Create an Event Watcher Policy
post
/api/event/WatcherPolicies
Creates a new event watcher policy.
Request
There are no request parameters for this operation.
Supported Media Types
- application/json
Root Schema : schema
Type:
Show Source
object
-
EmailAddresses: string
Comma-separated list of notification recipients.Example:
-
NotificationProfileID: integer
ID of the notification profile.Example:
0
-
NotificationTemplateID: integer
ID of the notification template.Example:
0
-
PolicyDescription: string
Event Watcher Policy DescriptionExample:
For any Login Failures by Node in the last 15 mins If any login failures occur and the Sum of Count >= 3, create this event.
-
PolicyEventID: integer
The ID of the Meta Event that should be dispatched if the threshold condition is met for the filtered metricsExample:
3
-
PolicyFilter: string
SQL used to select which events will be processed by this CAPE Policy's node(s)Example:
(EventType = 'LoginLogout' AND Severity > 1 AND LastReported > (UNIX_TIMESTAMP() - 900))
-
PolicyGrouping: string
A SQL "GROUP BY" clause that allows the filtered metrics to be grouped. Valid format is empty or a comma-delimited list of one or more Event.Events field namesExample:
Node
-
PolicyName: string
Event Watcher Policy NameExample:
Login Failure x3
-
PolicyPollTime: integer
How often, in seconds, should this policy be checkedExample:
900
-
PolicyStatusID: integer
Event Watcher PolicyStatusIDExample:
0
-
PolicyThresholdField: string
Field from Event.Events DB table to use in threshold calculation. Value must be a field in Events. The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)'Example:
Count
-
PolicyThresholdMetric: string
SQL Function applied to $PolicyThresholdField and compared with the $PolicyThresholdOperatorID operator against $PolicyThresholdValue The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)' Allowed Values: - count - sum - max - min - avgExample:
sum
-
PolicyThresholdOperatorID: integer
The OperatorID of the threshold calculation The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)' Allowed Values: - 0 => = - 1 => > - 2 => >= - 3 => < - 4 => <= 5 -> !==>Example:
2
-
PolicyThresholdValue: number
The numeric value used in the threshold condition. The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)'Example:
3
Response
Supported Media Types
- application/json
200 Response
Successful operation
Nested Schema : SuccessfulAddOperation
Type:
Show Source
object
-
message: string
The response message.Example:
Added record
-
success: boolean
Whether the operation was a success (true) or a failure (false).Example:
true
Nested Schema : type
Type:
Show Source
object
-
data: array
data
The properties of the new event watcher policy.
-
total: integer
The total number of results regardless of paging.Example:
1
Nested Schema : eventWatcherPoliciesRead
Type:
Show Source
object
-
ActionType: string
Indicates which type of action to take when a threshold is crossed. - event => Meta Event - notification => Notification profileExample:
event
-
EmailAddresses: string
Comma-separated list of notification recipients.Example:
-
Filters: array
Filters
List of Filters with the Watcher
-
NotificationProfileID: integer
ID of the notification profile.Example:
0
-
NotificationProfileName: string
Notification Profile NameExample:
oracle.doceng.json.BetterJsonNull@7053a864
-
NotificationTemplateID: integer
ID of the notification template.Example:
0
-
NotificationTemplateName: string
Notification Template NameExample:
oracle.doceng.json.BetterJsonNull@85104d6
-
PolicyAction: string
Action associated with the PolicyExample:
Meta Event: Login Failure x3
-
PolicyAuthor: string
Policy AuthorExample:
Administrator
-
PolicyDescription: string
Event Watcher Policy DescriptionExample:
For any Login Failures by Node in the last 15 mins If any login failures occur and the Sum of Count >= 3, create this event.
-
PolicyEventID: integer
The ID of the Meta Event that should be dispatched if the threshold condition is met for the filtered metricsExample:
3
-
PolicyEventName: string
The Name of the Meta Event that should be dispatched if the threshold condition is met for the filtered metricsExample:
Login Failure x3
-
PolicyFilter: string
SQL used to select which events will be processed by this CAPE Policy's node(s)Example:
(EventType = 'LoginLogout' AND Severity > 1 AND LastReported > (UNIX_TIMESTAMP() - 900))
-
PolicyGrouping: string
A SQL "GROUP BY" clause that allows the filtered metrics to be grouped. Valid format is empty or a comma-delimited list of one or more Event.Events field namesExample:
Node
-
PolicyID: integer
Policy ID specified for individual CRUD operationsExample:
2
-
PolicyName: string
Event Watcher Policy NameExample:
Login Failure x3
-
PolicyPollTime: integer
How often, in seconds, should this policy be checkedExample:
900
-
PolicyStatus: string
Event Watcher Policy StatusExample:
Disabled
-
PolicyStatusIcon: string
Event Watcher Policy Status IconExample:
OrbRed.png
-
PolicyStatusID: integer
Event Watcher PolicyStatusIDExample:
0
-
PolicyThreshold: string
Overall threshold operationExample:
sum(Count) >= 3
-
PolicyThresholdField: string
Field from Event.Events DB table to use in threshold calculation. Value must be a field in Events. The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)'Example:
Count
-
PolicyThresholdMetric: string
SQL Function applied to $PolicyThresholdField and compared with the $PolicyThresholdOperatorID operator against $PolicyThresholdValue The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)' Allowed Values: - count - sum - max - min - avgExample:
sum
-
PolicyThresholdOperatorID: integer
The OperatorID of the threshold calculation The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)' Allowed Values: - 0 => = - 1 => > - 2 => >= - 3 => < - 4 => <= 5 -> !==>Example:
2
-
PolicyThresholdValue: number
The numeric value used in the threshold condition. The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)'Example:
3
-
SearchType: string
Indicates which type of search - field => Guided - sql => Manual SQLExample:
sql
Nested Schema : Filters
Type:
array
List of Filters with the Watcher
Show Source
Example:
[
{
"FieldName":"Ack",
"Expression":"0",
"FieldValue":""
},
{
"FieldName":"Action",
"Expression":"0",
"FieldValue":""
},
{
"FieldName":"Actor",
"Expression":"0",
"FieldValue":""
}
]
Nested Schema : items
Type:
Show Source
object
-
Expression:
Example:
0
-
FieldName:
Example:
Ack
-
FieldValue:
Example:
Default Response
Failed operation
Root Schema : schema
Type:
Show Source
object
-
errors: array
errors
The list of errors reported. Validation errors will be keyed by record field.
-
message: string
The response message.Example:
Exception thrown
-
success: boolean
Whether the operation was a success (true) or a failure (false).Example:
false
Nested Schema : errors
Type:
array
The list of errors reported. Validation errors will be keyed by record field.
Show Source
Nested Schema : items
Type:
object