Get CAPE Nodes
get
/api/event/Nodes
Gets the CAPE nodes that match the specified parameters. If no parameters are specified, all CAPE nodes are returned.
Request
Query Parameters
-
filter: object
The fields to filter the results by. You cannot filter by fields that contain a state.
This parameter's value uses the following JSON format:
{
"property": "property",
"value": "propertyValue",
"operator": "operator",
"conjunction": "conjunction"
}
If you use multiple JSON objects to combine filters, for example, to filter by several different device names, you cannot combine OR and AND conjunctions. The conjunction used for the last object applies to the entire list.-
conjunction:
string
Default Value:
OR
Allowed Values:[ "AND", "OR" ]
The conjunction between filters.Example:AND
-
operator:
string
Default Value:
LIKE
Allowed Values:[ "eq", "ne", "gte", "gt", "lte", "lt", "LIKE", "NOT LIKE", "re", "not re", "NOT IN" ]
The filter operation to use.Example:eq
-
property(required):
string
The name of the field to filter on.Example:
name
-
value(required):
string
The value of the field to filter on.Example:
test
-
conjunction:
string
-
limit: integer(int32)
The number of records to limit results by.Example:
100
-
sort: object
The field and direction to sort results by. You cannot sort by fields that contain a state.
This parameters value uses the following JSON format:
{
"property": "property",
"direction": "direction"
}-
direction(required):
string
Allowed Values:
[ "ASC", "DESC" ]
The direction of the sort.Example:ASC
-
property(required):
string
The field to sort on.Example:
name
-
direction(required):
string
-
start: integer(int32)
The page of results to start from.Default Value:
0
Example:1
There's no request body for this operation.
Back to TopResponse
Supported Media Types
- application/json
200 Response
Successful operation
Nested Schema : SuccessfulGetOperation
Type:
Show Source
object
-
message: string
The response message.Example:
Loaded 1 entries
-
success: boolean
Whether the operation was a success (true) or a failure (false).Example:
true
Nested Schema : type
Type:
Show Source
object
-
data: array
data
The list of CAPE nodes that match the specified parameters.
-
total: integer
The total number of results regardless of paging.Example:
1
Nested Schema : data
Type:
array
The list of CAPE nodes that match the specified parameters.
Show Source
Nested Schema : eventNodesRead
Type:
Show Source
object
-
NodeActionText: string
Content of CAPE Node RuleExample:
use JSON; my $EventDBH = DBConnect($Config, 'Event', {AutoCommit => 1}); my $CurrentTime = sprintf "%.3f", Time::HiRes::time; # Get Anomaly EventID and Details my $AnomalyEventID = $EventData->{EventID}; my $AnomalyDetails; eval { local $SIG{__DIE__}; $AnomalyDetails = decode_json($EventData->{Details}); }; if ($@) { $Log->Message("ERROR", "Failed to decode Details: $@"); } # Get ML job my $AnomalyJobID = $AnomalyDetails->{MLJobID}; # Get Filter | Node ='xyz' AND SubNode='eth0' my $AnomalyFilter = $AnomalyDetails->{EventFilter}; my $AnomalyDuration = $CurrentTime - $EventData->{FirstReported}; # Mark Anomaly Event to prevent duplicate processing my ($ErrorFlag, $Message) = UpdateEvent({ DBH => \$EventDBH, EventID => $AnomalyEventID, Values => { Action => 'EscalateByAnomaly', Actor => 'CAPE', Duration => $AnomalyDuration, LastChanged => $CurrentTime, RootCauseFlag => 1, Severity => 0 } }); $Log->Message("WARN", "-> EscalateByAnomaly -> Marked Anomaly Event [$AnomalyEventID] as Cleared"); $Log->Message("WARN", "-> EscalateByAnomaly -> Escalating filter [$AnomalyFilter]"); # Retrieve alarms in filter with timeframe my ($ErrorFlag1, $Message1, $EventRef) = FindEventID({ DBH => \$EventDBH, Filter => $AnomalyFilter }); my $EventList = join(',', @$EventRef); $Log->Message("WARN", "-> EscalateByAnomaly -> Escalating filter returns [$EventList]"); # Set Severity Setting my $SymptomNewSeverity = 5; my $i = 0; foreach my $SymptomEventID (@$EventRef) { $i++; # Get symptom my $SymptomEvent = GetEventHash({ DBH => \$EventDBH, EventID => $SymptomEventID, ShardID => 1 }); my $SymptomOrigSeverity = $SymptomEvent->{Severity}; my $SymptomDuration = $CurrentTime - $SymptomEvent->{FirstReported}; # Suppress Events my ($ErrorFlag, $Message) = UpdateEvent({ DBH => \$EventDBH, EventID => $SymptomEventID, Values => { Action => 'EscalateByAnomaly', Actor => 'CAPE', Duration => $SymptomDuration, LastChanged => $CurrentTime, OrigSeverity => $SymptomOrigSeverity, RootCauseID => $AnomalyEventID, Severity => $SymptomNewSeverity } }); # EventJournal for suppression my ($ErrorFlag, $Message) = AddJournal({ DBH => \$EventDBH, EventID => $SymptomEventID, TimeStamp => $CurrentTime, Username => 'api', Entry => 'Escalate Abnormal Activity via event [' . $AnomalyEventID . '] due to [' . $AnomalyJobID . ']' }); } $EventDBH->disconnect();
-
NodeAlias: string
CAPE Node Alias (optional) used for referencing another CAPE nodeExample:
oracle.doceng.json.BetterJsonNull@53086bdc
-
NodeAliasDisplay: string
UI-Only field that is either the NodeAlias if one exists or "[None]" if no alias is setExample:
[None]
-
NodeDescription: string
CAPE Node DescriptionExample:
Take anomaly event by Machine Learning Policy and escalated Severity
-
NodeID: integer
Node ID specified for individual CRUD operationsExample:
1
-
NodeName: string
CAPE Node NameExample:
EscalateByAnomaly
-
NodeNextNodeID: integer
NodeID of the next node IF a node is set as the next to be executed.Example:
oracle.doceng.json.BetterJsonNull@55a29589
-
NodeNextNodeName: string
NodeName of the next node IF a node is set as the next to be executedExample:
oracle.doceng.json.BetterJsonNull@155767a7
-
NodeStateVerify: string
CAPE Node "next node" test statement. If this evaluates to "true", the event will be passed to $NodeNextNodeExample:
Default Response
Failed operation
Root Schema : schema
Type:
Show Source
object
-
errors: array
errors
The list of errors reported. Validation errors will be keyed by record field.
-
message: string
The response message.Example:
Exception thrown
-
success: boolean
Whether the operation was a success (true) or a failure (false).Example:
false
Nested Schema : errors
Type:
array
The list of errors reported. Validation errors will be keyed by record field.
Show Source
Nested Schema : items
Type:
object