REST API for Unified Assurance Core

Create an Event Supervised Correlation Policy

post

/api/event/SupervisedCorrelations/

Creates a new event supervised correlation policy.
The minimum required properties in the request body are:

SupervisedCorrelationName
MatchFields
RootMatchOperators
SymptomMatchOperators
MetaEventID
GroupByFields
MinimumMembers
TimeWindow

You must also include properties for the field set in MatchFields as <Field> and <Field>Root. For example, if you set the value of MatchFields to ["Ack"], you must also include AckRoot and Ack. The RootMatchOperators values are applied to the corresponding root cause field by array index. The SymptomMatchOperators values are applied to the corresponding symptom field by array index. The legacy MatchOperators property is accepted as an alias for RootMatchOperators.

Request

There are no request parameters for this operation.

Supported Media Types

application/json

Root Schema : schema

Type: object

Show Source

GroupByFields: string

The event field or fields to group by

Example: Ack
MatchFields: MatchFields

The event fields that must have matching values to fit the cluster
~~MatchOperators:~~ MatchOperators

Legacy root cause operator property. Use RootMatchOperators for new integrations.
MetaEventID: MetaEventID

Meta event to create as the root cause
MinimumMembers: integer

Minimum number of events to establish an event cluster based on the correlation policy definition

Example: 1
RootMatchOperators: RootMatchOperators

The root cause operators for the match fields, in the same order as MatchFields
StatusID: integer

The supervised correlation status ID. Either 0 (disabled) or 1 (enabled).

Example: 1
SupervisedCorrelationName: string

The supervised correlation name.
To avoid confusion with numeric IDs, the name value cannot be integers only or integers prefixed with the + or - symbols only. It must contain letters or other characters. For example, 1234, +1234, and -1234 are not valid, but US1234, US+1234 and US_1234 are.

Example: SC Name
SymptomMatchOperators: SymptomMatchOperators

The symptom operators for the match fields, in the same order as MatchFields
TimeWindow: integer

Length of the time window for the correlation policy, in seconds

Example: 30

{
    "type":"object",
    "properties":{
        "SupervisedCorrelationName":{
            "description":"The supervised correlation name.\n<br>To avoid confusion with numeric IDs, the name value cannot be integers only or integers prefixed with the + or - symbols only. It must contain letters or other characters. For example, <b>1234</b>, <b>+1234</b>, and <b>-1234</b> are not valid, but <b>US1234</b>, <b>US+1234</b> and <b>US_1234</b> are.",
            "type":"string",
            "example":"SC Name"
        },
        "MatchFields":{
            "$ref":"#/components/schemas/eventSupervisedCorrelationsRead/properties/MatchFields"
        },
        "MatchOperators":{
            "$ref":"#/components/schemas/eventSupervisedCorrelationsRead/properties/MatchOperators"
        },
        "RootMatchOperators":{
            "$ref":"#/components/schemas/eventSupervisedCorrelationsRead/properties/RootMatchOperators"
        },
        "SymptomMatchOperators":{
            "$ref":"#/components/schemas/eventSupervisedCorrelationsRead/properties/SymptomMatchOperators"
        },
        "MetaEventID":{
            "$ref":"#/components/schemas/eventSupervisedCorrelationsRead/properties/MetaEventID"
        },
        "GroupByFields":{
            "$ref":"#/components/schemas/eventSupervisedCorrelationsRead/properties/GroupByFields"
        },
        "MinimumMembers":{
            "$ref":"#/components/schemas/eventSupervisedCorrelationsRead/properties/MinimumMembers"
        },
        "TimeWindow":{
            "$ref":"#/components/schemas/eventSupervisedCorrelationsRead/properties/TimeWindow"
        },
        "StatusID":{
            "$ref":"#/components/schemas/eventSupervisedCorrelationsRead/properties/StatusID"
        }
    }
}

Nested Schema : MatchFields

The event fields that must have matching values to fit the cluster

Match One Schema

Show Source

array MatchFields-oneOf[0]
string

{
    "description":"The event fields that must have matching values to fit the cluster",
    "oneOf":[
        {
            "type":"array"
        },
        {
            "type":"string"
        }
    ],
    "example":"SubNode"
}

Example:

SubNode

Nested Schema : MatchOperators

Legacy root cause operator property. Use RootMatchOperators for new integrations.

Match One Schema

Show Source

array MatchOperators-oneOf[0]
string

{
    "description":"Legacy root cause operator property. Use RootMatchOperators for new integrations.",
    "deprecated":true,
    "oneOf":[
        {
            "type":"array",
            "items":{
                "type":"string",
                "enum":[
                    "=",
                    "!=",
                    ">",
                    ">=",
                    "<",
                    "<=",
                    "LIKE",
                    "NOT LIKE",
                    "REGEXP",
                    "NOT REGEXP"
                ]
            }
        },
        {
            "type":"string"
        }
    ],
    "example":"="
}

Example:

Nested Schema : MetaEventID

Meta event to create as the root cause

Match One Schema

Show Source

string
integer

{
    "description":"Meta event to create as the root cause",
    "oneOf":[
        {
            "type":"string"
        },
        {
            "type":"integer"
        }
    ],
    "example":"1"
}

Example:

Nested Schema : RootMatchOperators

The root cause operators for the match fields, in the same order as MatchFields

Match One Schema

Show Source

array RootMatchOperators-oneOf[0]
string

{
    "description":"The root cause operators for the match fields, in the same order as MatchFields",
    "oneOf":[
        {
            "type":"array",
            "items":{
                "type":"string",
                "enum":[
                    "=",
                    "!=",
                    ">",
                    ">=",
                    "<",
                    "<=",
                    "LIKE",
                    "NOT LIKE",
                    "REGEXP",
                    "NOT REGEXP"
                ]
            }
        },
        {
            "type":"string"
        }
    ],
    "example":"="
}

Example:

Nested Schema : SymptomMatchOperators

The symptom operators for the match fields, in the same order as MatchFields

Match One Schema

Show Source

array SymptomMatchOperators-oneOf[0]
string

{
    "description":"The symptom operators for the match fields, in the same order as MatchFields",
    "oneOf":[
        {
            "type":"array",
            "items":{
                "type":"string",
                "enum":[
                    "=",
                    "!=",
                    ">",
                    ">=",
                    "<",
                    "<=",
                    "LIKE",
                    "NOT LIKE",
                    "REGEXP",
                    "NOT REGEXP"
                ]
            }
        },
        {
            "type":"string"
        }
    ],
    "example":"="
}

Example:

Nested Schema : MatchFields-oneOf[0]

Type: array

Nested Schema : MatchOperators-oneOf[0]

Type: array

Show Source

Array of: string

Allowed Values: [ "=", "!=", ">", ">=", "<", "<=", "LIKE", "NOT LIKE", "REGEXP", "NOT REGEXP" ]

{
    "type":"array",
    "items":{
        "type":"string",
        "enum":[
            "=",
            "!=",
            ">",
            ">=",
            "<",
            "<=",
            "LIKE",
            "NOT LIKE",
            "REGEXP",
            "NOT REGEXP"
        ]
    }
}

Nested Schema : RootMatchOperators-oneOf[0]

Type: array

Show Source

Array of: string

Allowed Values: [ "=", "!=", ">", ">=", "<", "<=", "LIKE", "NOT LIKE", "REGEXP", "NOT REGEXP" ]

{
    "type":"array",
    "items":{
        "type":"string",
        "enum":[
            "=",
            "!=",
            ">",
            ">=",
            "<",
            "<=",
            "LIKE",
            "NOT LIKE",
            "REGEXP",
            "NOT REGEXP"
        ]
    }
}

Nested Schema : SymptomMatchOperators-oneOf[0]

Type: array

Show Source

Array of: string

Allowed Values: [ "=", "!=", ">", ">=", "<", "<=", "LIKE", "NOT LIKE", "REGEXP", "NOT REGEXP" ]

{
    "type":"array",
    "items":{
        "type":"string",
        "enum":[
            "=",
            "!=",
            ">",
            ">=",
            "<",
            "<=",
            "LIKE",
            "NOT LIKE",
            "REGEXP",
            "NOT REGEXP"
        ]
    }
}

Response

Supported Media Types

application/json

200 Response

Successful operation

Root Schema : schema

Match All

Show Source

object SuccessfulAddOperation

The response body for a successful add operation.
object type

{
    "allOf":[
        {
            "$ref":"#/components/schemas/SuccessfulAddOperation"
        },
        {
            "type":"object",
            "properties":{
                "data":{
                    "description":"The properties of the new event supervised correlation policy.",
                    "type":"array",
                    "items":{
                        "$ref":"#/components/schemas/eventSupervisedCorrelationsRead"
                    }
                },
                "total":{
                    "description":"The total number of results regardless of paging.",
                    "type":"integer",
                    "example":"1"
                }
            }
        }
    ]
}

Nested Schema : SuccessfulAddOperation

Type: object

The response body for a successful add operation.

Show Source

message: string

The response message.

Example: Added record
success: boolean

Whether the operation was a success (true) or a failure (false).

Example: true

{
    "description":"The response body for a successful add operation.",
    "properties":{
        "success":{
            "description":"Whether the operation was a success (<b>true</b>) or a failure (<b>false</b>).",
            "type":"boolean",
            "example":"true"
        },
        "message":{
            "description":"The response message.",
            "type":"string",
            "example":"Added record"
        }
    },
    "type":"object"
}

Nested Schema : type

Type: object

Show Source

data: array data

The properties of the new event supervised correlation policy.
total: integer

The total number of results regardless of paging.

Example: 1

{
    "type":"object",
    "properties":{
        "data":{
            "description":"The properties of the new event supervised correlation policy.",
            "type":"array",
            "items":{
                "$ref":"#/components/schemas/eventSupervisedCorrelationsRead"
            }
        },
        "total":{
            "description":"The total number of results regardless of paging.",
            "type":"integer",
            "example":"1"
        }
    }
}

Nested Schema : data

Type: array

The properties of the new event supervised correlation policy.

Show Source

Array of: object eventSupervisedCorrelationsRead

{
    "description":"The properties of the new event supervised correlation policy.",
    "type":"array",
    "items":{
        "$ref":"#/components/schemas/eventSupervisedCorrelationsRead"
    }
}

Nested Schema : eventSupervisedCorrelationsRead

Type: object

Show Source

GroupByFields: string

The event field or fields to group by

Example: Ack
MatchFields: MatchFields

The event fields that must have matching values to fit the cluster
MatchFieldValues: MatchFieldValues

The values of the match fields
~~MatchOperators:~~ MatchOperators

Legacy root cause operator property. Use RootMatchOperators for new integrations.
MetaEventID: MetaEventID

Meta event to create as the root cause
MinimumMembers: integer

Minimum number of events to establish an event cluster based on the correlation policy definition

Example: 1
RootCause: integer

Root Cause

Example: 1
RootFlags: integer

Root flags

Example: 0
RootMatchOperators: RootMatchOperators

The root cause operators for the match fields, in the same order as MatchFields
Status: string

Current Status

Example: Enabled
StatusID: integer

The supervised correlation status ID. Either 0 (disabled) or 1 (enabled).

Example: 1
SupervisedCorrelationID: integer

Event to be modified as either the root cause or correlated to another event

Example: 1037
SupervisedCorrelationName: string

Name of the supervised correlation policy

Example: test name
SymptomMatchOperators: SymptomMatchOperators

The symptom operators for the match fields, in the same order as MatchFields
TimeWindow: integer

Length of the time window for the correlation policy, in seconds

Example: 30

{
    "type":"object",
    "properties":{
        "SupervisedCorrelationID":{
            "description":"Event to be modified as either the root cause or correlated to another event",
            "type":"integer",
            "example":"1037"
        },
        "SupervisedCorrelationName":{
            "description":"Name of the supervised correlation policy",
            "type":"string",
            "example":"test name"
        },
        "GroupByFields":{
            "description":"The event field or fields to group by",
            "type":"string",
            "example":"Ack"
        },
        "MinimumMembers":{
            "description":"Minimum number of events to establish an event cluster based on the correlation policy definition",
            "type":"integer",
            "example":"1"
        },
        "TimeWindow":{
            "description":"Length of the time window for the correlation policy, in seconds",
            "type":"integer",
            "example":"30"
        },
        "MetaEventID":{
            "description":"Meta event to create as the root cause",
            "oneOf":[
                {
                    "type":"string"
                },
                {
                    "type":"integer"
                }
            ],
            "example":"1"
        },
        "RootCause":{
            "description":"Root Cause",
            "type":"integer",
            "example":"1"
        },
        "StatusID":{
            "description":"The supervised correlation status ID. Either <b>0</b> (disabled) or <b>1</b> (enabled).",
            "type":"integer",
            "example":"1"
        },
        "Status":{
            "description":"Current Status",
            "type":"string",
            "example":"Enabled"
        },
        "RootFlags":{
            "description":"Root flags",
            "type":"integer",
            "example":"0"
        },
        "MatchFields":{
            "description":"The event fields that must have matching values to fit the cluster",
            "oneOf":[
                {
                    "type":"array"
                },
                {
                    "type":"string"
                }
            ],
            "example":"SubNode"
        },
        "MatchOperators":{
            "description":"Legacy root cause operator property. Use RootMatchOperators for new integrations.",
            "deprecated":true,
            "oneOf":[
                {
                    "type":"array",
                    "items":{
                        "type":"string",
                        "enum":[
                            "=",
                            "!=",
                            ">",
                            ">=",
                            "<",
                            "<=",
                            "LIKE",
                            "NOT LIKE",
                            "REGEXP",
                            "NOT REGEXP"
                        ]
                    }
                },
                {
                    "type":"string"
                }
            ],
            "example":"="
        },
        "RootMatchOperators":{
            "description":"The root cause operators for the match fields, in the same order as MatchFields",
            "oneOf":[
                {
                    "type":"array",
                    "items":{
                        "type":"string",
                        "enum":[
                            "=",
                            "!=",
                            ">",
                            ">=",
                            "<",
                            "<=",
                            "LIKE",
                            "NOT LIKE",
                            "REGEXP",
                            "NOT REGEXP"
                        ]
                    }
                },
                {
                    "type":"string"
                }
            ],
            "example":"="
        },
        "SymptomMatchOperators":{
            "description":"The symptom operators for the match fields, in the same order as MatchFields",
            "oneOf":[
                {
                    "type":"array",
                    "items":{
                        "type":"string",
                        "enum":[
                            "=",
                            "!=",
                            ">",
                            ">=",
                            "<",
                            "<=",
                            "LIKE",
                            "NOT LIKE",
                            "REGEXP",
                            "NOT REGEXP"
                        ]
                    }
                },
                {
                    "type":"string"
                }
            ],
            "example":"="
        },
        "MatchFieldValues":{
            "description":"The values of the match fields",
            "oneOf":[
                {
                    "type":"array"
                },
                {
                    "type":"string"
                }
            ],
            "example":"test"
        }
    }
}

Nested Schema : MatchFields

The event fields that must have matching values to fit the cluster

Match One Schema

Show Source

array MatchFields-oneOf[0]
string

{
    "description":"The event fields that must have matching values to fit the cluster",
    "oneOf":[
        {
            "type":"array"
        },
        {
            "type":"string"
        }
    ],
    "example":"SubNode"
}

Example:

SubNode

Nested Schema : MatchFieldValues

The values of the match fields

Match One Schema

Show Source

array MatchFieldValues-oneOf[0]
string

{
    "description":"The values of the match fields",
    "oneOf":[
        {
            "type":"array"
        },
        {
            "type":"string"
        }
    ],
    "example":"test"
}

Example:

test

Nested Schema : MatchOperators

Legacy root cause operator property. Use RootMatchOperators for new integrations.

Match One Schema

Show Source

array MatchOperators-oneOf[0]
string

{
    "description":"Legacy root cause operator property. Use RootMatchOperators for new integrations.",
    "deprecated":true,
    "oneOf":[
        {
            "type":"array",
            "items":{
                "type":"string",
                "enum":[
                    "=",
                    "!=",
                    ">",
                    ">=",
                    "<",
                    "<=",
                    "LIKE",
                    "NOT LIKE",
                    "REGEXP",
                    "NOT REGEXP"
                ]
            }
        },
        {
            "type":"string"
        }
    ],
    "example":"="
}

Example:

Nested Schema : MetaEventID

Meta event to create as the root cause

Match One Schema

Show Source

string
integer

{
    "description":"Meta event to create as the root cause",
    "oneOf":[
        {
            "type":"string"
        },
        {
            "type":"integer"
        }
    ],
    "example":"1"
}

Example:

Nested Schema : RootMatchOperators

The root cause operators for the match fields, in the same order as MatchFields

Match One Schema

Show Source

array RootMatchOperators-oneOf[0]
string

{
    "description":"The root cause operators for the match fields, in the same order as MatchFields",
    "oneOf":[
        {
            "type":"array",
            "items":{
                "type":"string",
                "enum":[
                    "=",
                    "!=",
                    ">",
                    ">=",
                    "<",
                    "<=",
                    "LIKE",
                    "NOT LIKE",
                    "REGEXP",
                    "NOT REGEXP"
                ]
            }
        },
        {
            "type":"string"
        }
    ],
    "example":"="
}

Example:

Nested Schema : SymptomMatchOperators

The symptom operators for the match fields, in the same order as MatchFields

Match One Schema

Show Source

array SymptomMatchOperators-oneOf[0]
string

{
    "description":"The symptom operators for the match fields, in the same order as MatchFields",
    "oneOf":[
        {
            "type":"array",
            "items":{
                "type":"string",
                "enum":[
                    "=",
                    "!=",
                    ">",
                    ">=",
                    "<",
                    "<=",
                    "LIKE",
                    "NOT LIKE",
                    "REGEXP",
                    "NOT REGEXP"
                ]
            }
        },
        {
            "type":"string"
        }
    ],
    "example":"="
}

Example:

Nested Schema : MatchFields-oneOf[0]

Type: array

Nested Schema : MatchFieldValues-oneOf[0]

Type: array

Nested Schema : MatchOperators-oneOf[0]

Type: array

Show Source

Array of: string

Allowed Values: [ "=", "!=", ">", ">=", "<", "<=", "LIKE", "NOT LIKE", "REGEXP", "NOT REGEXP" ]

{
    "type":"array",
    "items":{
        "type":"string",
        "enum":[
            "=",
            "!=",
            ">",
            ">=",
            "<",
            "<=",
            "LIKE",
            "NOT LIKE",
            "REGEXP",
            "NOT REGEXP"
        ]
    }
}

Nested Schema : RootMatchOperators-oneOf[0]

Type: array

Show Source

Array of: string

Allowed Values: [ "=", "!=", ">", ">=", "<", "<=", "LIKE", "NOT LIKE", "REGEXP", "NOT REGEXP" ]

{
    "type":"array",
    "items":{
        "type":"string",
        "enum":[
            "=",
            "!=",
            ">",
            ">=",
            "<",
            "<=",
            "LIKE",
            "NOT LIKE",
            "REGEXP",
            "NOT REGEXP"
        ]
    }
}

Nested Schema : SymptomMatchOperators-oneOf[0]

Type: array

Show Source

Array of: string

Allowed Values: [ "=", "!=", ">", ">=", "<", "<=", "LIKE", "NOT LIKE", "REGEXP", "NOT REGEXP" ]

{
    "type":"array",
    "items":{
        "type":"string",
        "enum":[
            "=",
            "!=",
            ">",
            ">=",
            "<",
            "<=",
            "LIKE",
            "NOT LIKE",
            "REGEXP",
            "NOT REGEXP"
        ]
    }
}

Default Response

Failed operation

Root Schema : schema

Type: object

Show Source

errors: array errors

The list of errors reported. Validation errors will be keyed by record field.
message: string

The response message.

Example: Exception thrown
success: boolean

Whether the operation was a success (true) or a failure (false).

Example: false

{
    "properties":{
        "success":{
            "description":"Whether the operation was a success (<b>true</b>) or a failure (<b>false</b>).",
            "type":"boolean",
            "example":"false"
        },
        "message":{
            "description":"The response message.",
            "type":"string",
            "example":"Exception thrown"
        },
        "errors":{
            "description":"The list of errors reported. Validation errors will be keyed by record field.",
            "type":"array",
            "items":{
                "description":"An error.",
                "type":"object"
            }
        }
    },
    "type":"object"
}

Nested Schema : errors

Type: array

The list of errors reported. Validation errors will be keyed by record field.

Show Source

Array of: object items

An error.

{
    "description":"The list of errors reported. Validation errors will be keyed by record field.",
    "type":"array",
    "items":{
        "description":"An error.",
        "type":"object"
    }
}

Nested Schema : items

Type: object

An error.