formulaid string Arbitrary unique ID that is used to reference the condition from a custom expression. Can only contain capital-case letters. The ID must be defined by the user when modifying filter conditions, but will be generated anew when requesting them afterward.

Property behavior:
- required if CEP rule filter evaltype is set to "custom expression"

CEP rule time window

The CEP rule time window object defines the time window of the CEP rule. It has the following properties.

Property Type Description
duration string Duration of the CEP rule window (365 days maximum). Accepts seconds and time units with suffix.

Default: 10m
capacity integer Capacity of the CEP rule window. Supports user macros.

Default: 0 (unlimited)
group_by_host_group integer Group by flag for host group.

Possible values:
0 - no (default);
1 - yes.
group_by_host integer Group by flag for host.

Possible values:
0 - no (default);
1 - yes.
group_by_tags integer Group by flag for tag.

Possible values:
0 - no (default);
1 - yes.
tags string Tag names to use for grouping.

Property behavior:
- required if group_by_tag is set to "1"
event_count_tag string Tag name for displaying the count of affected events.

Property behavior:
- supported if CEP rule window_type is set to "2"; not allowed otherwise
script string Script to execute.

Property behavior:
- supported if CEP rule window_type is set to "4"; not allowed otherwise

CEP rule operation

The CEP rule operation object defines an operation that will be performed when a CEP rule is executed. It has the following properties.

Property Type Description
sortorder integer Execution order (ascending) of the operation.

Property behavior:
- required
execute_when integer Type of condition for operation.

Possible values:
0 - event occurred;
1 - event added;
2 - event evicted;
3 - window closed;
4 - event pattern matched;
5 - event closed.

Property behavior:
- required
scope integer Scope of the operation.

Possible values:
0 - current event (default);
1 - other events;
2 - all events.

Possible values when execute_when is "Window closed" or "Pattern matched": 2 - all events.

Possible values when execute_when is "Event ocurred": 0 - current event.
filter object Filter object.
scope_filter object Scope filter object.

scope_filter is editable only if the scope field contains "Other events" or "All events" value. Otherwise scope_filter accepts only object with default values.
type integer CEP operation type.

Possible values:
1 - set event name;
2 - close event;
3 - discard event;
4 - set event severity;
5 - increase event severity;
6 - decrease event severity;
7 - suppress event;
8 - unsuppress event;
9 - copy first event as new;
10 - copy last event as new;
11 - add tag;
12 - set tag;
13 - set tag value;
14 - increase tag value;
15 - decrease tag value;
16 - rename tag;
17 - remove tag;
18 - close window.

Property behavior:
- required
- supported:
1, 2, 3, 4, 5, 6, 7, 8, 11, 12, 13, 14, 15, 16, 17 - supported if "Event occurred" (see execute_when)
1, 2, 4, 5, 6, 7, 8, 11, 12, 13, 14, 15, 16, 17, 18 - supported if "Event added" (see execute_when)
1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18 - supported if "Event evicted" (see execute_when)
1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18 - supported if "Event closed" (see execute_when)
1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17 - supported if "Window closed" (see execute_when)
1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18 - supported if "Event pattern matched" (see execute_when)
event_name string Event name for a specific operation type.

Property behavior:
- required if type is set to "Set event name"
tag string Tag name for specific operation types.

Property behavior:
- required if type is set to "Add tag", "Set tag", "Set tag value", "Increase tag value", "Decrease tag value", "Rename tag", "Remove tag"
new_tag string New tag name for a specific operation type.

Property behavior:
- required if type is set to "Rename tag"
tag_value string Tag value for specific operation types.

Property behavior:
- required if type is set to "Add tag", "Set tag", "Set tag value", "Increase tag value", "Decrease tag value", "Rename tag", "Remove tag"
severity integer Event severity for a specific operation type.

Property behavior:
- required if type is set to "Set event severity"
suppress_duration string Duration of the event suppression. Accepts seconds and time unit with suffix.

Property behavior:
- required if type is set to "Suppress event"

CEP rule operation filter

The CEP rule operation filter object defines a set of conditions that must be met to perform the configured CEP operations. It has the following properties.

Property Type Description
conditions array Set of operation filter conditions to use for filtering results. The conditions will be sorted in the order of their placement in the formula.

Property behavior:
- required
evaltype integer Filter condition evaluation method.

Possible values:
0 - And/Or;
1 - And;
2 - Or;
3 - Custom expression.

Property behavior:
- required
eval_formula string Generated expression that will be used for evaluating filter conditions. The expression contains IDs that reference specific filter conditions by its formulaid. The value of eval_formula is equal to the value of formula for filters with a custom expression.

Property behavior:
- read-only
formula string Arbitrary unique ID that is used to reference the condition from a custom expression. Can only contain capital-case letters. The ID must be defined by the user when modifying filter conditions, but will be generated anew when requesting them afterward.

Property behavior:
- required

CEP rule operation filter condition

The CEP rule operation filter condition object defines a specific condition that must be checked before running the CEP rule operations.

Property Type Description
type integer Type of operation condition.

Possible values:
25 - tag name;
26 - tag value;
30 - problem opened;
31 - first;
32 - last;
33 - symptom;
34 - cloned;
35 - suppressed.

Property behavior:
- required
- supported:
25, 26, 30, 33, 34, 35 - supported if "Event occurred" (see execute_when)
operator integer Condition operator.

Possible values:
0 - equals (default);
1 - does not equal;
2 - contains;
3 - does not contain;
5 - is greater than or equals;
6 - is less than or equals;
10 - true;
11 - false.

Property behavior:
- required
- supported:
0, 1, 2, 3 - supported values if type set to "Tag name"
0, 1, 2, 3, 5, 6 - supported values if type set to "Tag value"
10, 11 - supported values if type set to "Problem opened", "First", "Last", "Symptom", "Cloned", "Suppressed".
tag string Tag name of operation condition.

Property behavior:
- required if type is set to "Tag name" or "Tag value"
tag_value string Value to compare with.

Property behavior:
- required if type is set to "Tag value"

CEP rule operation scope filter

The CEP rule operation scope filter object defines a set of conditions that must be met to apply the configured CEP operations to events. It has the following properties.

Property Type Description
conditions array Set of operation scope filter conditions to use for filtering results. The conditions will be sorted in the order of their placement in the formula.

Property behavior:
- required
evaltype integer Filter condition evaluation method.

Possible values:
0 - And/Or;
1 - And;
2 - Or;
3 - Custom expression.

Property behavior:
- required
eval_formula string Generated expression that will be used for evaluating filter conditions. The expression contains IDs that reference specific filter conditions by its formulaid. The value of eval_formula is equal to the value of formula for filters with a custom expression.

Property behavior:
- read-only
formula string Arbitrary unique ID that is used to reference the condition from a custom expression. Can only contain capital-case letters. The ID must be defined by the user when modifying filter conditions, but will be generated anew when requesting them afterward.

Property behavior:
- required

CEP rule operation scope filter condition

The CEP rule operation scope filter condition object defines a specific condition that must be checked before applying the CEP rule operations to events.

Property Type Description
type integer Type of operation condition.

Possible values:
25 - tag name;
26 - tag value;
30 - problem opened;
31 - first;
32 - last;
33 - symptom;
34 - cloned;
35 - suppressed.

Property behavior:
- required
- supported:
25, 26, 30, 33, 34, 35 - supported if "Event occurred" (see execute_when)
operator integer Condition operator.

Possible values:
0 - equals (default);
1 - does not equal;
2 - contains;
3 - does not contain;
5 - is greater than or equals;
6 - is less than or equals;
10 - true;
11 - false.

Property behavior:
- required
- supported:
0, 1, 2, 3 - supported values if type set to "Tag name"
0, 1, 2, 3, 5, 6 - supported values if type set to "Tag value"
10, 11 - supported values if type set to "Problem opened", "First", "Last", "Symptom", "Cloned", "Suppressed".
tag string Tag name of operation condition.

Property behavior:
- required if type is set to "Tag name" or "Tag value"
tag_value string Value to compare with.

Property behavior:
- required if type is set to "Tag value"