1. REST API for Unified Assurance Core
  2. Tasks
  3. Events
  4. Watcher Policies

Create an Event Watcher Policy

post

/api/event/WatcherPolicies

Creates a new event watcher policy.
Because event watcher policies are stored in the database with a specific user ID, and externally-authenticated transient users do not have Unified Assurance user IDs, transient users cannot create event watcher policies.
The minimum required properties in the request body are:
  • PolicyName
  • PolicyDescription
  • PolicyPollTime
  • PolicyStatusID
  • PolicyThresholdMetric
  • PolicyThresholdField
  • PolicyThresholdOperatorID
  • PolicyThresholdValue
  • ActionType
  • PolicyEventID
  • SearchType
  • PolicyGrouping

Request

There are no request parameters for this operation.

Supported Media Types
Request Body - application/json ()
Root Schema : schema
Type: object
Show Source
  • Comma-separated list of notification recipients.
    Example:
  • ID of the notification profile.
    Example: 0
  • ID of the notification template.
    Example: 0
  • Event Watcher Policy Description
    Example: For any Login Failures by Node in the last 15 mins If any login failures occur and the Sum of Count >= 3, create this event.
  • The ID of the Meta Event that should be dispatched if the threshold condition is met for the filtered metrics
    Example: 3
  • SQL used to select which events will be processed by this CAPE Policy's node(s)
    Example: (EventType = 'LoginLogout' AND Severity > 1 AND LastReported > (UNIX_TIMESTAMP() - 900))
  • A SQL "GROUP BY" clause that allows the filtered metrics to be grouped. Valid format is empty or a comma-delimited list of one or more Event.Events field names
    Example: Node
  • The event watcher policy name.
    To avoid confusion with numeric IDs, the name value cannot be integers only or integers prefixed with the + or - symbols only. It must contain letters or other characters. For example, 1234, +1234, and -1234 are not valid, but US1234, US+1234 and US_1234 are.
    Example: Login failure x3
  • How often, in seconds, should this policy be checked
    Example: 900
  • The event watcher policy status ID. Either 0 (disabled) or 1 (enabled).
    Example: 0
  • Field from Event.Events DB table to use in threshold calculation. Value must be a field in Events. The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)'
    Example: Count
  • SQL Function applied to $PolicyThresholdField and compared with the $PolicyThresholdOperatorID operator against $PolicyThresholdValue The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)' Allowed Values: - count - sum - max - min - avg
    Example: sum
  • The OperatorID of the threshold calculation The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)' Allowed Values: - 0 => = - 1 => > - 2 => >= - 3 => < - 4 => <= 5 -> !=
    Example: 2
  • The numeric value used in the threshold condition. The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)'
    Example: 3
Back to Top

Response

Supported Media Types

200 Response

Successful operation
Body ()
Root Schema : schema
Match All
Show Source
Nested Schema : SuccessfulAddOperation
Type: object
The response body for a successful add operation.
Show Source
Nested Schema : type
Type: object
Show Source
Nested Schema : data
Type: array
The properties of the new event watcher policy.
Show Source
Nested Schema : eventWatcherPoliciesRead
Type: object
Show Source
  • Indicates which type of action to take when a threshold is crossed. - event => Meta Event - notification => Notification profile
    Example: event
  • Comma-separated list of notification recipients.
    Example:
  • Filters
    List of Filters with the Watcher
  • ID of the notification profile.
    Example: 0
  • Notification Profile Name
    Example: oracle.doceng.json.BetterJsonNull@3aec2f59
  • ID of the notification template.
    Example: 0
  • Notification Template Name
    Example: oracle.doceng.json.BetterJsonNull@fefd4a2
  • Action associated with the Policy
    Example: Meta Event: Login Failure x3
  • Policy Author
    Example: Administrator
  • Event Watcher Policy Description
    Example: For any Login Failures by Node in the last 15 mins If any login failures occur and the Sum of Count >= 3, create this event.
  • The ID of the Meta Event that should be dispatched if the threshold condition is met for the filtered metrics
    Example: 3
  • The Name of the Meta Event that should be dispatched if the threshold condition is met for the filtered metrics
    Example: Login Failure x3
  • SQL used to select which events will be processed by this CAPE Policy's node(s)
    Example: (EventType = 'LoginLogout' AND Severity > 1 AND LastReported > (UNIX_TIMESTAMP() - 900))
  • A SQL "GROUP BY" clause that allows the filtered metrics to be grouped. Valid format is empty or a comma-delimited list of one or more Event.Events field names
    Example: Node
  • Policy ID specified for individual CRUD operations
    Example: 2
  • Event Watcher Policy Name
    Example: Login Failure x3
  • How often, in seconds, should this policy be checked
    Example: 900
  • Event Watcher Policy Status
    Example: Disabled
  • Event Watcher Policy Status Icon
    Example: OrbRed.png
  • The event watcher policy status ID. Either 0 (disabled) or 1 (enabled).
    Example: 0
  • Overall threshold operation
    Example: sum(Count) >= 3
  • Field from Event.Events DB table to use in threshold calculation. Value must be a field in Events. The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)'
    Example: Count
  • SQL Function applied to $PolicyThresholdField and compared with the $PolicyThresholdOperatorID operator against $PolicyThresholdValue The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)' Allowed Values: - count - sum - max - min - avg
    Example: sum
  • The OperatorID of the threshold calculation The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)' Allowed Values: - 0 => = - 1 => > - 2 => >= - 3 => < - 4 => <= 5 -> !=
    Example: 2
  • The numeric value used in the threshold condition. The Threshold condition is formulated as 'if ($PolicyThresholdMetric($PolicyThresholdField) $PolicyThresholdOperatorID $PolicyThresholdValue)'
    Example: 3
  • Indicates which type of search - field => Guided - sql => Manual SQL
    Example: sql
Nested Schema : Filters
Type: array
List of Filters with the Watcher
Show Source
Example:
[
    {
        "FieldName":"Ack",
        "Expression":"0",
        "FieldValue":""
    },
    {
        "FieldName":"Action",
        "Expression":"0",
        "FieldValue":""
    },
    {
        "FieldName":"Actor",
        "Expression":"0",
        "FieldValue":""
    }
]
Nested Schema : items
Type: object
Show Source

Default Response

Failed operation
Body ()
Root Schema : schema
Type: object
Show Source
Nested Schema : errors
Type: array
The list of errors reported. Validation errors will be keyed by record field.
Show Source
Nested Schema : items
Type: object
An error.
Back to Top