1. REST API for Unified Assurance Core
  2. Tasks
  3. Events
  4. CAPE Policies

Create a CAPE Policy

post

/api/event/Policies

Creates a new CAPE policy.
The minimum required properties in the request body are:
  • PolicyName
  • PolicyZoneID
  • PolicyProcessType
  • PolicyPollTime
  • PolicyNodeID
  • PolicyStatusID

Request

There are no request parameters for this operation.

Supported Media Types
Request Body - application/json ()
Root Schema : schema
Type: object
Show Source
  • CAPE Policy Description
    Example: Analytics has found an event that has never happened before or through heuristics has been found as not noise but important. The goal is to increase the severity of the originating event.
  • The CAPE policy name.
    To avoid confusion with numeric IDs, the name value cannot be integers only or integers prefixed with the + or - symbols only. It must contain letters or other characters. For example, 1234, +1234, and -1234 are not valid, but US1234, US+1234 and US_1234 are.
    Example: Abnormal Activity
  • The ID of the first node called to process this policy's matching events.
    Example: 1
  • Interval, in seconds, this policy should run (30 seconds recommended minimum)
    Example: 30
  • Flag to indicate whether events will be processed by each node in a batch, or individually Allowed Values: - 0 => Process Events Individually - 1 => Process Events Together
    Example: 0
  • SQL used to select which events will be processed by this CAPE Policy's node(s)
    Example: SELECT * FROM Events WHERE Severity > 1 AND EventType LIKE 'AbnormalActivity-%'
  • The policy status ID. Either 0 (disabled) or 1 (enabled).
    Example: 1
  • The device zone ID associated with the policy. 0 is used for "all zones".
    Example: 0
Back to Top

Response

Supported Media Types

200 Response

Successful operation
Body ()
Root Schema : schema
Match All
Show Source
Nested Schema : SuccessfulAddOperation
Type: object
The response body for a successful add operation.
Show Source
Nested Schema : type
Type: object
Show Source
Nested Schema : data
Type: array
The properties of the new CAPE policy.
Show Source
Nested Schema : eventPoliciesRead
Type: object
Show Source
  • CAPE Policy Description
    Example: Analytics has found an event that has never happened before or through heuristics has been found as not noise but important. The goal is to increase the severity of the originating event.
  • Profile ID specified for individual CRUD operations
    Example: 1
  • CAPE Policy Name
    Example: AbnormalActivity
  • The ID of the first node called to process this policy's matching events.
    Example: 1
  • Name of the first node called.
    Example: EscalateByAnomaly
  • Name of the first node called.
    Example: EscalateByAnomaly
  • Interval, in seconds, this policy should run (30 seconds recommended minimum)
    Example: 30
  • Flag to indicate whether events will be processed by each node in a batch, or individually Allowed Values: - 0 => Process Events Individually - 1 => Process Events Together
    Example: 0
  • SQL used to select which events will be processed by this CAPE Policy's node(s)
    Example: SELECT * FROM Events WHERE Severity > 1 AND EventType LIKE 'AbnormalActivity-%'
  • Status for the Policy. Status will be Enabled or Disabled.
    Example: Enabled
  • CAPE Policy Status Icon. The icon will be "OrbRed.png" or "OrbGreen.png"
    Example: OrbGreen.png
  • The policy status ID. Either 0 (disabled) or 1 (enabled).
    Example: 1
  • The device zone ID associated with the policy. 0 is used for "all zones".
    Example: 0
  • The device zone name associated with the policy. It will be null if the zone ID is 0.
    Example: oracle.doceng.json.BetterJsonNull@5b977aaa
  • The device zone name associated with the policy. It will be "[All]" if the zone ID is 0.
    Example: [All]

Default Response

Failed operation
Body ()
Root Schema : schema
Type: object
Show Source
Nested Schema : errors
Type: array
The list of errors reported. Validation errors will be keyed by record field.
Show Source
Nested Schema : items
Type: object
An error.
Back to Top