Create a CAPE Node
post
/api/event/Nodes
Creates a new CAPE node.
Request
There are no request parameters for this operation.
Supported Media Types
- application/json
Root Schema : schema
Type:
Show Source
object
-
NodeActionText: string
Content of CAPE Node RuleExample:
use JSON; my $EventDBH = DBConnect($Config, 'Event', {AutoCommit => 1}); my $CurrentTime = sprintf "%.3f", Time::HiRes::time; # Get Anomaly EventID and Details my $AnomalyEventID = $EventData->{EventID}; my $AnomalyDetails; eval { local $SIG{__DIE__}; $AnomalyDetails = decode_json($EventData->{Details}); }; if ($@) { $Log->Message("ERROR", "Failed to decode Details: $@"); } # Get ML job my $AnomalyJobID = $AnomalyDetails->{MLJobID}; # Get Filter | Node ='xyz' AND SubNode='eth0' my $AnomalyFilter = $AnomalyDetails->{EventFilter}; my $AnomalyDuration = $CurrentTime - $EventData->{FirstReported}; # Mark Anomaly Event to prevent duplicate processing my ($ErrorFlag, $Message) = UpdateEvent({ DBH => \$EventDBH, EventID => $AnomalyEventID, Values => { Action => 'EscalateByAnomaly', Actor => 'CAPE', Duration => $AnomalyDuration, LastChanged => $CurrentTime, RootCauseFlag => 1, Severity => 0 } }); $Log->Message("WARN", "-> EscalateByAnomaly -> Marked Anomaly Event [$AnomalyEventID] as Cleared"); $Log->Message("WARN", "-> EscalateByAnomaly -> Escalating filter [$AnomalyFilter]"); # Retrieve alarms in filter with timeframe my ($ErrorFlag1, $Message1, $EventRef) = FindEventID({ DBH => \$EventDBH, Filter => $AnomalyFilter }); my $EventList = join(',', @$EventRef); $Log->Message("WARN", "-> EscalateByAnomaly -> Escalating filter returns [$EventList]"); # Set Severity Setting my $SymptomNewSeverity = 5; my $i = 0; foreach my $SymptomEventID (@$EventRef) { $i++; # Get symptom my $SymptomEvent = GetEventHash({ DBH => \$EventDBH, EventID => $SymptomEventID, ShardID => 1 }); my $SymptomOrigSeverity = $SymptomEvent->{Severity}; my $SymptomDuration = $CurrentTime - $SymptomEvent->{FirstReported}; # Suppress Events my ($ErrorFlag, $Message) = UpdateEvent({ DBH => \$EventDBH, EventID => $SymptomEventID, Values => { Action => 'EscalateByAnomaly', Actor => 'CAPE', Duration => $SymptomDuration, LastChanged => $CurrentTime, OrigSeverity => $SymptomOrigSeverity, RootCauseID => $AnomalyEventID, Severity => $SymptomNewSeverity } }); # EventJournal for suppression my ($ErrorFlag, $Message) = AddJournal({ DBH => \$EventDBH, EventID => $SymptomEventID, TimeStamp => $CurrentTime, Username => 'api', Entry => 'Escalate Abnormal Activity via event [' . $AnomalyEventID . '] due to [' . $AnomalyJobID . ']' }); } $EventDBH->disconnect();
-
NodeAlias: string
CAPE Node Alias (optional) used for referencing another CAPE nodeExample:
oracle.doceng.json.BetterJsonNull@53086bdc
-
NodeDescription: string
CAPE Node DescriptionExample:
Take anomaly event by Machine Learning Policy and escalated Severity
-
NodeName: string
CAPE Node NameExample:
EscalateByAnomaly
-
NodeNextNode: integer
NodeID of the next node IF a node is set as the next to be executed.Example:
oracle.doceng.json.BetterJsonNull@55a29589
-
NodeStateVerify: string
CAPE Node "next node" test statement. If this evaluates to "true", the event will be passed to $NodeNextNodeExample:
Response
Supported Media Types
- application/json
200 Response
Successful operation
Nested Schema : SuccessfulAddOperation
Type:
Show Source
object
-
message: string
The response message.Example:
Added record
-
success: boolean
Whether the operation was a success (true) or a failure (false).Example:
true
Nested Schema : type
Type:
Show Source
object
-
data: array
data
The properties of the new cape node.
-
total: integer
The total number of results regardless of paging.Example:
1
Nested Schema : eventNodesRead
Type:
Show Source
object
-
NodeActionText: string
Content of CAPE Node RuleExample:
use JSON; my $EventDBH = DBConnect($Config, 'Event', {AutoCommit => 1}); my $CurrentTime = sprintf "%.3f", Time::HiRes::time; # Get Anomaly EventID and Details my $AnomalyEventID = $EventData->{EventID}; my $AnomalyDetails; eval { local $SIG{__DIE__}; $AnomalyDetails = decode_json($EventData->{Details}); }; if ($@) { $Log->Message("ERROR", "Failed to decode Details: $@"); } # Get ML job my $AnomalyJobID = $AnomalyDetails->{MLJobID}; # Get Filter | Node ='xyz' AND SubNode='eth0' my $AnomalyFilter = $AnomalyDetails->{EventFilter}; my $AnomalyDuration = $CurrentTime - $EventData->{FirstReported}; # Mark Anomaly Event to prevent duplicate processing my ($ErrorFlag, $Message) = UpdateEvent({ DBH => \$EventDBH, EventID => $AnomalyEventID, Values => { Action => 'EscalateByAnomaly', Actor => 'CAPE', Duration => $AnomalyDuration, LastChanged => $CurrentTime, RootCauseFlag => 1, Severity => 0 } }); $Log->Message("WARN", "-> EscalateByAnomaly -> Marked Anomaly Event [$AnomalyEventID] as Cleared"); $Log->Message("WARN", "-> EscalateByAnomaly -> Escalating filter [$AnomalyFilter]"); # Retrieve alarms in filter with timeframe my ($ErrorFlag1, $Message1, $EventRef) = FindEventID({ DBH => \$EventDBH, Filter => $AnomalyFilter }); my $EventList = join(',', @$EventRef); $Log->Message("WARN", "-> EscalateByAnomaly -> Escalating filter returns [$EventList]"); # Set Severity Setting my $SymptomNewSeverity = 5; my $i = 0; foreach my $SymptomEventID (@$EventRef) { $i++; # Get symptom my $SymptomEvent = GetEventHash({ DBH => \$EventDBH, EventID => $SymptomEventID, ShardID => 1 }); my $SymptomOrigSeverity = $SymptomEvent->{Severity}; my $SymptomDuration = $CurrentTime - $SymptomEvent->{FirstReported}; # Suppress Events my ($ErrorFlag, $Message) = UpdateEvent({ DBH => \$EventDBH, EventID => $SymptomEventID, Values => { Action => 'EscalateByAnomaly', Actor => 'CAPE', Duration => $SymptomDuration, LastChanged => $CurrentTime, OrigSeverity => $SymptomOrigSeverity, RootCauseID => $AnomalyEventID, Severity => $SymptomNewSeverity } }); # EventJournal for suppression my ($ErrorFlag, $Message) = AddJournal({ DBH => \$EventDBH, EventID => $SymptomEventID, TimeStamp => $CurrentTime, Username => 'api', Entry => 'Escalate Abnormal Activity via event [' . $AnomalyEventID . '] due to [' . $AnomalyJobID . ']' }); } $EventDBH->disconnect();
-
NodeAlias: string
CAPE Node Alias (optional) used for referencing another CAPE nodeExample:
oracle.doceng.json.BetterJsonNull@53086bdc
-
NodeAliasDisplay: string
UI-Only field that is either the NodeAlias if one exists or "[None]" if no alias is setExample:
[None]
-
NodeDescription: string
CAPE Node DescriptionExample:
Take anomaly event by Machine Learning Policy and escalated Severity
-
NodeID: integer
Node ID specified for individual CRUD operationsExample:
1
-
NodeName: string
CAPE Node NameExample:
EscalateByAnomaly
-
NodeNextNodeID: integer
NodeID of the next node IF a node is set as the next to be executed.Example:
oracle.doceng.json.BetterJsonNull@55a29589
-
NodeNextNodeName: string
NodeName of the next node IF a node is set as the next to be executedExample:
oracle.doceng.json.BetterJsonNull@155767a7
-
NodeStateVerify: string
CAPE Node "next node" test statement. If this evaluates to "true", the event will be passed to $NodeNextNodeExample:
Default Response
Failed operation
Root Schema : schema
Type:
Show Source
object
-
errors: array
errors
The list of errors reported. Validation errors will be keyed by record field.
-
message: string
The response message.Example:
Exception thrown
-
success: boolean
Whether the operation was a success (true) or a failure (false).Example:
false
Nested Schema : errors
Type:
array
The list of errors reported. Validation errors will be keyed by record field.
Show Source
Nested Schema : items
Type:
object