EnrichmentPolicy

EnrichmentPolicy - Create

Adds a new enrichment policy.

POST

https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/EnrichmentPolicy

Parameters

Field	Label in UI	Type	Description
id	-	String	Existing enrichment policy id. Mandatory Field
name	Policy Name	String	Enrichment policy name. Mandatory Field
description	Description	String	Description for the enrichment policy. Optional Field
specifications	Specification	[json]	Mandatory Field. See specifications details below.

Specifications details

Mandatory Field. The following parameters must be provided to define enrichment policy specifications:

• rules: Rules for the enrichment policy. Optional field.

  To define rules, the following parameters must be provided:

  • category: Value can be "simple" or "type_based".

  • operation: Value must be "Equals".

  • prefix: Value can be "true" or "false". Mandatory only when category = "type_based".

  • event_key: Event id. Mandatory only when category = "simple".

  • source_key: Source id.

  • type: Value can only be "ip" or "string" or "num". Mandatory only when category = "type_based".

• source: Enrichment source. Mandatory.

• criteria: Criteria for the enrichment policy.

  To define the enrichment criteria, the following parameters must be provided:

  • type: Value can be "KeyPresents" or "KeyPresentsValueMatches".

  • key: The enrichment policy criteria is fulfilled if this key is present in the log.

  • value: The criteria is fulfilled if the above mentioned key and this value is present in the log. Mandatory.

Request Example

{
    "data": {
        "name": "testPolicy",
        "specifications": [
            {
                "rules": [
                    {
                        "category": "simple",
                        "source_key": "id",
                        "prefix": false,
                        "operation": "Equals",
                        "type": "string",
                        "event_key": "id"
                    }
                ],
                "source": "test_odbc",
                "criteria": [
                    {
                        "type": "KeyPresents",
                        "key": "id",
                        "value": ""
                    }
                ]
            }
        ],
        "description": "Enrichment Policy <i> description </i>."
    }
}

Success Response

{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}

EnrichmentPolicy - Edit

Edits an enrichment policy of given id.

PUT

https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/EnrichmentPolicy/{id}

Parameters

Field	Label in UI	Type	Description
id	-	String	Existing enrichment policy id. Mandatory Field
name	Policy Name	String	Enrichment policy name. Mandatory Field
description	Description	String	Description for the enrichment policy. Optional Field
specifications	Specification	[json]	Mandatory Field. See specifications details (same as Create).

Specifications details

Mandatory Field. The following parameters must be provided to define enrichment policy specifications:

• rules: Rules for the enrichment policy. Optional field.

  To define rules, the following parameters must be provided:

  • category: Value can be "simple" or "type_based".

  • operation: Value must be "Equals".

  • prefix: Value can be "true" or "false". Mandatory only when category = "type_based".

  • event_key: Event id. Mandatory only when category = "simple".

  • source_key: Source id.

  • type: Value can only be "ip" or "string" or "num". Mandatory only when category = "type_based".

• source: Enrichment source. Mandatory.

• criteria: Criteria for the enrichment policy.

  To define the enrichment criteria, the following parameters must be provided:

  • type: Value can be "KeyPresents" or "KeyPresentsValueMatches".

  • key: The enrichment policy criteria is fulfilled if this key is present in the log.

  • value: The criteria is fulfilled if the above mentioned key and this value is present in the log. Mandatory.

Request Example

{
    "data": {
        "name": "testPolicy",
        "description": "Enrichment Policy Description.",
        "specifications": [
            {
                "criteria": [
                    {
                        "type": "KeyPresents",
                        "key": "id",
                        "value": ""
                    }
                ],
                "source": "test_odbc",
                "rules": [
                    {
                        "source_key": "id",
                        "operation": "Equals",
                        "event_key": "id",
                        "category": "simple",
                        "type": "string",
                        "prefix": false
                    }
                ]
            }
        ]
    }
}

Success Response

{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}

EnrichmentPolicy - Get

Fetches an enrichment policy with given id.

GET

https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/EnrichmentPolicy/{id}

Parameters

Field	Label in UI	Type	Description
id	-	String	Existing Enrichment Policy id.

Success Response

{
    "name": "testPolicy",
    "specifications": [
        {
            "rules": [
                {
                    "category": "simple",
                    "operation": "Equals",
                    "prefix": false,
                    "event_key": "id",
                    "source_key": "id"
                }
            ],
            "source": "test_odbc",
            "criteria": [
                {
                    "type": "KeyPresents",
                    "key": "id",
                    "value": ""
                }
            ]
        }
    ],
    "id": "574fb123d8aaa4625bfe2d23",
    "description": "Enrichment Policy <i> description </i>."
}

EnrichmentPolicy - List

Lists all enrichment policies.

GET

https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/EnrichmentPolicy

Success Response

Response

[
    {
        "name": "testPolicy",
        "specifications": [
            {
                "rules": [
                    {
                        "category": "simple",
                        "source_key": "id",
                        "prefix": false,
                        "operation": "Equals",
                        "type": "string",
                        "event_key": "id"
                    }
                ],
                "source": "test_odbc",
                "criteria": [
                    {
                        "type": "KeyPresents",
                        "key": "id",
                        "value": ""
                    }
                ]
            }
        ],
        "id": "574fb123d8aaa4625bfe2d23",
        "description": "Enrichment Policy <i> description </i>."
    }
]

EnrichmentPolicy - Trash

Deletes an enrichment policy with given id.

DELETE

https://api-server-host-name/configapi/{pool_UUID}/{logpoint_identifier}/EnrichmentPolicy/{id}

Parameters

Field	Label in UI	Type	Description
id	-	String	Enrichment Policy id. Mandatory Field

Success Response

{
    "status": "Success",
    "message": "/monitorapi/{pool_UUID}/{logpoint_identifier}/orders/{request_id}"
}