# AlertRules

## AlertRules - Activate

Activates the alert rule with given id.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/activate
```

### Parameter

| Field | Label in UI |   Type | Description                    |
| ----- | ----------: | -----: | ------------------------------ |
| id    |           - | String | Alert rule id. Mandatory Field |

### Request Example

```json
{
    "data": {}
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - Create

Create a new alert rule

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules
```

### Parameter

| Field                    |               Label in UI |      Type | Description                                                                                                                                                                                                                                      |
| ------------------------ | ------------------------: | --------: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| aggregate                | Risk Calculation Function |    String | Risk Calculation Function. Accepts values such as "min","max" and "avg". Used for calculating Risk Value of the alert. Mandatory Field                                                                                                           |
| apply\_jinja\_template   |      Apply Jinja Template |    String | Option to view rows that is displayed in Incident Data View in a format defined by the Jinja template. Optional Field                                                                                                                            |
| alert\_context\_template |           Template Syntax |    String | Specify the Jinja Template syntax for rows that is displayed in the Incident Data View. Optional Field                                                                                                                                           |
| assigned\_to             |               Assigned To |    String | ID of the user who can re-assign, comment on and view the data of the generated incident. Optional Field                                                                                                                                         |
| attack\_tag              |                Attack Tag | \[String] | List of attack tag IDs to categorize the alert rules. Use MitreAttacks - FetchMitreAttacks to obtain value for this parameter. Optional Field                                                                                                    |
| condition\_option        |                 Condition |    String | Accepts values such as "greaterthan", "lessthan", "equalsto", "lessequal", "equals", "moreequal" and "notequal". Mandatory Field                                                                                                                 |
| condition\_value         |                 Condition |       int | Can be positive integer or 0. Mandatory Field                                                                                                                                                                                                    |
| delay\_interval\_minute  | Delay Threshold (Minutes) |       int | Specify the value of delay interval in minutes to wait for the logs before processing. To set the value, "timestamp\_on" parameter value must be "log\_ts" in SystemSettingsGeneral API. Accepts values from 1 to 1440 only. Optional Field.     |
| description              |               Description |    String | Description of the alert rule. Optional Field                                                                                                                                                                                                    |
| flush\_on\_trigger       |          Flush On Trigger |    String | Enabling Flush on Trigger activates the next alert rule only by new set of events. Accepts only "on" as value to enable flush on trigger. Optional Field                                                                                         |
| limit                    |                     Limit |       int | Number of logs. Minimum value for the field is 1. Mandatory Field                                                                                                                                                                                |
| log\_source              |               Log Sources | \[String] | List of log sources from where the logs should be collected. Optional Field                                                                                                                                                                      |
| manageable\_by           |             Manageable by | \[String] | A list of incident user groups ID where users can re-assign, comment on, view data and resolve the generated incidents. Optional Field                                                                                                           |
| metadata                 |                  Metadata |   \[json] | Optional Field. Array of key-value pair objects to define custom metadata for an alert rule. Each object in the array must include the following parameters: field: Field for the custom metadata. value: Value associated with the given field. |
| original\_data           | Alert using original data |   boolean | Alert will be generated with encrypted data where Data Privacy Module is enabled. Setting this value as "true" sends request to generate alert with original data. Can be true/false. Optional Field                                             |
| owner                    |                         - |    String | ID of the user who owns alert rule. Mandatory Field                                                                                                                                                                                              |
| query                    |                     Query |    String | The query for which the alert rule should be fired. Optional Field                                                                                                                                                                               |
| repos                    |                     Repos | \[String] | The list of the Repos that you want to monitor for the matching alert condition. Use Repos - FetchRemoteRepos to obtain value for this parameter. Mandatory Field                                                                                |
| risk                     |                      Risk |    String | Risk level of the Alert. Accepts values such as "low", "medium", "high" and "critical". Used for calculating Risk Value of the alert. Mandatory Field                                                                                            |
| search\_interval\_minute | Search Interval (Minutes) |       int | Specify the custom search interval for retrieving the logs via search in minutes. Optional Field                                                                                                                                                 |
| searchname               |                      Name |    String | Name of the alert. It should be a unique valid string. Mandatory Field                                                                                                                                                                           |
| throttling\_enabled      |          Alert Throttling |    String | Accepts "on" as value to enable Alert Throttling. Can be "on" only. Optional Field                                                                                                                                                               |
| throttling\_field        |                     Field |    String | Specify a field on the basis of which alert throttling will be applied. Can be positive integer or 0. Mandatory only when the value of throttling\_enabled is "on". Optional Field                                                               |
| throttling\_time\_range  |                   Minutes |       int | Specify a time in minutes for which alert will not be dispatched. Mandatory only when the value of the value of throttling\_enabled is "on". Optional Field                                                                                      |
| timerange\_day           |                       Day |       int | Specify the timerange in Day for which the alert condition is to be matched. Either timerange\_day or timerange\_hour must be present when timerange\_minute is not present in the request. Optional Field                                       |
| timerange\_hour          |                      Hour |       int | Specify the timerange in Hour for which the alert condition is to be matched. Either timerange\_day or timerange\_hour must be present when timerange\_minute is not present in the request. Optional Field                                      |
| timerange\_minute        |                    Minute |       int | Specify the timerange in Minute for which the alert condition is to be matched. Mandatory only when timerange\_day and timerange\_hour is not present in the request. Optional Field                                                             |

### Request Example

```json
{
    "data": {
        "aggregate": "min",
        "apply_jinja_template": "on",
        "alert_context_template": "{% for item in rows %}{{ item.col_ts }}{{item.device_ip}}{{item.source_address}}{%- endfor %}",
        "assigned_to": "5b2a1204d8aaa4136bd32baa",
        "attack_tag": [
            "fa31b91e608e4d840a773d891f3e0a84",
            "bfe6e195e59084a433a6cf3083056b01"
        ],
        "condition_option": "greaterthan",
        "condition_value": 5,
        "delay_interval_minute": 5,
        "description": "Notification of average severity level per device",
        "flush_on_trigger": "on",
        "limit": 25,
        "log_source": [
            "log1",
            "log2"
        ],
        "manageable_by": [
            "5a467b3dd8aaa461c3139038",
            "5a467b3dd8aaa461c3139039"
        ],
        "metadata": [
            {
                "field": "device_ip",
                "value": "127.0.0.1"
            },
            {
                "field": "device_name",
                "value": "localhost"
            }
        ],
        "original_data": "true",
        "owner": "5a466e9dd8aaa4748d3977c7",
        "query": "severity=*|chart avg(severity) by device_ip",
        "repos": [
            "127.0.0.1:5504/_LogPointAlerts",
            "127.0.0.1:5504/_logpoint"
        ],
        "risk": "medium",
        "search_interval_minute": 5,
        "searchname": "Average severity level per device",
        "throttling_enabled": "on",
        "throttling_field": "user",
        "throttling_time_range": 5,
        "timerange_hour": 2
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - Deactivate

Deactivates the alert rule with given id.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/deactivate
```

### Parameter

| Field | Label in UI |   Type | Description                    |
| ----- | ----------: | -----: | ------------------------------ |
| id    |           - | String | Alert rule id. Mandatory Field |

### Request Example

```json
{
    "data": {}
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - Edit

Edit alert rule with given id

**PUT**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}
```

### Parameter

| Field                    |               Label in UI |      Type | Description                                                                                                                                   |
| ------------------------ | ------------------------: | --------: | --------------------------------------------------------------------------------------------------------------------------------------------- |
| aggregate                | Risk Calculation Function |    String | Risk Calculation Function. Accepts values such as "min","max" and "avg". Used for calculating Risk Value of the alert. Mandatory Field        |
| alert\_context\_template |           Template Syntax |    String | Specify the Jinja Template syntax for rows that will be displayed in the Incident Data View. Optional Field                                   |
| assigned\_to             |               Assigned To |    String | ID of the user who can re-assign, comment on and view the data of the generated incident. Optional Field                                      |
| attack\_tag              |                Attack Tag | \[String] | List of attack tag IDs to categorize the alert rules. Use MitreAttacks - FetchMitreAttacks to obtain value for this parameter. Optional Field |
| condition\_option        |                 Condition |    String | Accepts values such as "greaterthan", "lessthan", "equalsto", "lessequal", "equals", "moreequal" and "notequal". Mandatory Field              |
| condition\_value         |                 Condition |       int | Can be positive integer or 0. Mandatory Field                                                                                                 |
| delay\_interval\_minute  | Delay Threshold (Minutes) |       int | See Create for details. Optional Field                                                                                                        |
| description              |               Description |    String | Description of the alert rule. Optional Field                                                                                                 |
| flush\_on\_trigger       |          Flush On Trigger |    String | Accepts only "on". Optional Field                                                                                                             |
| id                       |                         - |    String | Alert rule id. Mandatory Field                                                                                                                |
| limit                    |                     Limit |       int | Number of logs. Minimum value for the field is 1. Mandatory Field                                                                             |
| log\_source              |               Log Sources | \[String] | List of log sources from where the logs should be collected. Optional Field                                                                   |
| manageable\_by           |             Manageable by | \[String] | List of incident user groups ID. Optional Field                                                                                               |
| metadata                 |                  Metadata |   \[json] | Array of key-value pair objects for custom metadata. Optional Field                                                                           |
| original\_data           | Alert using original data |   boolean | Can be true/false. Optional Field                                                                                                             |
| query                    |                     Query |    String | The query for which the alert rule should be fired. Optional Field                                                                            |
| repos                    |                     Repos | \[String] | The list of the Repos that you want to monitor for the matching alert condition. Mandatory Field                                              |
| risk                     |                      Risk |    String | Risk level of the Alert. Mandatory Field                                                                                                      |
| search\_interval\_minute | Search Interval (Minutes) |       int | Optional Field                                                                                                                                |
| searchname               |                      Name |    String | Name of the alert rule. Mandatory Field                                                                                                       |
| throttling\_enabled      |          Alert Throttling |    String | Accepts "on". Optional Field                                                                                                                  |
| throttling\_field        |                     Field |    String | Mandatory only when throttling\_enabled is "on". Optional Field                                                                               |
| throttling\_time\_range  |                   Minutes |       int | Mandatory only when throttling\_enabled is "on". Optional Field                                                                               |
| timerange\_day           |                       Day |       int | Either timerange\_day or timerange\_hour must be present when timerange\_minute is not present. Optional Field                                |
| timerange\_hour          |                      Hour |       int | See above. Optional Field                                                                                                                     |
| timerange\_minute        |                    Minute |       int | Mandatory only when timerange\_day and timerange\_hour are not present. Optional Field                                                        |

### Request Example

```json
{
    "data": {
        "aggregate": "min",
        "alert_context_template": "{% for item in rows %}{{ item.col_ts }}{{item.device_ip}}{{item.source_address}}{%- endfor %}",
        "assigned_to": "5b2a1204d8aaa4136bd32baa",
        "attack_tag": [
            "fa31b91e608e4d840a773d891f3e0a84",
            "bfe6e195e59084a433a6cf3083056b01"
        ],
        "condition_option": "greaterthan",
        "condition_value": 5,
        "delay_interval_minute": 5,
        "description": "Notification of average severity level per device",
        "flush_on_trigger": "on",
        "limit": 25,
        "log_source": [
            "log1",
            "log2"
        ],
        "manageable_by": [
            "5a467b3dd8aaa461c3139038",
            "5a467b3dd8aaa461c3139039"
        ],
        "metadata": [
            {
                "field": "device_ip",
                "value": "127.0.0.1"
            },
            {
                "field": "device_name",
                "value": "localhost"
            }
        ],
        "original_data": "true",
        "query": "severity=*|chart avg(severity) by device_ip",
        "repos": [
            "127.0.0.1:5504/_LogPointAlerts",
            "127.0.0.1:5504/_logpoint"
        ],
        "risk": "medium",
        "search_interval_minute": 5,
        "searchname": "Average severity level per device",
        "throttling_enabled": "on",
        "throttling_field": "user",
        "throttling_time_range": 5,
        "timerange_minute": 10
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - EmailNotification

Setup email notification for an alert rule

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/EmailNotification
```

### Parameter

| Field                    |          Label in UI |      Type | Description                                                                                                                                                                                                                          |
| ------------------------ | -------------------: | --------: | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| b64\_logo                |                    - |    String | Base64 encoded logo image. Only "jpeg" image type upto 160\*75 dimension is allowed. Should be a comma separated value containing type of image and base64 encoded value. Mandatory only when logo\_enable is "true". Optional Field |
| dispatch\_option         | Notification Trigger |    String | "auto" or "manual". Optional Field                                                                                                                                                                                                   |
| email\_emails            |               Emails | \[String] | List of email addresses. Mandatory only when notify\_email is "on". Optional Field                                                                                                                                                   |
| email\_template          |              Message |    String | Message of the Email. Optional Field                                                                                                                                                                                                 |
| email\_threshold\_option |            Threshold |    String | Time Unit for email threshold. Can be minute/hour/day. Mandatory only when email\_threshold\_value is required. Optional Field                                                                                                       |
| email\_threshold\_value  |            Threshold |       int | Value for email threshold. Can be positive integer. Mandatory only when email\_threshold\_option is required. Optional Field                                                                                                         |
| id                       |                    - |    String | Alert rule id. Mandatory Field                                                                                                                                                                                                       |
| link\_disable            |  Disable Search Link |   boolean | true to disable the search link in the email, false to enable. Optional Field                                                                                                                                                        |
| logo\_enable             |          Enable Logo |   boolean | true to add a logo or false to remove/disable the logo. Optional Field                                                                                                                                                               |
| notify\_email            |     Notify via email |    String | Accepts on/off. Mandatory Field                                                                                                                                                                                                      |
| simple\_view             |   Toggle Simple View |   boolean | Option to edit the notification message in plain text or view a rendered preview.                                                                                                                                                    |
| subject                  |              Subject |    String | Subject of the Email. Optional Field                                                                                                                                                                                                 |

### Request Example

```json
{
    "data": {
        "b64_logo": "data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDAwQDBAgEBAgQCwkLEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBD/wAARCAAhACIDASIAAhEBAxEB/8QAFwABAQEBAAAAAAAAAAAAAAAAAAYHCf/EACMQAAEDBAIDAAMAAAAAAAAAAAEAAgQDBgcRBSESFDETIlH/xAAYAQADAQEAAAAAAAAAAAAAAAAAAgMBBP/EACARAAICAgIDAQEAAAAAAAAAAAEDAAIEESExEhNBBVH/2gAMAwEAAhEDEQA/AOqaIozKeTIOLuBoc1M4yvPdKkiLSo0nBvfg55cSd6Aax3wEk6AHaatTc+I7jrVd1wtY2T8Es0WYY2zhFyDcL7dfbMrjK3qPl0qj6we14Y5rXNI01zT+7SNjRG++lp6ZirpPjeZell2Nbggj4eIREU4sKUyHYtC/OOhwa0j8RhyvZaTvs+DmfR8On7B/oVWim5VXrK79H+cS2PkMxWhyjqw6mSY1wjLsS+JF0O5WK6GYdSLHiUKWiC97HEk6DQB4dADsuJJWtoi1dPXQUBJA455lc3Od+g33PO7aA611CIieckIiIhCIiIQiIiE//9k=",
        "dispatch_option": "auto",
        "email_emails": [
            "rp@gmail.com",
            "sp@gmail.com"
        ],
        "email_template": "This is to notify the user that the user logged more than 5 times.",
        "email_threshold_option": "minute",
        "email_threshold_value": 5,
        "link_disable": "false",
        "logo_enable": "true",
        "notify_email": "on",
        "simple_view":"off",
        "subject": "The user logged more than 5 times."
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - FetchMyRules

Fetches all alert rules defined under MyRules.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/MyAlertRules/fetch
```

### Parameter

| Field       | Label in UI |      Type | Description                                                                                     |
| ----------- | ----------: | --------: | ----------------------------------------------------------------------------------------------- |
| active      |           - |   boolean | Status (active/deactive) of the alert rules to fetch. true fetches active rules. Optional Field |
| log\_source |           - | \[String] | List of log sources to filter alert rules. Optional Field                                       |

### Request Example

```json
{
    "data": {
        "active": "true",
        "log_source": [
            "log1",
            "log2"
        ]
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}/{data_node}"
}
```

***

## AlertRules - FetchSharedRules

Fetches all alert rules that has been shared.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/SharedAlertRules/fetch
```

#### Parameter

| **Field**   | **Label in UI** | **Type**  | **Description**                                                                                                                                                                                                            |
| ----------- | --------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| active      | -               | boolean   | Status(active/deactive) of the alert rules to fetch. Setting this value as "true" sends request to generate all active alert rules defined under SharedRules section. Can be true/false. Optional Field                    |
| log\_source | -               | \[String] | List of log sources. Filters alert rules according to the specified log sources in the list. If at least one log source in the alert rule matches one in the list, it is included in the filtered results. Optional Field. |

#### Request Example

```
{
    "data": {
        "active": "true",
        "log_source": [
            "log1",
            "log2"
        ],
    }
}
```

#### Success Response

```
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}/{data_node}"
}
```

## AlertRules - FetchUsedRules

Fetches all the vendor alert rules that have been used.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/UsedAlertRules/fetch
```

#### Parameter

| **Field**   | **Label in UI** | **Type**  | **Description**                                                                                                                                                                                                            |
| ----------- | --------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| active      | -               | boolean   | Status(active/deactive) of the alert rules to fetch. Setting this value as "true" sends request to generate all active alert rules defined under UsedRules section. Can be true/false. Optional Field                      |
| log\_source | -               | \[String] | List of log sources. Filters alert rules according to the specified log sources in the list. If at least one log source in the alert rule matches one in the list, it is included in the filtered results. Optional Field. |

#### Request Example

```
{
    "data": {
        "active": "true",
        "log_source": [
            "log1",
            "log2"
        ],
    }
}
```

#### Success Response

```
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}/{data_node}"
}
```

## AlertRules - FetchUsedSharedRules

Fetches the alert rules that were shared by users and are currently being used in the given Logpoint.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/UsedSharedAlertRules/fetch
```

#### Parameter

| **Field**   | **Label in UI** | **Type**  | **Description**                                                                                                                                                                                                            |
| ----------- | --------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| active      | -               | boolean   | Status(active/deactive) of the alert rules to fetch. Setting this value as "true" sends request to generate all active alert rules defined under UsedSharedRules section. Can be true/false. Optional Field                |
| log\_source | -               | \[String] | List of log sources. Filters alert rules according to the specified log sources in the list. If at least one log source in the alert rule matches one in the list, it is included in the filtered results. Optional Field. |

#### Request Example

```
{
    "data": {
        "active": "true",
        "log_source": [
            "log1",
            "log2"
        ],
    }
}
```

#### Success Response

```
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}/{data_node}"
}
```

## AlertRules - FetchVendorRules

Fetches all alert rules provided by the vendor.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/VendorAlertRules/fetch
```

### Parameter

| Field       | Label in UI |      Type | Description                          |
| ----------- | ----------: | --------: | ------------------------------------ |
| log\_source |           - | \[String] | List of log sources. Optional Field. |

### Request Example

```json
{
    "data": {
        "log_source": [
            "log1",
            "log2"
        ]
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}/{data_node}"
}
```

## AlertRules - HTTPNotification

Setup HTTP notification for an alert rule.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/HTTPNotification
```

### Parameter

| Field                   |          Label in UI |   Type | Description                                                                                                                                     |
| ----------------------- | -------------------: | -----: | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| dispatch\_option        | Notification Trigger | String | "auto" or "manual". Optional Field                                                                                                              |
| http\_body              |                      | String | Template for the body of the HTTP notification. Provide only when http\_request\_type is POST, PUT, or PATCH. Optional Field                    |
| http\_header            |              Headers |   json | Define auth\_type (basic\_auth/api\_token/bearer\_token), auth\_key, auth\_value (for api\_token), auth\_pass (for basic\_auth). Optional Field |
| http\_querystring       |         Query String | String | Query string. Mandatory only when notify\_http is "on". Optional Field                                                                          |
| http\_request\_type     |         Request Type | String | GET/POST/PUT/DELETE/PATCH/HEAD. Mandatory only when notify\_http is "on". Optional Field                                                        |
| http\_threshold\_option |            Threshold | String | Time Unit for http threshold. minute/hour/day. Optional Field                                                                                   |
| http\_threshold\_value  |            Threshold |    int | Value for http threshold. Optional Field                                                                                                        |
| http\_url               |             Base URL | String | URL to send HTTP notification. Mandatory only when notify\_http is "on". Optional Field                                                         |
| id                      |                    - | String | Alert rule id. Mandatory Field                                                                                                                  |
| notify\_http            |      Notify via HTTP | String | Accepts on/off. Mandatory Field                                                                                                                 |
| protocol                |             Protocol | String | HTTP/HTTPS. Optional Field (default HTTP when notify\_http is "on" and protocol not provided).                                                  |

### Request Example

```json
{
    "data": {
        "http_body": "{\"title\": \"{{alert_name}}\", \"description\": \"{{description}}\", \"risk\": \"{{risk}}\", \"dispatch_option\": \"auto\", \"query\": \"{{ extra_info.query }}\"}",
        "http_header": {
            "auth_key": "key1",
            "auth_pass": "pwd1",
            "auth_type": "basic_auth"
        },
        "http_querystring": "user='admin'&count=rows_count",
        "http_request_type": "POST",
        "http_threshold_option": "minute",
        "http_threshold_value": 5,
        "http_url": "http://www.test.com/try",
        "notify_http": "on"
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - Install

Install a given alertrule pak file

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/install
```

### Parameter

| Field          | Label in UI |   Type | Description                                                                           |
| -------------- | ----------: | -----: | ------------------------------------------------------------------------------------- |
| file\_location |           - | String | Location of the file to install. Can be either 'private' or 'public'. Mandatory Field |
| file\_name     | Alert Rules | String | Name of the pak file for AlertRules. Mandatory Field                                  |
| owner          |           - | String | ID of the user who owns alert rule. Mandatory Field                                   |

### Request Example

```json
{
    "data": {
        "file_location": "private",
        "file_name": "alert1.pak",
        "owner": "5a466e9dd8aaa4748d3977c7"
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - ListPrivateUploads

List all the pak files that contain alert rules in private storage

GET

```
https://api-server-host-name/configapi/{pool_UUID}/AlertRules/list
```

### Success Response

```json
[
    "test.pak"
]
```

## AlertRules - ListPublicUploads

List all the pak files that contain alert rules in public storage

**GET**

```
https://api-server-host-name/configapi/AlertRules/list
```

### Success Response

```json
[
    "test.pak"
]
```

## AlertRules - SMSNotification

Setup SMS notification for an alert rule.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/SMSNotification
```

### Parameter

| Field                  |          Label in UI |      Type | Description                                                                                           |
| ---------------------- | -------------------: | --------: | ----------------------------------------------------------------------------------------------------- |
| dispatch\_option       | Notification Trigger |    String | "auto" or "manual". Optional Field                                                                    |
| id                     |                    - |    String | Alert rule id. Mandatory Field                                                                        |
| notify\_sms            |       Notify via SMS |    String | Accepts on/off. Mandatory Field                                                                       |
| sms\_body              |                 Body |    String | SMS notification message. Optional Field                                                              |
| sms\_password          |             Password |    String | SMS server password. Mandatory only when notify\_sms is "on". Optional Field                          |
| sms\_port              |                 Port |       int | Port number of SMS server. Mandatory only when notify\_sms is "on". Optional Field                    |
| sms\_receivers         |            Receivers | \[String] | List of receiver phone numbers (3-15 digits). Mandatory only when notify\_sms is "on". Optional Field |
| sms\_sender            |            Sender ID |    String | Sender ID for the SMS server. Mandatory only when notify\_sms is "on". Optional Field                 |
| sms\_server            |          SMSC Server |    String | Destination server address. Mandatory only when notify\_sms is "on". Optional Field                   |
| sms\_threshold\_option |            Threshold |    String | Time Unit for sms threshold. minute/hour/day. Optional Field                                          |
| sms\_threshold\_value  |            Threshold |       int | Value for sms threshold. Optional Field                                                               |
| sms\_username          |             Username |    String | Username for the SMS server. Mandatory only when notify\_sms is "on". Optional Field                  |

### Request Example

```json
{
    "data": {
        "dispatch_option": "auto",
        "notify_sms": "on",
        "sms_body": "New alert dispatched",
        "sms_password": "password1",
        "sms_port": 2775,
        "sms_receivers": [
            "+998939893",
            "5110521"
        ],
        "sms_sender": "SH-LPO",
        "sms_server": "127.0.0.1",
        "sms_threshold_option": "minute",
        "sms_threshold_value": 5,
        "sms_username": "johnwatson"
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - SNMPNotification

Setup SNMP notification for an alert rule

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/SNMPNotification
```

### Parameter

| Field                    |           Label in UI |   Type | Description                                                                                                                  |
| ------------------------ | --------------------: | -----: | ---------------------------------------------------------------------------------------------------------------------------- |
| dispatch\_option         |  Notification Trigger | String | "auto" or "manual". Optional Field                                                                                           |
| id                       |                     - | String | Alert rule id. Mandatory Field                                                                                               |
| notify\_snmp             | Notify via SNMP Traps | String | Accepts on/off. Mandatory Field                                                                                              |
| snmp\_agent              |                 Agent | String | Name of the agent that sends SNMP trap. Mandatory when snmp\_version is SNMPv2c. Optional Field                              |
| snmp\_authorization\_key |     Authorization Key | String | Authorization Key for SNMPv3. Mandatory when snmp\_version is SNMPv3. Optional Field                                         |
| snmp\_community\_string  |      Community String | String | Passphrase for SNMPv2c. Optional Field                                                                                       |
| snmp\_ip                 |                    IP | String | IP address of trap receiver. Mandatory only when notify\_snmp is "on". Optional Field                                        |
| snmp\_message            |               Message | String | OID's corresponding value in the Message. Optional Field                                                                     |
| snmp\_oid                |                   OID | String | Valid SNMP trap or Enterprise specific OID in dotted decimal format. Mandatory only when notify\_ssh is "on". Optional Field |
| snmp\_port               |                  Port |    int | Port number of trap receiver. Mandatory only when notify\_snmp is "on". Optional Field                                       |
| snmp\_private\_key       |           Private Key | String | Private Key for SNMPv3. Optional Field                                                                                       |
| snmp\_threshold\_option  |             Threshold | String | Time Unit for snmp threshold. minute/hour/day. Optional Field                                                                |
| snmp\_threshold\_value   |             Threshold |    int | Value for snmp threshold. Optional Field                                                                                     |
| snmp\_username           |              Username | String | Username for SNMPv3. Optional Field                                                                                          |
| snmp\_version            |          SNMP Version | String | SNMPv2c or SNMPv3. Optional Field                                                                                            |

### Request Example

```json
{
    "data": {
        "dispatch_option": "auto",
        "notify_snmp": "on",
        "snmp_agent": "192.168.3.12",
        "snmp_community_string": "public",
        "snmp_ip": "10.45.9.20",
        "snmp_message": "Alert rule was fired.",
        "snmp_oid": "1.3.6.1.4.1.8072.1.2.1.1.5.0.1.2.05",
        "snmp_port": 192,
        "snmp_threshold_enabled": "on",
        "snmp_threshold_option": "minute",
        "snmp_threshold_value": 5,
        "snmp_version": "SNMPv2c"
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - SSHNotification

Setup SSH notification for an alert rule.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/SSHNotification
```

### Parameter

| Field                  |          Label in UI |   Type | Description                                                                                              |
| ---------------------- | -------------------: | -----: | -------------------------------------------------------------------------------------------------------- |
| dispatch\_option       | Notification Trigger | String | "auto" or "manual". Optional Field                                                                       |
| id                     |                    - | String | Alert rule id. Mandatory Field                                                                           |
| notify\_ssh            |       Notify via SSH | String | Accepts on/off. Mandatory Field                                                                          |
| ssh\_auth\_password    |             Password | String | Password. Mandatory when ssh\_auth\_type is "password". Optional Field                                   |
| ssh\_auth\_type        |       Authentication | String | "password" or "certificate". Mandatory only when notify\_ssh is "on". Optional Field                     |
| ssh\_cert\_type        |     Certificate Type | String | Use when ssh\_auth\_type is certificate. Values: system\_cert, user\_cert. Optional Field                |
| ssh\_command           |              Command | String | Command to execute when the alert rule is fired. Mandatory only when notify\_ssh is "on". Optional Field |
| ssh\_port              |                 Port |    int | Port number. Mandatory only when notify\_ssh is "on". Optional Field                                     |
| ssh\_server            |               Server | String | Destination server address. Mandatory only when notify\_ssh is "on". Optional Field                      |
| ssh\_threshold\_option |            Threshold | String | Time Unit for ssh threshold. minute/hour/day. Optional Field                                             |
| ssh\_threshold\_value  |            Threshold |    int | Value for ssh threshold. Optional Field                                                                  |
| ssh\_username          |             Username | String | Username for the destination server. Optional Field                                                      |

### Request Example

```json
{
    "data": {
        "dispatch_option": "auto",
        "notify_ssh": "on",
        "ssh_auth_password": "password1",
        "ssh_auth_type": "password",
        "ssh_command": "command1",
        "ssh_port": 22,
        "ssh_server": "10.45.9.18",
        "ssh_threshold_option": "minute",
        "ssh_threshold_value": 5,
        "ssh_username": "username1"
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - ShareWithUsers

Shares the alert rule by id with specified usergroups or users with specific permissions.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/share
```

### Parameter

| Field        | Label in UI |    Type | Description                                                                                                                                                                                                                                                      |
| ------------ | ----------: | ------: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| id           |           - |  String | Alert rule id. Mandatory Field                                                                                                                                                                                                                                   |
| rbac\_config |           - | \[json] | Alert sharing config using RBAC. Either empty list or objects with group\_id (mandatory), group\_permission (READ/EDIT/FULL) or user\_permissions (list). For user\_permissions, each object must have user\_id and permission (READ/EDIT/FULL). Mandatory Field |

### Request Example

```json
{
    "data": {
        "rbac_config": [
            {
                "group_id": "60616651b8a4470f71510082",
                "group_permission": "READ"
            },
            {
                "group_id": "605c56cacec4f90f9786cc87",
                "user_permissions": [
                    {
                        "permission": "EDIT",
                        "user_id": "605c56f36253bcd9fb1d1d67"
                    },
                    {
                        "permission": "FULL",
                        "user_id": "60640a538501f571ab422732"
                    }
                ]
            }
        ]
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - SyslogNotification

Setup Syslog notification for an alert rule

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/SyslogNotification
```

### Parameter

| Field             |          Label in UI |    Type | Description                                                                                        |
| ----------------- | -------------------: | ------: | -------------------------------------------------------------------------------------------------- |
| dispatch\_option  | Notification Trigger |  String | "auto" or "manual". Optional Field                                                                 |
| facility          |             Facility |     int | Values 0 to 23. Optional Field                                                                     |
| id                |                    - |  String | Alert rule id. Mandatory Field                                                                     |
| message           |              Message |  String | Free-form message. Optional Field                                                                  |
| notify\_syslog    |    Notify via Syslog |  String | Accepts on/off. Mandatory Field                                                                    |
| port              |                 Port |     int | Port number of remote syslog server. Mandatory only when notify\_syslog is "on". Optional Field    |
| protocol          |                    - |  String | UDP/TCP. Mandatory only when notify\_syslog is "on". Optional Field                                |
| server            |               Server |  String | Server address of remote syslog server. Mandatory only when notify\_syslog is "on". Optional Field |
| severity          |             Severity |     int | Values 0 to 7. Mandatory only when notify\_syslog is "on". Optional Field                          |
| split\_rows       |                    - | boolean | true/false. If true send each new line as separate syslog message. Optional Field                  |
| threshold\_option |            Threshold |  String | Time Unit for syslog threshold. minute/hour/day. Optional Field                                    |
| threshold\_value  |            Threshold |     int | Value for syslog threshold. Optional Field                                                         |

### Request Example

```json
{
    "data": {
        "dispatch_option": "auto",
        "facility": 9,
        "message": "The user logged more than 5 times.",
        "notify_syslog": "on",
        "port": 192,
        "protocol": "UDP",
        "server": "10.45.9.20",
        "severity": 4,
        "split_rows": "true",
        "threshold_option": "minute",
        "threshold_value": 5
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - TransferOwnership

Transfer ownership of the alert rule to another user.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/transferOwnership
```

### Parameter

| Field  | Label in UI |   Type | Description                                         |
| ------ | ----------: | -----: | --------------------------------------------------- |
| id     |           - | String | Alert rule id. Mandatory Field                      |
| userid |           - | String | Transfer ownership to this User id. Mandatory Field |

### Request Example

```json
{
    "data": {
        "userid": "574fceedd8aaa40740736302"
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - Trash

Deletes the alert rule with given id.

**DELETE**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}
```

### Parameter

| Field | Label in UI |   Type | Description                    |
| ----- | ----------: | -----: | ------------------------------ |
| id    |           - | String | Alert rule id. Mandatory Field |

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - TrashPrivateUploads

Delete the file with given name from private storage

**DELETE**

```
https://api-server-host-name/configapi/{pool_UUID}/AlertRules/{file_name}
```

### Parameter

| Field      |   Type | Description                                     |
| ---------- | -----: | ----------------------------------------------- |
| file\_name | String | Name of the file to be deleted. Mandatory Field |

### Success Response

```json
{
    "status": "Success",
    "message": "Alert1.pak successfully deleted"
}
```

## AlertRules - TrashPublicUploads

Delete the file with given name from public storage

**DELETE**

```
https://api-server-host-name/configapi/AlertRules/{file_name}
```

### Parameter

| Field      |   Type | Description                                     |
| ---------- | -----: | ----------------------------------------------- |
| file\_name | String | Name of the file to be deleted. Mandatory Field |

### Success Response

```json
{
    "status": "Success",
    "message": "Alert1.pak successfully deleted"
}
```

## AlertRules - UnshareWithUsers

Unshares the alert rule with given id from all users within the pool.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/unshare
```

### Parameter

| Field | Label in UI |   Type | Description                    |
| ----- | ----------: | -----: | ------------------------------ |
| id    |           - | String | Alert rule id. Mandatory Field |

### Request Example

```json
{
    "data": {}
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - Upload

Upload pak files that contains alert rules to private storage. This upload should be used for alert rules only.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/AlertRules/upload
```

### Header

| Field             | Description                                                                   |
| ----------------- | ----------------------------------------------------------------------------- |
| file\_name        | Name of the file to be uploaded.                                              |
| Content-Type      | application/octet-stream                                                      |
| replace\_existing | Set 'true' to replace existing file with same name. Default 'false'. Optional |

### Parameter

| Field |      Type | Description                           |
| ----- | --------: | ------------------------------------- |
| file  | \[Object] | (pak) to be uploaded. Mandatory Field |

### Success Response

```json
{
    "status": "Success",
    "message": "Alert1.pak successfully uploaded in private storage. "
}
```

## AlertRules - UploadPublic

Upload pak files that contain alert rules to public storage. This upload should be used for alert rules only.

**POST**

```
https://api-server-host-name/configapi/AlertRules/publicupload
```

### Header

| Field             | Description                                                                   |
| ----------------- | ----------------------------------------------------------------------------- |
| file\_name        | Name of the file to be uploaded.                                              |
| Content-Type      | application/octet-stream                                                      |
| replace\_existing | Set 'true' to replace existing file with same name. Default 'false'. Optional |

### Parameter

| Field |      Type | Description                           |
| ----- | --------: | ------------------------------------- |
| file  | \[Object] | (pak) to be uploaded. Mandatory Field |

### Success Response

```json
{
    "status": "Success",
    "message": "Alert1.pak successfully uploaded in public storage."
}
```

## AlertRules - UseAlertRules

Use the alert rules shared by other LogPoint users or the vendor alert rules.

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/useAlertRules
```

### Parameter

| Field | Label in UI |   Type | Description                                                       |
| ----- | ----------: | -----: | ----------------------------------------------------------------- |
| id    |           - | String | Alert rule id. Mandatory Field                                    |
| owner |           - | String | ID of the user who will use the given alert rule. Mandatory Field |

### Request Example

```json
{
    "data": {
        "owner": "5a466e9dd8aaa4748d3977c7"
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```

## AlertRules - UseVendorRules

{% hint style="warning" %}
DEPRECATED — Will be removed in future version.&#x20;

Use [AlertRules - UseAlertRules API](#alertrules-usealertrules) instead.
{% endhint %}

**POST**

```
https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/AlertRules/{id}/useVendorRules
```

### Parameter

| Field | Label in UI |   Type | Description                                         |
| ----- | ----------: | -----: | --------------------------------------------------- |
| id    |           - | String | Alert rule id. Mandatory Field                      |
| owner |           - | String | ID of the user who owns alert rule. Mandatory Field |

### Request Example

```json
{
    "data": {
        "owner": "5a466e9dd8aaa4748d3977c7"
    }
}
```

### Success Response

```json
{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}
```
