Event Management

Live

Event Management

+ Day(s) remaining in the trial

Overview

Event Management can receive events from various sources, either on premise or in the cloud. Events indicate that something has happened on an application, service, or another monitored object. Based on the affected resources, events are correlated into a single incident. Resolving the incident solves the problem and all underlying events, and restores service. Your URL for making the API calls can be formed by replacing CEM_DOMAIN_NAME with the fully qualified domain name specified in your service credentials.

Security

Keys

Pick a key to use with this API. Make sure you are logged in with your IBM id for your keys to be populated in the dropdown below. By selecting a key, it will be pre-filled for each endpoint in the Documentation section that can be used with the built-in testing. If you want to change which key to use for a particular endpoint, you can do so at the endpoint in the Documentation section.
You can manage your API keys in the <MyAPIs> section. API keys authenticate you to your subscription, so make sure to keep them secret. Do not share the X-IBM-Client-Secret portion of any API key in publicly accessible places such as GitHub, or client-side code.



Manage your keys
 

Documentation

Event Management:

/eventPolicies

changePoliciesExecOrder
Sets the new order on a list of policies in a subscription.

PUT   /eventPolicies/v2/executionOrder

			https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2/executionOrder
		
Keys
Header parameters

commonauth

STRING , required

API key + IBMid + UAA

Request code
								
HttpResponse<String> response = Unirest.put("https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2/executionOrder") .header("authorization", "Basic REPLACE_BASIC_AUTH") .asString();
Response model

204

Successful request

401

Unauthorized

Body

object , optional

403

Not authorized

Body

object , optional

500

Error updating policy

Body

object , optional

Response example

204

Successful request

401

Unauthorized

								{
  "" : object
}
							

403

Not authorized

								{
  "" : object
}
							

500

Error updating policy

								{
  "" : object
}
							
createEventPolicy
Creates an event policy within a subscription

POST   /eventPolicies/v2

			https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2
		
Keys
Header parameters

commonauth

STRING , required

API key + IBMid + UAA

Request code
								
HttpResponse<String> response = Unirest.post("https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2") .header("authorization", "Basic REPLACE_BASIC_AUTH") .asString();
Request model

actions

OBJECT , optional

author

STRING , optional

Name of the user who created the policy

created

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and thus eligible to be matched to alerts

executionOrder

INTEGER , optional

The execution order of this policy relative to the other policies in the system

id

STRING , optional

Unique reference for this policy

lastRun

STRING , optional

The time when this policy was last run in a RFC 3339 format timestamp. This parameter is omitted if the policy has never been run

lastUpdated

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp. Set to created time if this policy has never been updated

lastUpdatedBy

STRING , optional

The name of the user who last modified this policy. Set to creator if this policy has never been updated

name

STRING , optional

Name of the event policy. Must be unique.

applyAll

BOOLEAN , optional

If this is set to true, the policy applies to all events and any custom conditions are ignored. Either applyAll or conditions must be specified

author

STRING , optional

Name of the user who created the policy. Stores a value based off API key if not specified.

condition

OBJECT , optional

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and will be considered when processing events

name

STRING , optional

Unique name of the event policy. Note this is required when creating a policy (POST) but not on an update (PUT).

enrich

OBJECT , optional

flapping

OBJECT , optional

runbook

OBJECT , optional

suppress

OBJECT , optional

enabled

BOOLEAN , required

Action is enabled

enrichmentArray

ARRAY , optional

One or more enrichments to add to the event when this policy's condition is met

action

STRING , optional

How the value should be combined with the original value for string event attributes

attribute

OBJECT , required

value

STRING , required

The value to enrich the event with

ENUM

STRING , optional

Event attributes that can be updated during enrichment

clearSeconds

INTEGER , required

The period after the last state change before the event is no longer identified as flapping

count

INTEGER , required

The number of state changes that will cause the event to be identified as flapping

enabled

BOOLEAN , required

Action is enabled

flappingSeconds

INTEGER , required

Maximum period state changes should be counted

enabled

BOOLEAN , required

Action is enabled

runbooksArray

ARRAY , optional

One or more runbooks to run when this policy's condition is met'

is_auto

BOOLEAN , optional

Should the runbook be executed automatically

parameters

ARRAY , optional

runbookID

STRING , required

specific Runbook ID

attribute

STRING , optional

If the mapping is of type eventAttribute, this must be the name of an event attribute. If the mapping of type manual, this must be the value to be used. If the mapping is of type runtime, the field is ignored and can be left blank

mapping

STRING , required

Source for parameter's value'

name

STRING , required

Runbook's parameter name

enabled

BOOLEAN , required

Action is enabled

identicalEvents

INTEGER , optional

Number of identical events (X)

suppressCondition

STRING , required

Condition used to supress events

timePeriod

INTEGER , optional

Time period in units specified. Should not exceed one day

timeUnits

STRING , optional

Time period units

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used when evaluating multiple conditions

value

ARRAY , required

List of conditions used to match events to the policy. 0 length array signals no conditions specified

attribute

OBJECT , required

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used to check the value against the attribute. An empty value is accepted when the document is created as long as the policy is not enabled. It must not be empty if the policy is enabled and applyAll is false

value

STRING , optional

The value to be checked using the operator and attribute. The value is not required for the 'is empty' and 'is not empty' operators.

ENUM

STRING , optional

event attribute for this value.

Request example
{
  "actions": {
    "enrich": {
    "enabled": boolean,
    "enrichmentArray": [{
    "action": [overwrite, append, prepend],
    "attribute": {
    "ENUM": [event.severity, event.summary, event.expiryTime, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.type.eventType]
  },
    "value": string
  }]
  },
    "flapping": {
    "clearSeconds": integer,
    "count": integer,
    "enabled": boolean,
    "flappingSeconds": integer
  },
    "runbook": {
    "enabled": boolean,
    "runbooksArray": [{
    "is_auto": boolean,
    "parameters": [{
    "attribute": string,
    "mapping": [eventAttribute, manual, runtime],
    "name": string
  }],
    "runbookID": string
  }]
  },
    "suppress": {
    "enabled": boolean,
    "identicalEvents": integer,
    "suppressCondition": [all, XinY],
    "timePeriod": integer,
    "timeUnits": [seconds, minutes, hours]
  }
  },
  "author": string,
  "created": string,
  "description": string,
  "enabled": boolean,
  "executionOrder": integer,
  "id": string,
  "lastRun": string,
  "lastUpdated": string,
  "lastUpdatedBy": string,
  "name": string,
  "applyAll": boolean,
  "author": string,
  "condition": {
    "id": string,
    "operator": [and, or],
    "value": [{
    "attribute": {
    "ENUM": [event.summary, event.severity, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.sender.displayName, event.sender.name, event.sender.sourceId, event.sender.type, event.type.eventType, event.type.statusOrThreshold]
  },
    "id": string,
    "operator": [==, !=, >, >=, <, <=, contains, does not contain, starts with, ends with, is empty, is not empty],
    "value": string
  }]
  },
  "description": string,
  "enabled": boolean,
  "name": string
}
Response model

201

Policy successfully created

Body

actions [actionsPayload]

OBJECT , optional

author

STRING , optional

Name of the user who created the policy

created

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and thus eligible to be matched to alerts

executionOrder

INTEGER , optional

The execution order of this policy relative to the other policies in the system

id

STRING , optional

Unique reference for this policy

lastRun

STRING , optional

The time when this policy was last run in a RFC 3339 format timestamp. This parameter is omitted if the policy has never been run

lastUpdated

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp. Set to created time if this policy has never been updated

lastUpdatedBy

STRING , optional

The name of the user who last modified this policy. Set to creator if this policy has never been updated

name

STRING , optional

Name of the event policy. Must be unique.

applyAll

BOOLEAN , optional

If this is set to true, the policy applies to all events and any custom conditions are ignored. Either applyAll or conditions must be specified

author

STRING , optional

Name of the user who created the policy. Stores a value based off API key if not specified.

condition [conditionsPayload]

OBJECT , optional

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and will be considered when processing events

name

STRING , optional

Unique name of the event policy. Note this is required when creating a policy (POST) but not on an update (PUT).

enrich [enrichAction]

OBJECT , optional

flapping [flappingAction]

OBJECT , optional

runbook [runbookAction]

OBJECT , optional

suppress [suppressAction]

OBJECT , optional

enabled

BOOLEAN , required

Action is enabled

enrichmentArray [enrichments]

ARRAY , optional

One or more enrichments to add to the event when this policy's condition is met

action

STRING , optional

How the value should be combined with the original value for string event attributes

attribute [EnrichmentAttribute]

OBJECT , required

value

STRING , required

The value to enrich the event with

ENUM

STRING , optional

Event attributes that can be updated during enrichment

clearSeconds

INTEGER , required

The period after the last state change before the event is no longer identified as flapping

count

INTEGER , required

The number of state changes that will cause the event to be identified as flapping

enabled

BOOLEAN , required

Action is enabled

flappingSeconds

INTEGER , required

Maximum period state changes should be counted

enabled

BOOLEAN , required

Action is enabled

runbooksArray [runbooksRuntime]

ARRAY , optional

One or more runbooks to run when this policy's condition is met'

is_auto

BOOLEAN , optional

Should the runbook be executed automatically

parameters

ARRAY , optional

runbookID

STRING , required

specific Runbook ID

attribute

STRING , optional

If the mapping is of type eventAttribute, this must be the name of an event attribute. If the mapping of type manual, this must be the value to be used. If the mapping is of type runtime, the field is ignored and can be left blank

mapping

STRING , required

Source for parameter's value'

name

STRING , required

Runbook's parameter name

enabled

BOOLEAN , required

Action is enabled

identicalEvents

INTEGER , optional

Number of identical events (X)

suppressCondition

STRING , required

Condition used to supress events

timePeriod

INTEGER , optional

Time period in units specified. Should not exceed one day

timeUnits

STRING , optional

Time period units

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used when evaluating multiple conditions

value [propConditions]

ARRAY , required

List of conditions used to match events to the policy. 0 length array signals no conditions specified

attribute [EventAttribute]

OBJECT , required

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used to check the value against the attribute. An empty value is accepted when the document is created as long as the policy is not enabled. It must not be empty if the policy is enabled and applyAll is false

value

STRING , optional

The value to be checked using the operator and attribute. The value is not required for the 'is empty' and 'is not empty' operators.

ENUM

STRING , optional

event attribute for this value.

400

Invalid request

Body

object , optional

401

Unauthorized

Body

object , optional

403

Not authorized

Body

object , optional

409

Already exists

Body

object , optional

Response example

201

Policy successfully created

								{
  "actions" : {
    "enrich" : {
    "enabled" : boolean,
    "enrichmentArray" : [{
    "action" : [overwrite, append, prepend],
    "attribute" : {
    "ENUM" : [event.severity, event.summary, event.expiryTime, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.type.eventType]
  },
    "value" : string
  }]
  },
    "flapping" : {
    "clearSeconds" : integer,
    "count" : integer,
    "enabled" : boolean,
    "flappingSeconds" : integer
  },
    "runbook" : {
    "enabled" : boolean,
    "runbooksArray" : [{
    "is_auto" : boolean,
    "parameters" : [{
    "attribute" : string,
    "mapping" : [eventAttribute, manual, runtime],
    "name" : string
  }],
    "runbookID" : string
  }]
  },
    "suppress" : {
    "enabled" : boolean,
    "identicalEvents" : integer,
    "suppressCondition" : [all, XinY],
    "timePeriod" : integer,
    "timeUnits" : [seconds, minutes, hours]
  }
  },
  "author" : string,
  "created" : string,
  "description" : string,
  "enabled" : boolean,
  "executionOrder" : integer,
  "id" : string,
  "lastRun" : string,
  "lastUpdated" : string,
  "lastUpdatedBy" : string,
  "name" : string,
  "applyAll" : boolean,
  "author" : string,
  "condition" : {
    "id" : string,
    "operator" : [and, or],
    "value" : [{
    "attribute" : {
    "ENUM" : [event.summary, event.severity, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.sender.displayName, event.sender.name, event.sender.sourceId, event.sender.type, event.type.eventType, event.type.statusOrThreshold]
  },
    "id" : string,
    "operator" : [==, !=, >, >=, <, <=, contains, does not contain, starts with, ends with, is empty, is not empty],
    "value" : string
  }]
  },
  "description" : string,
  "enabled" : boolean,
  "name" : string
}
							

400

Invalid request

								{
  "" : object
}
							

401

Unauthorized

								{
  "" : object
}
							

403

Not authorized

								{
  "" : object
}
							

409

Already exists

								{
  "" : object
}
							
deleteEventPolicy
Deletes a policy

DELETE   /eventPolicies/v2/{id}

			https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2/{id}
		
Keys
Header parameters

commonauth

STRING , required

API key + IBMid + UAA

Path and Query parameters

id

URL , required

Policy reference ID. This is returned by the list policies GET and uniquely identifies the policy.

Request code
								
HttpResponse<String> response = Unirest.delete("https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2/{id}") .header("authorization", "Basic REPLACE_BASIC_AUTH") .asString();
Response model

204

Successful request

401

Unauthorized

Body

object , optional

403

Not authorized

Body

object , optional

404

Unable to locate policy

500

Error deleting policy

Body

object , optional

Response example

204

Successful request

401

Unauthorized

								{
  "" : object
}
							

403

Not authorized

								{
  "" : object
}
							

404

Unable to locate policy

500

Error deleting policy

								{
  "" : object
}
							
getEventPolicies
List the summary information for all event policies within a subscription

GET   /eventPolicies/v2

			https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2
		
Keys
Header parameters

commonauth

STRING , required

API key + IBMid + UAA

Request code
								
HttpResponse<String> response = Unirest.get("https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2") .header("authorization", "Basic REPLACE_BASIC_AUTH") .asString();
Response model

200

Successful request

Body

actions [actionsPayload]

OBJECT , optional

author

STRING , optional

Name of the user who created the policy

created

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and thus eligible to be matched to alerts

executionOrder

INTEGER , optional

The execution order of this policy relative to the other policies in the system

id

STRING , optional

Unique reference for this policy

lastRun

STRING , optional

The time when this policy was last run in a RFC 3339 format timestamp. This parameter is omitted if the policy has never been run

lastUpdated

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp. Set to created time if this policy has never been updated

lastUpdatedBy

STRING , optional

The name of the user who last modified this policy. Set to creator if this policy has never been updated

name

STRING , optional

Name of the event policy. Must be unique.

enrich [enrichAction]

OBJECT , optional

flapping [flappingAction]

OBJECT , optional

runbook [runbookAction]

OBJECT , optional

suppress [suppressAction]

OBJECT , optional

enabled

BOOLEAN , required

Action is enabled

enrichmentArray [enrichments]

ARRAY , optional

One or more enrichments to add to the event when this policy's condition is met

action

STRING , optional

How the value should be combined with the original value for string event attributes

attribute [EnrichmentAttribute]

OBJECT , required

value

STRING , required

The value to enrich the event with

ENUM

STRING , optional

Event attributes that can be updated during enrichment

clearSeconds

INTEGER , required

The period after the last state change before the event is no longer identified as flapping

count

INTEGER , required

The number of state changes that will cause the event to be identified as flapping

enabled

BOOLEAN , required

Action is enabled

flappingSeconds

INTEGER , required

Maximum period state changes should be counted

enabled

BOOLEAN , required

Action is enabled

runbooksArray [runbooksRuntime]

ARRAY , optional

One or more runbooks to run when this policy's condition is met'

is_auto

BOOLEAN , optional

Should the runbook be executed automatically

parameters

ARRAY , optional

runbookID

STRING , required

specific Runbook ID

attribute

STRING , optional

If the mapping is of type eventAttribute, this must be the name of an event attribute. If the mapping of type manual, this must be the value to be used. If the mapping is of type runtime, the field is ignored and can be left blank

mapping

STRING , required

Source for parameter's value'

name

STRING , required

Runbook's parameter name

enabled

BOOLEAN , required

Action is enabled

identicalEvents

INTEGER , optional

Number of identical events (X)

suppressCondition

STRING , required

Condition used to supress events

timePeriod

INTEGER , optional

Time period in units specified. Should not exceed one day

timeUnits

STRING , optional

Time period units

400

Invalid request

Body

object , optional

401

Unauthorized

Body

object , optional

403

Not authorized

Body

object , optional

Response example

200

Successful request

								{
  "application/json" : [ {
    "actions" : {
      "enrich" : {
        "enabled" : false
      },
      "runbook" : {
        "enabled" : false
      },
      "suppress" : {
        "enabled" : true,
        "identicalEvents" : 1,
        "suppressCondition" : "XinY",
        "timePeriod" : 120,
        "timeUnits" : "seconds"
      }
    },
    "author" : "user@example.com",
    "created" : "2017-03-10T10:02:47.297Z",
    "description" : "Sample policy description",
    "enabled" : true,
    "id" : "123-abc",
    "lastRun" : 0,
    "lastUpdated" : "2017-03-10T10:03:24.672Z",
    "lastUpdatedBy" : "user@example.com",
    "name" : "SamplePolicy"
  } ]
}
							

400

Invalid request

								{
  "" : object
}
							

401

Unauthorized

								{
  "" : object
}
							

403

Not authorized

								{
  "" : object
}
							
getEventPolicy
Gets a policy

GET   /eventPolicies/v2/{id}

			https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2/{id}
		
Keys
Header parameters

commonauth

STRING , required

API key + IBMid + UAA

Path and Query parameters

id

URL , required

Policy reference ID. This is returned by the list policies GET and uniquely identifies the policy.

Request code
								
HttpResponse<String> response = Unirest.get("https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2/{id}") .header("authorization", "Basic REPLACE_BASIC_AUTH") .asString();
Response model

200

Successful request

Body

actions [actionsPayload]

OBJECT , optional

author

STRING , optional

Name of the user who created the policy

created

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and thus eligible to be matched to alerts

executionOrder

INTEGER , optional

The execution order of this policy relative to the other policies in the system

id

STRING , optional

Unique reference for this policy

lastRun

STRING , optional

The time when this policy was last run in a RFC 3339 format timestamp. This parameter is omitted if the policy has never been run

lastUpdated

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp. Set to created time if this policy has never been updated

lastUpdatedBy

STRING , optional

The name of the user who last modified this policy. Set to creator if this policy has never been updated

name

STRING , optional

Name of the event policy. Must be unique.

applyAll

BOOLEAN , optional

If this is set to true, the policy applies to all events and any custom conditions are ignored. Either applyAll or conditions must be specified

author

STRING , optional

Name of the user who created the policy. Stores a value based off API key if not specified.

condition [conditionsPayload]

OBJECT , optional

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and will be considered when processing events

name

STRING , optional

Unique name of the event policy. Note this is required when creating a policy (POST) but not on an update (PUT).

enrich [enrichAction]

OBJECT , optional

flapping [flappingAction]

OBJECT , optional

runbook [runbookAction]

OBJECT , optional

suppress [suppressAction]

OBJECT , optional

enabled

BOOLEAN , required

Action is enabled

enrichmentArray [enrichments]

ARRAY , optional

One or more enrichments to add to the event when this policy's condition is met

action

STRING , optional

How the value should be combined with the original value for string event attributes

attribute [EnrichmentAttribute]

OBJECT , required

value

STRING , required

The value to enrich the event with

ENUM

STRING , optional

Event attributes that can be updated during enrichment

clearSeconds

INTEGER , required

The period after the last state change before the event is no longer identified as flapping

count

INTEGER , required

The number of state changes that will cause the event to be identified as flapping

enabled

BOOLEAN , required

Action is enabled

flappingSeconds

INTEGER , required

Maximum period state changes should be counted

enabled

BOOLEAN , required

Action is enabled

runbooksArray [runbooksRuntime]

ARRAY , optional

One or more runbooks to run when this policy's condition is met'

is_auto

BOOLEAN , optional

Should the runbook be executed automatically

parameters

ARRAY , optional

runbookID

STRING , required

specific Runbook ID

attribute

STRING , optional

If the mapping is of type eventAttribute, this must be the name of an event attribute. If the mapping of type manual, this must be the value to be used. If the mapping is of type runtime, the field is ignored and can be left blank

mapping

STRING , required

Source for parameter's value'

name

STRING , required

Runbook's parameter name

enabled

BOOLEAN , required

Action is enabled

identicalEvents

INTEGER , optional

Number of identical events (X)

suppressCondition

STRING , required

Condition used to supress events

timePeriod

INTEGER , optional

Time period in units specified. Should not exceed one day

timeUnits

STRING , optional

Time period units

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used when evaluating multiple conditions

value [propConditions]

ARRAY , required

List of conditions used to match events to the policy. 0 length array signals no conditions specified

attribute [EventAttribute]

OBJECT , required

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used to check the value against the attribute. An empty value is accepted when the document is created as long as the policy is not enabled. It must not be empty if the policy is enabled and applyAll is false

value

STRING , optional

The value to be checked using the operator and attribute. The value is not required for the 'is empty' and 'is not empty' operators.

ENUM

STRING , optional

event attribute for this value.

401

Unauthorized

Body

object , optional

403

Not authorized

Body

object , optional

404

Unable to locate policy

Response example

200

Successful request

								{
  "actions" : {
    "enrich" : {
    "enabled" : boolean,
    "enrichmentArray" : [{
    "action" : [overwrite, append, prepend],
    "attribute" : {
    "ENUM" : [event.severity, event.summary, event.expiryTime, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.type.eventType]
  },
    "value" : string
  }]
  },
    "flapping" : {
    "clearSeconds" : integer,
    "count" : integer,
    "enabled" : boolean,
    "flappingSeconds" : integer
  },
    "runbook" : {
    "enabled" : boolean,
    "runbooksArray" : [{
    "is_auto" : boolean,
    "parameters" : [{
    "attribute" : string,
    "mapping" : [eventAttribute, manual, runtime],
    "name" : string
  }],
    "runbookID" : string
  }]
  },
    "suppress" : {
    "enabled" : boolean,
    "identicalEvents" : integer,
    "suppressCondition" : [all, XinY],
    "timePeriod" : integer,
    "timeUnits" : [seconds, minutes, hours]
  }
  },
  "author" : string,
  "created" : string,
  "description" : string,
  "enabled" : boolean,
  "executionOrder" : integer,
  "id" : string,
  "lastRun" : string,
  "lastUpdated" : string,
  "lastUpdatedBy" : string,
  "name" : string,
  "applyAll" : boolean,
  "author" : string,
  "condition" : {
    "id" : string,
    "operator" : [and, or],
    "value" : [{
    "attribute" : {
    "ENUM" : [event.summary, event.severity, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.sender.displayName, event.sender.name, event.sender.sourceId, event.sender.type, event.type.eventType, event.type.statusOrThreshold]
  },
    "id" : string,
    "operator" : [==, !=, >, >=, <, <=, contains, does not contain, starts with, ends with, is empty, is not empty],
    "value" : string
  }]
  },
  "description" : string,
  "enabled" : boolean,
  "name" : string
}
							

401

Unauthorized

								{
  "" : object
}
							

403

Not authorized

								{
  "" : object
}
							

404

Unable to locate policy

updateEventPolicy
Replace the policy with the policy payload provided. Note the conditions array is replaced by the received conditions array. Conditions are not merged.

PUT   /eventPolicies/v2/{id}

			https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2/{id}
		
Keys
Header parameters

commonauth

STRING , required

API key + IBMid + UAA

Path and Query parameters

id

URL , required

Policy reference ID. This is returned by the list policies GET and uniquely identifies the policy.

Request code
								
HttpResponse<String> response = Unirest.put("https://{CEM_DOMAIN_NAME}/api/eventPolicies/v2/{id}") .header("authorization", "Basic REPLACE_BASIC_AUTH") .asString();
Request model

actions

OBJECT , optional

author

STRING , optional

Name of the user who created the policy

created

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and thus eligible to be matched to alerts

executionOrder

INTEGER , optional

The execution order of this policy relative to the other policies in the system

id

STRING , optional

Unique reference for this policy

lastRun

STRING , optional

The time when this policy was last run in a RFC 3339 format timestamp. This parameter is omitted if the policy has never been run

lastUpdated

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp. Set to created time if this policy has never been updated

lastUpdatedBy

STRING , optional

The name of the user who last modified this policy. Set to creator if this policy has never been updated

name

STRING , optional

Name of the event policy. Must be unique.

applyAll

BOOLEAN , optional

If this is set to true, the policy applies to all events and any custom conditions are ignored. Either applyAll or conditions must be specified

author

STRING , optional

Name of the user who created the policy. Stores a value based off API key if not specified.

condition

OBJECT , optional

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and will be considered when processing events

name

STRING , optional

Unique name of the event policy. Note this is required when creating a policy (POST) but not on an update (PUT).

enrich

OBJECT , optional

flapping

OBJECT , optional

runbook

OBJECT , optional

suppress

OBJECT , optional

enabled

BOOLEAN , required

Action is enabled

enrichmentArray

ARRAY , optional

One or more enrichments to add to the event when this policy's condition is met

action

STRING , optional

How the value should be combined with the original value for string event attributes

attribute

OBJECT , required

value

STRING , required

The value to enrich the event with

ENUM

STRING , optional

Event attributes that can be updated during enrichment

clearSeconds

INTEGER , required

The period after the last state change before the event is no longer identified as flapping

count

INTEGER , required

The number of state changes that will cause the event to be identified as flapping

enabled

BOOLEAN , required

Action is enabled

flappingSeconds

INTEGER , required

Maximum period state changes should be counted

enabled

BOOLEAN , required

Action is enabled

runbooksArray

ARRAY , optional

One or more runbooks to run when this policy's condition is met'

is_auto

BOOLEAN , optional

Should the runbook be executed automatically

parameters

ARRAY , optional

runbookID

STRING , required

specific Runbook ID

attribute

STRING , optional

If the mapping is of type eventAttribute, this must be the name of an event attribute. If the mapping of type manual, this must be the value to be used. If the mapping is of type runtime, the field is ignored and can be left blank

mapping

STRING , required

Source for parameter's value'

name

STRING , required

Runbook's parameter name

enabled

BOOLEAN , required

Action is enabled

identicalEvents

INTEGER , optional

Number of identical events (X)

suppressCondition

STRING , required

Condition used to supress events

timePeriod

INTEGER , optional

Time period in units specified. Should not exceed one day

timeUnits

STRING , optional

Time period units

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used when evaluating multiple conditions

value

ARRAY , required

List of conditions used to match events to the policy. 0 length array signals no conditions specified

attribute

OBJECT , required

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used to check the value against the attribute. An empty value is accepted when the document is created as long as the policy is not enabled. It must not be empty if the policy is enabled and applyAll is false

value

STRING , optional

The value to be checked using the operator and attribute. The value is not required for the 'is empty' and 'is not empty' operators.

ENUM

STRING , optional

event attribute for this value.

Request example
{
  "actions": {
    "enrich": {
    "enabled": boolean,
    "enrichmentArray": [{
    "action": [overwrite, append, prepend],
    "attribute": {
    "ENUM": [event.severity, event.summary, event.expiryTime, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.type.eventType]
  },
    "value": string
  }]
  },
    "flapping": {
    "clearSeconds": integer,
    "count": integer,
    "enabled": boolean,
    "flappingSeconds": integer
  },
    "runbook": {
    "enabled": boolean,
    "runbooksArray": [{
    "is_auto": boolean,
    "parameters": [{
    "attribute": string,
    "mapping": [eventAttribute, manual, runtime],
    "name": string
  }],
    "runbookID": string
  }]
  },
    "suppress": {
    "enabled": boolean,
    "identicalEvents": integer,
    "suppressCondition": [all, XinY],
    "timePeriod": integer,
    "timeUnits": [seconds, minutes, hours]
  }
  },
  "author": string,
  "created": string,
  "description": string,
  "enabled": boolean,
  "executionOrder": integer,
  "id": string,
  "lastRun": string,
  "lastUpdated": string,
  "lastUpdatedBy": string,
  "name": string,
  "applyAll": boolean,
  "author": string,
  "condition": {
    "id": string,
    "operator": [and, or],
    "value": [{
    "attribute": {
    "ENUM": [event.summary, event.severity, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.sender.displayName, event.sender.name, event.sender.sourceId, event.sender.type, event.type.eventType, event.type.statusOrThreshold]
  },
    "id": string,
    "operator": [==, !=, >, >=, <, <=, contains, does not contain, starts with, ends with, is empty, is not empty],
    "value": string
  }]
  },
  "description": string,
  "enabled": boolean,
  "name": string
}
Response model

200

Successful request

Body

actions [actionsPayload]

OBJECT , optional

author

STRING , optional

Name of the user who created the policy

created

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and thus eligible to be matched to alerts

executionOrder

INTEGER , optional

The execution order of this policy relative to the other policies in the system

id

STRING , optional

Unique reference for this policy

lastRun

STRING , optional

The time when this policy was last run in a RFC 3339 format timestamp. This parameter is omitted if the policy has never been run

lastUpdated

STRING , optional

The time when this policy was created in a RFC 3339 format timestamp. Set to created time if this policy has never been updated

lastUpdatedBy

STRING , optional

The name of the user who last modified this policy. Set to creator if this policy has never been updated

name

STRING , optional

Name of the event policy. Must be unique.

applyAll

BOOLEAN , optional

If this is set to true, the policy applies to all events and any custom conditions are ignored. Either applyAll or conditions must be specified

author

STRING , optional

Name of the user who created the policy. Stores a value based off API key if not specified.

condition [conditionsPayload]

OBJECT , optional

description

STRING , optional

Description of the event policy

enabled

BOOLEAN , optional

True if this event policy is enabled and will be considered when processing events

name

STRING , optional

Unique name of the event policy. Note this is required when creating a policy (POST) but not on an update (PUT).

enrich [enrichAction]

OBJECT , optional

flapping [flappingAction]

OBJECT , optional

runbook [runbookAction]

OBJECT , optional

suppress [suppressAction]

OBJECT , optional

enabled

BOOLEAN , required

Action is enabled

enrichmentArray [enrichments]

ARRAY , optional

One or more enrichments to add to the event when this policy's condition is met

action

STRING , optional

How the value should be combined with the original value for string event attributes

attribute [EnrichmentAttribute]

OBJECT , required

value

STRING , required

The value to enrich the event with

ENUM

STRING , optional

Event attributes that can be updated during enrichment

clearSeconds

INTEGER , required

The period after the last state change before the event is no longer identified as flapping

count

INTEGER , required

The number of state changes that will cause the event to be identified as flapping

enabled

BOOLEAN , required

Action is enabled

flappingSeconds

INTEGER , required

Maximum period state changes should be counted

enabled

BOOLEAN , required

Action is enabled

runbooksArray [runbooksRuntime]

ARRAY , optional

One or more runbooks to run when this policy's condition is met'

is_auto

BOOLEAN , optional

Should the runbook be executed automatically

parameters

ARRAY , optional

runbookID

STRING , required

specific Runbook ID

attribute

STRING , optional

If the mapping is of type eventAttribute, this must be the name of an event attribute. If the mapping of type manual, this must be the value to be used. If the mapping is of type runtime, the field is ignored and can be left blank

mapping

STRING , required

Source for parameter's value'

name

STRING , required

Runbook's parameter name

enabled

BOOLEAN , required

Action is enabled

identicalEvents

INTEGER , optional

Number of identical events (X)

suppressCondition

STRING , required

Condition used to supress events

timePeriod

INTEGER , optional

Time period in units specified. Should not exceed one day

timeUnits

STRING , optional

Time period units

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used when evaluating multiple conditions

value [propConditions]

ARRAY , required

List of conditions used to match events to the policy. 0 length array signals no conditions specified

attribute [EventAttribute]

OBJECT , required

id

STRING , optional

Unique id for this condition -- md5 hash of the stringified version of this JSON condition

operator

STRING , required

The operator used to check the value against the attribute. An empty value is accepted when the document is created as long as the policy is not enabled. It must not be empty if the policy is enabled and applyAll is false

value

STRING , optional

The value to be checked using the operator and attribute. The value is not required for the 'is empty' and 'is not empty' operators.

ENUM

STRING , optional

event attribute for this value.

400

Policy was not updated

Body

object , optional

401

Unauthorized

Body

object , optional

403

Not authorized

Body

object , optional

404

Unable to locate policy

409

Cannot rename to the name of a policy that already exists

Body

object , optional

Response example

200

Successful request

								{
  "actions" : {
    "enrich" : {
    "enabled" : boolean,
    "enrichmentArray" : [{
    "action" : [overwrite, append, prepend],
    "attribute" : {
    "ENUM" : [event.severity, event.summary, event.expiryTime, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.type.eventType]
  },
    "value" : string
  }]
  },
    "flapping" : {
    "clearSeconds" : integer,
    "count" : integer,
    "enabled" : boolean,
    "flappingSeconds" : integer
  },
    "runbook" : {
    "enabled" : boolean,
    "runbooksArray" : [{
    "is_auto" : boolean,
    "parameters" : [{
    "attribute" : string,
    "mapping" : [eventAttribute, manual, runtime],
    "name" : string
  }],
    "runbookID" : string
  }]
  },
    "suppress" : {
    "enabled" : boolean,
    "identicalEvents" : integer,
    "suppressCondition" : [all, XinY],
    "timePeriod" : integer,
    "timeUnits" : [seconds, minutes, hours]
  }
  },
  "author" : string,
  "created" : string,
  "description" : string,
  "enabled" : boolean,
  "executionOrder" : integer,
  "id" : string,
  "lastRun" : string,
  "lastUpdated" : string,
  "lastUpdatedBy" : string,
  "name" : string,
  "applyAll" : boolean,
  "author" : string,
  "condition" : {
    "id" : string,
    "operator" : [and, or],
    "value" : [{
    "attribute" : {
    "ENUM" : [event.summary, event.severity, event.resource.application, event.resource.cluster, event.resource.component, event.resource.displayName, event.resource.hostname, event.resource.interface, event.resource.ipaddress, event.resource.location, event.resource.name, event.resource.port, event.resource.service, event.resource.sourceId, event.resource.type, event.sender.displayName, event.sender.name, event.sender.sourceId, event.sender.type, event.type.eventType, event.type.statusOrThreshold]
  },
    "id" : string,
    "operator" : [==, !=, >, >=, <, <=, contains, does not contain, starts with, ends with, is empty, is not empty],
    "value" : string
  }]
  },
  "description" : string,
  "enabled" : boolean,
  "name" : string
}
							

400

Policy was not updated

								{
  "" : object
}
							

401

Unauthorized

								{
  "" : object
}
							

403

Not authorized

								{
  "" : object
}
							

404

Unable to locate policy

409

Cannot rename to the name of a policy that already exists

								{
  "" : object
}
							

Loading content...

Resources