Get a CAPE Policy by ID
get
/api/event/Policies/{id}
Gets the CAPE policy that matches the specified ID.
Request
Path Parameters
-
id(required): integer(int32)
The CAPE policy ID.Example:
1
There's no request body for this operation.
Back to TopResponse
Supported Media Types
- application/json
200 Response
Successful operation
Root Schema : schema
Match All
Show Source
-
object
SuccessfulGetOperation
The response body for a successful get operation.
-
object
type
Nested Schema : SuccessfulGetOperation
Type:
object
The response body for a successful get operation.
Show Source
-
message: string
The response message.Example:
Loaded 1 entries
-
success: boolean
Whether the operation was a success (true) or a failure (false).Example:
true
Nested Schema : eventPoliciesRead
Type:
Show Source
object
-
PolicyDescription: string
CAPE Policy DescriptionExample:
Analytics has found an event that has never happened before or through heuristics has been found as not noise but important. The goal is to increase the severity of the originating event.
-
PolicyID: integer
Profile ID specified for individual CRUD operationsExample:
1
-
PolicyName: string
CAPE Policy NameExample:
AbnormalActivity
-
PolicyNodeID: integer
The ID of the first node called to process this policy's matching events.Example:
1
-
PolicyNodeName: string
Name of the first node called.Example:
EscalateByAnomaly
-
PolicyNodeNameDisplay: string
Name of the first node called.Example:
EscalateByAnomaly
-
PolicyPollTime: integer
Interval, in seconds, this policy should run (30 seconds recommended minimum)Example:
30
-
PolicyProcessType: string
Flag to indicate whether events will be processed by each node in a batch, or individually Allowed Values: - 0 => Process Events Individually - 1 => Process Events TogetherExample:
0
-
PolicySelectSQL: string
SQL used to select which events will be processed by this CAPE Policy's node(s)Example:
SELECT * FROM Events WHERE Severity > 1 AND EventType LIKE 'AbnormalActivity-%'
-
PolicyStatus: string
Status for the Policy. Status will be Enabled or Disabled.Example:
Enabled
-
PolicyStatusIcon: string
CAPE Policy Status Icon. The icon will be "OrbRed.png" or "OrbGreen.png"Example:
OrbGreen.png
-
PolicyStatusID: integer
The policy status ID. Either 0 (disabled) or 1 (enabled).Example:
1
-
PolicyZoneID: integer
The device zone ID associated with the policy. 0 is used for "all zones".Example:
0
-
PolicyZoneName: string
The device zone name associated with the policy. It will be null if the zone ID is 0.Example:
oracle.doceng.json.BetterJsonNull@5b977aaa
-
PolicyZoneNameDisplay: string
The device zone name associated with the policy. It will be "[All]" if the zone ID is 0.Example:
[All]
Default Response
Failed operation
Root Schema : schema
Type:
Show Source
object
-
errors: array
errors
The list of errors reported. Validation errors will be keyed by record field.
-
message: string
The response message.Example:
Exception thrown
-
success: boolean
Whether the operation was a success (true) or a failure (false).Example:
false
Nested Schema : errors
Type:
array
The list of errors reported. Validation errors will be keyed by record field.
Show Source
-
Array of:
object items
An error.
Nested Schema : items
Type:
object
An error.