1. REST API for Unified Assurance Core
  2. Tasks
  3. Events
  4. CAPE Policies

Update a CAPE Policy

put

/api/event/Policies/{id}

Updates the properties of the CAPE policy that matches the specified ID.

Request

Path Parameters
Supported Media Types
Request Body - application/json ()
Root Schema : schema
Match All
Show Source
Nested Schema : eventPolicies
Type: object
Show Source
  • CAPE Policy Description
    Example: Analytics has found an event that has never happened before or through heuristics has been found as not noise but important. The goal is to increase the severity of the originating event.
  • The CAPE policy name.
    To avoid confusion with numeric IDs, the name value cannot be integers only or integers prefixed with the + or - symbols only. It must contain letters or other characters. For example, 1234, +1234, and -1234 are not valid, but US1234, US+1234 and US_1234 are.
    Example: Abnormal Activity
  • The ID of the first node called to process this policy's matching events.
    Example: 1
  • Interval, in seconds, this policy should run (30 seconds recommended minimum)
    Example: 30
  • Flag to indicate whether events will be processed by each node in a batch, or individually Allowed Values: - 0 => Process Events Individually - 1 => Process Events Together
    Example: 0
  • SQL used to select which events will be processed by this CAPE Policy's node(s)
    Example: SELECT * FROM Events WHERE Severity > 1 AND EventType LIKE 'AbnormalActivity-%'
  • The policy status ID. Either 0 (disabled) or 1 (enabled).
    Example: 1
  • The device zone ID associated with the policy. 0 is used for "all zones".
    Example: 0
Nested Schema : type
Type: object
Show Source
Back to Top

Response

Supported Media Types

200 Response

Successful operation
Body ()
Root Schema : schema
Match All
Show Source
Nested Schema : SuccessfulUpdateOperation
Type: object
The response body for a successful update operation.
Show Source
Nested Schema : type
Type: object
Show Source
Nested Schema : data
Type: array
The properties of the updated CAPE policy.
Show Source
Nested Schema : eventPoliciesRead
Type: object
Show Source
  • CAPE Policy Description
    Example: Analytics has found an event that has never happened before or through heuristics has been found as not noise but important. The goal is to increase the severity of the originating event.
  • Profile ID specified for individual CRUD operations
    Example: 1
  • CAPE Policy Name
    Example: AbnormalActivity
  • The ID of the first node called to process this policy's matching events.
    Example: 1
  • Name of the first node called.
    Example: EscalateByAnomaly
  • Name of the first node called.
    Example: EscalateByAnomaly
  • Interval, in seconds, this policy should run (30 seconds recommended minimum)
    Example: 30
  • Flag to indicate whether events will be processed by each node in a batch, or individually Allowed Values: - 0 => Process Events Individually - 1 => Process Events Together
    Example: 0
  • SQL used to select which events will be processed by this CAPE Policy's node(s)
    Example: SELECT * FROM Events WHERE Severity > 1 AND EventType LIKE 'AbnormalActivity-%'
  • Status for the Policy. Status will be Enabled or Disabled.
    Example: Enabled
  • CAPE Policy Status Icon. The icon will be "OrbRed.png" or "OrbGreen.png"
    Example: OrbGreen.png
  • The policy status ID. Either 0 (disabled) or 1 (enabled).
    Example: 1
  • The device zone ID associated with the policy. 0 is used for "all zones".
    Example: 0
  • The device zone name associated with the policy. It will be null if the zone ID is 0.
    Example: oracle.doceng.json.BetterJsonNull@5b977aaa
  • The device zone name associated with the policy. It will be "[All]" if the zone ID is 0.
    Example: [All]

Default Response

Failed operation
Body ()
Root Schema : schema
Type: object
Show Source
Nested Schema : errors
Type: array
The list of errors reported. Validation errors will be keyed by record field.
Show Source
Nested Schema : items
Type: object
An error.
Back to Top