Sign in
Event Processing Policy

Get event processing policy rule

Retrieve a single event processing policy rule by its GUID.

get/v1/event-processing-policy/rules/{rule-guid}

Path parameters

rule-guidstring uuid required

Rule GUID

Response

Rule retrieved successfully

guidstring uuid

Rule GUID. A new random GUID is generated on input if omitted.

ruleNumberinteger

1-based position of the rule in its chain (output only; ignored on input - array order is authoritative)

chainIdinteger

ID of the chain containing the rule, 0 for the main chain (output only; on input the rule belongs to the chain being updated)

chainCallsinteger[]

IDs of chains entered when the rule matches, in order. Calls are made after the rule's own actions; a call to a chain that is already active for the event is skipped and reported by the SYS_EPP_CHAIN_LOOP event.

flagsinteger

Rule flags bitmask: 0x000001 stop processing, 0x000002 negated source match, 0x000004 negated event match, 0x000008 generate alarm, 0x000010 disabled, 0x000020 terminate alarms by regular expression, 0x000100..0x001000 match severity (info/warning/minor/major/critical), 0x002000 create helpdesk ticket, 0x004000 accept correlated events, 0x008000 negated time frame match, 0x010000 start downtime, 0x020000 end downtime, 0x040000 request AI comment, 0x080000 create incident, 0x100000 AI analyze incident, 0x200000 AI auto-assign incident

sourcesinteger[]

Source object IDs the rule matches (empty = match any source)

sourceExclusionsinteger[]

Source object IDs explicitly excluded from matching

eventsinteger[]

Event codes the rule matches (empty = match any event)

filterScriptstring

NXSL filter script source; rule matches only if the script returns true

alarmSeverityinteger

Severity of the generated alarm: 0=Normal, 1=Warning, 2=Minor, 3=Major, 4=Critical, 5=same as event, 6=terminate alarms, 7=resolve alarms

alarmKeystring

Alarm key template (supports macro expansion)

alarmMessagestring

Alarm message template (supports macro expansion)

alarmImpactstring

Alarm impact description template

alarmTimeoutinteger

Alarm timeout in seconds (0 = no timeout)

alarmTimeoutEventinteger

Event code generated when the alarm times out

alarmCategoriesinteger[]

Alarm category IDs assigned to the generated alarm

alarmCategoryScriptstring

Name of the library script returning alarm categories for the generated alarm (replaces alarmCategories when set)

rootCauseAnalysisScriptstring

Name of the library script used for root cause analysis

timerCancellationsstring[]

Timer keys to cancel when the rule matches

actionScriptstring

NXSL action script executed when the rule matches

pstorageSetActionsobject

Persistent storage entries to set (key/value pairs; values support macro expansion)

pstorageDeleteActionsstring[]

Persistent storage keys to delete

customAttributeSetActionsobject

Custom attributes to set on the source object (key/value pairs; values support macro expansion)

customAttributeDeleteActionsstring[]

Custom attribute names to delete from the source object

downtimeTagstring

Downtime tag used when starting or ending maintenance downtime

incidentDelayinteger

Delay in seconds before an incident is created (0 = immediate)

incidentTitlestring

Incident title template (empty = use alarm message)

incidentDescriptionstring

Incident description template

incidentAIAnalysisDepthinteger

Depth of AI incident analysis (0=quick, 1=standard, 2=thorough)

incidentAIPromptstring

Custom AI analysis instructions for the incident

aiAgentInstructionsstring

Instructions for the AI agent when generating an alarm comment

commentsstring

Rule description

Changes

Changed in 8 of the 115 revisions of this API.227

  • 4fd66f32833f2See the full diff
    • ○

      added the optional property to the response with the status

      response-optional-property-added

    • ○

      added the optional property to the response with the status

      response-optional-property-added

    This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • c2492179ed182See the full diff
    • ●

      removed the optional property from the response with the status

      response-optional-property-removed

    • ●

      removed the optional property from the response with the status

      response-optional-property-removed

    This revision also has 4 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • 3aeada4e28f82See the full diff
    • ○

      added the optional property to the response with the status

      response-optional-property-added

    • ○

      added the optional property to the response with the status

      response-optional-property-added

    This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • 4e1f9580c5b01See the full diff
    • ▲

      the response property became nullable for the status

      response-property-became-nullable

    This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • e1509f7b65d51See the full diff
    • ○

      added the optional property to the response with the status

      response-optional-property-added

  • 5c4e62ff38ff1See the full diff
    • ○

      added the optional property to the response with the status

      response-optional-property-added

  • ffc1b9ccf0c91See the full diff
    • ○

      endpoint added

      endpoint-added

  • c6aaf3632e481See the full diff
    • ▲

      api path removed without deprecation

      api-path-removed-without-deprecation

    This revision also has 40 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog