[Index]
A rule defining alert settings.
Model ref.: data/AlertingRule
The full URL would include the host-proxy name: https://[host-proxy].
Variables are enclosed in square brackets.
{
"$schema": "http://json-schema.org/draft-03/schema",
"type": "object",
"properties": {
"name": {
"title": "Rule Name",
"description": "Name of the alerting rule. This must be unique per rule group.",
"type": "string",
"maxLength": 255,
"required": true
},
"description": {
"title": "Description",
"description": "Provide a brief description of this Alerting Rule.",
"type": "string",
"maxLength": 8192
},
"enabled": {
"title": "Enabled",
"description": "Is this rule enabled?",
"type": "boolean",
"default": false
},
"severity": {
"title": "Severity",
"type": "string",
"required": true,
"choices": [
{
"value": "Informational",
"title": "Informational"
},
{
"value": "Minor",
"title": "Minor"
},
{
"value": "Major",
"title": "Major"
},
{
"value": "Critical",
"title": "Critical"
}
],
"maxLength": 1024
},
"include_llm_response": {
"title": "Include AI Generated Response to Alerting Message",
"type": "boolean",
"required": false,
"readonly": false,
"default": false
},
"evaluation_frequency": {
"title": "Evaluation Frequency",
"type": "string",
"required": true,
"choices": [
{
"value": "5m",
"title": "Every 5 minutes"
},
{
"value": "10m",
"title": "Every 10 minutes"
},
{
"value": "30m",
"title": "Every 30 minutes"
},
{
"value": "1h",
"title": "Every hour"
},
{
"value": "4h",
"title": "Every 4 hours"
},
{
"value": "1d",
"title": "Every day"
},
{
"value": "1w",
"title": "Every week"
},
{
"value": "1M",
"title": "Every month"
},
{
"value": "1Y",
"title": "Every year"
}
],
"maxLength": 1024
},
"rule_type": {
"title": "Rule Type",
"type": "string",
"default": "Database",
"choices": [
{
"value": "Database",
"title": "Database"
}
],
"maxLength": 1024
},
"firing_actions": {
"title": "Firing Actions",
"type": "array",
"items": {
"type": "object",
"properties": {
"workflow": {
"title": "Workflow",
"type": "string",
"format": "uri",
"required": true,
"target": "/api/data/ProvisioningWorkflow/template_choices/?field=name&format=json&hierarchy=[hierarchy]&auth_token=[authtoken],
"target_attr": "name",
"maxLength": 1024,
"target_model_type": "data/ProvisioningWorkflow",
"choices": []
},
"input_parameters": {
"title": "Input Parameters",
"description": "Additional parameters for the workflow",
"type": "array",
"items": {
"type": "object",
"choices": [],
"properties": {
"name": {
"title": "Name",
"description": "Name of additional input parameter.",
"type": "string",
"required": true,
"items": {
"attr_props": [],
"choices": []
},
"choices": [],
"attr_props": [],
"maxLength": 1024
},
"value": {
"title": "Value",
"description": "Value of additional input parameter.",
"type": "string",
"required": true,
"items": {
"attr_props": [],
"choices": []
},
"choices": [],
"attr_props": [],
"maxLength": 1024
}
}
},
"choices": [],
"attr_props": []
}
}
}
},
"resolved_actions": {
"title": "Resolved Actions",
"type": "array",
"items": {
"type": "object",
"properties": {
"workflow": {
"title": "Workflow",
"type": "string",
"format": "uri",
"required": true,
"target": "/api/data/ProvisioningWorkflow/template_choices/?field=name&format=json&hierarchy=[hierarchy]&auth_token=[authtoken],
"target_attr": "name",
"maxLength": 1024,
"target_model_type": "data/ProvisioningWorkflow",
"choices": []
},
"input_parameters": {
"title": "Input Parameters",
"description": "Additional parameters for the workflow",
"type": "array",
"items": {
"type": "object",
"choices": [],
"properties": {
"name": {
"title": "Name",
"description": "Name of additional input parameter.",
"type": "string",
"required": true,
"items": {
"attr_props": [],
"choices": []
},
"choices": [],
"attr_props": [],
"maxLength": 1024
},
"value": {
"title": "Value",
"description": "Value of additional input parameter.",
"type": "string",
"required": true,
"items": {
"attr_props": [],
"choices": []
},
"choices": [],
"attr_props": [],
"maxLength": 1024
}
}
},
"choices": [],
"attr_props": []
}
}
}
},
"database_rule": {
"title": "Database Rule",
"type": "object",
"properties": {
"datasource": {
"title": "Data Source",
"description": "Specify Data Source",
"type": "string",
"default": "LXT0",
"maxLength": 1024
},
"datasourceInstance": {
"title": "Data Source Instance",
"description": "Specify Data Source Instance",
"type": "string",
"format": "uri",
"choices": [],
"maxLength": 1024,
"target": "/api/choices/?format=json&hierarchy=[hierarchy]&auth_token=[authtoken]
},
"resource_definition": {
"title": "Resource Definition",
"description": "Returns the resource definitions",
"type": "string",
"maxLength": 1024
},
"resource": {
"title": "Resource",
"description": "Specify resource",
"type": "string",
"format": "uri",
"target_attr": "name",
"choices": [],
"maxLength": 1024,
"target": "/api/choices/?format=json&hierarchy=[hierarchy]&auth_token=[authtoken]
},
"_range": {
"title": "Query Date Range",
"description": "Specify the date range for the query",
"type": "string",
"choices": [
{
"value": "Last 5 minutes",
"title": "Last 5 minutes"
},
{
"value": "Last 30 Minutes",
"title": "Last 30 Minutes"
},
{
"value": "Last 60 Minutes",
"title": "Last 60 Minutes"
},
{
"value": "Last 12 Hours",
"title": "Last 12 Hours"
},
{
"value": "Last 24 Hours",
"title": "Last 24 Hours"
},
{
"value": "Last 7 Days",
"title": "Last 7 Days"
},
{
"value": "Last 30 Days",
"title": "Last 30 Days"
},
{
"value": "Last 2 Months",
"title": "Last 2 Months"
},
{
"value": "Last 3 Months",
"title": "Last 3 Months"
},
{
"value": "Last 6 Months",
"title": "Last 6 Months"
},
{
"value": "Last 12 Months",
"title": "Last 12 Months"
},
{
"value": "Previous Hour",
"title": "Previous Hour"
},
{
"value": "Previous Day",
"title": "Previous Day"
},
{
"value": "Previous Week",
"title": "Previous Week"
},
{
"value": "Previous Month",
"title": "Previous Month"
},
{
"value": "Previous Year",
"title": "Previous Year"
},
{
"value": "Through Today",
"title": "Through Today"
},
{
"value": "Through Yesterday",
"title": "Through Yesterday"
}
],
"maxLength": 1024
},
"_lowerTs": {
"title": "Start Timestamp",
"description": "Lower timestamp bound for the data range shown in the chart",
"type": "integer"
},
"_upperTs": {
"title": "End Timestamp",
"description": "Upper timestamp bound for the data range shown in the chart",
"type": "integer"
},
"_outputType": {
"title": "Output Type",
"description": "The format in which the data will be presented in the chart",
"type": "string",
"default": "highcharts",
"choices": [
{
"value": "raw",
"title": "Raw"
},
{
"value": "highcharts",
"title": "Highcharts"
}
],
"maxLength": 1024
},
"_limit": {
"title": "Number of Rows",
"description": "Number of rows to be displayed in the table",
"type": "string",
"default": "0",
"maxLength": 1024
},
"_offset": {
"title": "Starting Row",
"description": "Starting row for table pagination",
"type": "string",
"default": "0",
"maxLength": 1024
},
"over_time": {
"title": "Over Time",
"description": "Specify whether this query should be evaluated over time.",
"type": "boolean",
"default": false
},
"interval": {
"title": "Interval",
"description": "Specify the interval for the query",
"type": "integer",
"default": 1,
"choices": [
{
"value": 1,
"title": "Monthly"
},
{
"value": 2,
"title": "Weekly"
},
{
"value": 3,
"title": "Daily"
},
{
"value": 4,
"title": "Hourly"
},
{
"value": 5,
"title": "Minute"
},
{
"value": 6,
"title": "Second"
}
]
},
"fields": {
"title": "Fields",
"description": "Specify the fields from the resource to be used in the chart.",
"type": "array",
"items": {
"type": "object",
"properties": {
"ruleName": {
"title": "Field Name",
"description": "This is the field name.",
"type": "string",
"required": true,
"choices": [],
"maxLength": 1024
},
"headerName": {
"title": "Friendly Name",
"description": "Specify a friendly name to be used in the chart.",
"type": "string",
"required": true,
"maxLength": 1024
},
"ruleTypeString": {
"title": "Field Type",
"description": "This is the field type",
"type": "integer",
"choices": [
{
"value": 0,
"title": "Text"
},
{
"value": 1,
"title": "Integer"
},
{
"value": 2,
"title": "Float"
}
]
},
"ruleType": {
"title": "Field Type",
"description": "This is the field type",
"type": "integer"
},
"valueType": {
"title": "Value Type",
"description": "This is the operation value type",
"type": "integer"
},
"operation": {
"title": "Operation",
"description": "Select the operation to be performed on the field.",
"type": "string",
"choices": [
{
"value": "Count",
"title": "Count"
},
{
"value": "Grouping Count",
"title": "Grouping Count"
},
{
"value": "Min",
"title": "Min"
},
{
"value": "Max",
"title": "Max"
},
{
"value": "Avg",
"title": "Avg"
},
{
"value": "Sum",
"title": "Sum"
},
{
"value": "Value",
"title": "Value"
},
{
"value": "Variance",
"title": "Variance"
},
{
"value": "Stddev",
"title": "Stddev"
},
{
"value": "Select Query",
"title": "Select Query"
},
{
"value": "Partition By",
"title": "Partition By"
},
{
"value": "Partition Order",
"title": "Partition Order"
}
],
"maxLength": 1024
}
}
}
},
"filters": {
"title": "Filters",
"description": "Specify filters to be applied to the data.",
"type": "array",
"items": {
"type": "object",
"properties": {
"ruleName": {
"title": "Field Name",
"description": "Specify Field Name",
"type": "string",
"choices": [],
"maxLength": 1024
},
"operation": {
"title": "Operation",
"description": "Specify operation",
"type": "string",
"choices": [
{
"value": "LIKE",
"title": "LIKE (Case sensitive)"
},
{
"value": "NOT LIKE",
"title": "NOT LIKE (Case sensitive)"
},
{
"value": "ILIKE",
"title": "ILIKE (Case insensitive)"
},
{
"value": "NOT ILIKE",
"title": "NOT ILIKE (Case insensitive)"
},
{
"value": "=",
"title": "Equals"
},
{
"value": "!=",
"title": "Does Not Equal"
},
{
"value": "IN",
"title": "Contains"
},
{
"value": "NOT IN",
"title": "Does Not Contain"
},
{
"value": "~",
"title": "Regex (Case sensitive)"
},
{
"value": "~*",
"title": "Regex (Case insensitive)"
},
{
"value": "!~",
"title": "Exclude Regex (Case sensitive)"
},
{
"value": "!~*",
"title": "Exclude Regex (Case insenstive)"
}
],
"maxLength": 1024
},
"filterValue": {
"title": "Filter Value",
"description": "Specify filter value",
"type": "string",
"maxLength": 1024
},
"ignore_case": {
"title": "Ignore Case",
"type": "boolean",
"required": false,
"readonly": false
},
"type": {
"title": "Filter Type",
"description": "Specify type",
"type": "integer"
}
}
}
},
"condition": {
"title": "Alert Condition",
"type": "object",
"properties": {
"queryOutputType": {
"title": "Query Output Type",
"description": "Specifies the type of the SQL query output.",
"type": "string",
"choices": [
{
"value": "number",
"title": "Number"
},
{
"value": "list_number",
"title": "List of Numbers"
},
{
"value": "string",
"title": "String"
},
{
"value": "list_string",
"title": "List of Strings"
}
],
"maxLength": 1024
},
"condition_groups": {
"title": "Condition Groups",
"description": "Array of condition groups that can be combined with logical operators.",
"type": "array",
"items": {
"type": "object",
"properties": {
"operand": {
"title": "Operand",
"description": "Defines the logical operator to combine this group with the previous group.",
"type": "string",
"choices": [
{
"value": "OR",
"title": "Logical OR"
},
{
"value": "AND",
"title": "Logical AND"
}
],
"maxLength": 1024
},
"conditions": {
"title": "Conditions",
"description": "List of conditions within this group.",
"type": "array",
"items": {
"type": "object",
"properties": {
"operand": {
"title": "Operand",
"description": "Defines the logical operator to combine this group with the previous group.",
"type": "string",
"choices": [
{
"value": "OR",
"title": "Logical OR"
},
{
"value": "AND",
"title": "Logical AND"
}
],
"maxLength": 1024
},
"field": {
"title": "Field",
"description": "The Friendly Name of the field to be used in the condition.",
"type": "string",
"maxLength": 1024
},
"operator": {
"title": "Operator",
"description": "Defines the comparison operator for the condition.",
"type": "string",
"choices": [
{
"value": "=",
"title": "Equals"
},
{
"value": "!=",
"title": "Does Not Equal"
},
{
"value": "<",
"title": "Less Than"
},
{
"value": "<=",
"title": "Less Than or Equal"
},
{
"value": ">",
"title": "Greater Than"
},
{
"value": ">=",
"title": "Greater Than or Equal"
},
{
"value": "contains",
"title": "Contains"
},
{
"value": "starts_with",
"title": "Starts With"
},
{
"value": "ends_with",
"title": "Ends With"
}
],
"maxLength": 1024
},
"value": {
"title": "Value",
"description": "The value to compare against.",
"type": "string",
"maxLength": 1024
}
}
}
}
}
}
}
}
}
}
}
},
"schema_version": "1.0"
}
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get the GUI Add form. | GET | /api/data/AlertingRule/add/ |
|
The GUI Add form of data/AlertingRule as JSON |
The API call to the /add/ URL can only be made from a hierarchy that allows the model type to be added. The actions in the response shows the url for the POST API call to create an instance.
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Create | POST | /api/data/AlertingRule | hierarchy=[hierarchy] |
|
tool/Transaction/[trans pkid]to inspect the created resource and its instance pkid.
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Bulk delete [pkid1],[pkid2]... | DELETE | /api/data/AlertingRule/ | hierarchy=[hierarchy] | {"hrefs":["/api/data/AlertingRule/[pkid1]", "/api/data/AlertingRule/[pkid2]", ...]} |
GET http://[host-proxy]/api/data/AlertingRule/?hierarchy=[hierarchy]&format=json
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Get a selected [export_format] of the schema and instances [pkid1], [pkid2],... of data/AlertingRule; optionally with tag_version at [version] and Configuration Template as [configtemplate]. | POST | /api/data/AlertingRule/export/ |
|
{ "hrefs":["/api/data/AlertingRule/[pkid1]", "/api/data/AlertingRule/[pkid2]",...]}} |
For export_format=json, the response is a time stamped zip file of data in JSON as in the system database. Item properties such as strings that are empty or Boolean values that are not set, are not included. The filename in the response is of the format as the example:
Content-Disposition: attachment; filename=export_2013-05-17_14:20:19.186444.json.zip
Content-Language:en
Content-Type:application/x-zip
For export_format=raw_xlsx, the response is a MS Excel spreadsheet with columns corresponding to the JSON format export and a response filename format:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
For export_format=xlsx, the response is a MS Excel spreadsheet, arranged by any Field Display Policies that apply. The columns correspond with those of a Bulk Load Template export sheet. The response filename format is:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_formatted_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
The XLSX format can be used to bulk load instances of data/AlertingRule and the JSON format can be used to import instances of data/AlertingRule.
GET http://[host-proxy]/api/data/AlertingRule/?hierarchy=[hierarchy]
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get a compressed format of the Bulk Load spreadsheet template for data/AlertingRule | POST | /api/data/AlertingRule/export_bulkload_template/ |
|
The response is an attachment of the format: filetype_bulkloadsheet.xlsx.gz |
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Configuration Template | GET | /api/data/AlertingRule/configuration_template/ | hierarchy=[hierarchy] |
|
POST http://[host-proxy]/api/data/ConfigurationTemplate/?hierarchy=[hierarchy]
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Field Display Policy | GET | /api/data/AlertingRule/field_display_policy/ | hierarchy=[hierarchy] |
|
POST http://[host-proxy]/api/data/FieldDisplayPolicy/?hierarchy=[hierarchy]
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| List | GET | /api/data/AlertingRule/ |
|
The data/AlertingRule schema and all instances as JSON. |
(The list will return 0 to 3 data/AlertingRule instances)
{
"pagination": {
"skip": 0,
"limit": 3,
"maximum_limit": 2000,
"total": 9,
"total_limit": null,
"order_by": "name",
"direction": "asc",
"current": "/api/data/AlertingRule/?skip=0&limit=3&order_by=name&direction=asc&traversal=fulltree"
},
"operations": [
"add",
"bulk_update_form",
"list",
"update",
"transform",
"migration",
"remove",
"export",
"help",
"configuration_template",
"field_display_policy",
"get",
"export_bulkload_template"
],
"meta": {
"model_type": "data/AlertingRule",
"summary_attrs": [
{
"name": "name",
"title": "Rule Name"
},
{
"name": "description",
"title": "Description"
},
{
"name": "enabled",
"title": "Enabled"
},
{
"name": "severity",
"title": "Severity"
},
{
"name": "evaluation_frequency",
"title": "Evaluation Frequency"
},
{
"name": "hierarchy_friendly_name",
"title": "Located At",
"allow_filtering": true
}
],
"tagged_versions": [],
"tags": [],
"title": "",
"business_key": {
"unique": [
"name"
],
"hierarchy": true
},
"api_version": "21.2",
"cached": true,
"references": {
"children": [],
"parent": [
{
"href": "/api/data/HierarchyNode/6t0ggef2c0deab00hb595101",
"pkid": "6t0ggef2c0deab00hb595101"
}
],
"device": [
{
"href": "",
"pkid": ""
}
],
"foreign_key": []
},
"model_specific_actions": [
"get",
"list",
"add",
"clone",
"update",
"remove",
"export",
"export_bulkload_template",
"configuration_template",
"field_display_policy",
"help"
],
"schema_version": "1.0",
"actions": [
{
"add": {
"method": "GET",
"class": "add",
"href": "/api/data/AlertingRule/add/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Add"
}
},
{
"remove": {
"method": "DELETE",
"class": "delete",
"href": "/api/data/AlertingRule/?hierarchy=[hierarchy]",
"support_async": true,
"title": "Delete"
}
},
{
"export": {
"method": "POST",
"class": "export",
"href": "/api/data/AlertingRule/export/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Export",
"view": "/api/view/ExportData/add/?auth_token=[authtoken],
"submit": "payload"
}
},
{
"export_bulkload_template": {
"method": "POST",
"class": "bulkload_template",
"href": "/api/data/AlertingRule/export_bulkload_template/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Export Bulk Load Template"
}
},
{
"configuration_template": {
"method": "GET",
"class": "config",
"href": "/api/data/AlertingRule/configuration_template/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Configuration Template"
}
},
{
"field_display_policy": {
"method": "GET",
"class": "display_policy",
"href": "/api/data/AlertingRule/field_display_policy/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Field Display Policy"
}
},
{
"list": {
"method": "GET",
"class": "list",
"href": "/api/data/AlertingRule/?hierarchy=[hierarchy]",
"support_async": false,
"title": "List"
}
},
{
"help": {
"method": "GET",
"class": "help",
"href": "/api/data/AlertingRule/help?hierarchy=[hierarchy]",
"support_async": false,
"title": "Help"
}
}
]
},
"resources": [
{
"data": {
"name": "Default Example - Exchange - Inactive Licensed Mailbox",
"description": "Template: mailbox exists, an Exchange-relevant license is present, and there has been no send/receive activity for N days. Example email: licensed mailboxes with no email activity in 60 days, annual savings estimate, patterns (former employees, mis-licensed shared mailboxes), and a future [Review Mailboxes] action (offboard license, contact user, or training links).\n\nFILTER SETUP: The bundled filter uses a sentinel UserPrincipalName so the rule never matches until you replace it with real Reporter/LXT columns (e.g. last activity age, license flags) from Microsoft Exchange Online User Mailbox or an analytics join. Remove the sentinel row and add validated filters before enabling.",
"enabled": false,
"severity": "Major",
"evaluation_frequency": "1d",
"rule_type": "Database",
"firing_actions": [
{
"workflow": "AlertingSendEmail"
}
],
"database_rule": {
"datasource": "LXT0",
"resource": "Microsoft Exchange Online User Mailbox",
"_range": "Last 30 Days",
"_outputType": "raw",
"_limit": "0",
"_offset": "0",
"fields": [
{
"ruleName": "UserPrincipalName",
"headerName": "match_count",
"ruleTypeString": 0,
"ruleType": 0,
"valueType": 0,
"operation": "Count"
}
],
"filters": [
{
"ruleName": "UserPrincipalName",
"operation": "=",
"filterValue": "__voss_template_replace_filters_before_enable__"
}
],
"condition": {
"queryOutputType": "number",
"condition_groups": [
{
"operand": "AND",
"conditions": [
{
"operand": "AND",
"field": "match_count",
"operator": ">",
"value": "0"
}
]
}
]
}
},
"pkid": "69ee3a3062dfd021865c58ad",
"hierarchy_friendly_name": "sys (System)",
"hierarchy_path": "sys"
},
"meta": {
"model_type": "data/AlertingRule",
"summary_attrs": [
{
"name": "name",
"title": "Rule Name"
},
{
"name": "description",
"title": "Description"
},
{
"name": "enabled",
"title": "Enabled"
},
{
"name": "severity",
"title": "Severity"
},
{
"name": "evaluation_frequency",
"title": "Evaluation Frequency"
},
{
"name": "hierarchy_friendly_name",
"title": "Located At",
"allow_filtering": true
}
],
"tagged_versions": [],
"tags": [
"alerting",
"V4UC",
"ba_CommonOverlay",
"V4UC",
"ba_CommonOverlay"
],
"title": "Default Example - Exchange - Inactive Licensed Mailbox",
"business_key": {
"unique": [
"name"
],
"hierarchy": true
},
"api_version": "21.2",
"cached": true,
"references": {
"parent": [
{
"pkid": "6t0ggef2c0deab00hb595101",
"href": "/api/data/HierarchyNode/6t0ggef2c0deab00hb595101"
}
],
"device": [
{
"href": "",
"pkid": ""
}
],
"foreign_key": [
{
"path": "firing_actions.0.workflow",
"model_type": "data/ProvisioningWorkflow"
}
],
"owner": [
{
"pkid": ""
}
],
"self": [
{
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/",
"pkid": "69ee3a3062dfd021865c58ac"
}
]
},
"path": [
"6t0ggef2c0deab00hb595101",
"69ee3a3062dfd021865c58ac"
],
"schema_version": "1.0",
"actions": [
{
"update": {
"method": "PUT",
"class": "update",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/",
"support_async": true,
"title": "Modify"
}
},
{
"remove": {
"method": "DELETE",
"class": "delete",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/",
"support_async": true,
"title": "Delete"
}
},
{
"clone": {
"method": "GET",
"class": "clone",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/clone/?schema=&schema_rules=true",
"support_async": false,
"title": "Clone"
}
},
{
"export": {
"method": "GET",
"class": "export",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/export/",
"support_async": false,
"title": "Export",
"view": "/api/view/ExportData/add/",
"submit": "payload"
}
},
{
"get": {
"method": "GET",
"class": "get",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/",
"support_async": false,
"title": "Get"
}
},
{
"help": {
"method": "GET",
"class": "help",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/help",
"support_async": false,
"title": "Help"
}
}
],
"summary": "false"
},
"pkid": "69ee3a3062dfd021865c58ac"
},
{
"data": {
"name": "Default Example - Exchange - Mailbox Near Capacity",
"description": "Template: operational risk when mailbox storage crosses a high watermark (for example 85\u201390%+ of quota). Example email: users hitting send/receive risk, recommended actions (enable archiving, raise quota, cleanup), and a future [View Affected Users] drill-down.\n\nFILTER SETUP: Confirm LXT columns for percent-used or byte ratio versus ProhibitSendQuota on Microsoft Exchange Online User Mailbox. Replace the sentinel filter before enabling.",
"enabled": false,
"severity": "Critical",
"evaluation_frequency": "1d",
"rule_type": "Database",
"firing_actions": [
{
"workflow": "AlertingSendEmail"
}
],
"database_rule": {
"datasource": "LXT0",
"resource": "Microsoft Exchange Online User Mailbox",
"_range": "Last 24 Hours",
"_outputType": "raw",
"_limit": "0",
"_offset": "0",
"fields": [
{
"ruleName": "UserPrincipalName",
"headerName": "match_count",
"ruleTypeString": 0,
"ruleType": 0,
"valueType": 0,
"operation": "Count"
}
],
"filters": [
{
"ruleName": "UserPrincipalName",
"operation": "=",
"filterValue": "__voss_template_replace_filters_before_enable__"
}
],
"condition": {
"queryOutputType": "number",
"condition_groups": [
{
"operand": "AND",
"conditions": [
{
"operand": "AND",
"field": "match_count",
"operator": ">",
"value": "0"
}
]
}
]
}
},
"pkid": "69ee3a3062dfd021865c58b5",
"hierarchy_friendly_name": "sys (System)",
"hierarchy_path": "sys"
},
"meta": {
"model_type": "data/AlertingRule",
"summary_attrs": [
{
"name": "name",
"title": "Rule Name"
},
{
"name": "description",
"title": "Description"
},
{
"name": "enabled",
"title": "Enabled"
},
{
"name": "severity",
"title": "Severity"
},
{
"name": "evaluation_frequency",
"title": "Evaluation Frequency"
},
{
"name": "hierarchy_friendly_name",
"title": "Located At",
"allow_filtering": true
}
],
"tagged_versions": [],
"tags": [
"alerting",
"V4UC",
"ba_CommonOverlay",
"V4UC",
"ba_CommonOverlay"
],
"title": "Default Example - Exchange - Mailbox Near Capacity",
"business_key": {
"unique": [
"name"
],
"hierarchy": true
},
"api_version": "21.2",
"cached": true,
"references": {
"parent": [
{
"pkid": "6t0ggef2c0deab00hb595101",
"href": "/api/data/HierarchyNode/6t0ggef2c0deab00hb595101"
}
],
"device": [
{
"href": "",
"pkid": ""
}
],
"foreign_key": [
{
"path": "firing_actions.0.workflow",
"model_type": "data/ProvisioningWorkflow"
}
],
"owner": [
{
"pkid": ""
}
],
"self": [
{
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58b4/",
"pkid": "69ee3a3062dfd021865c58b4"
}
]
},
"path": [
"6t0ggef2c0deab00hb595101",
"69ee3a3062dfd021865c58b4"
],
"schema_version": "1.0",
"actions": [
{
"update": {
"method": "PUT",
"class": "update",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58b4/",
"support_async": true,
"title": "Modify"
}
},
{
"remove": {
"method": "DELETE",
"class": "delete",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58b4/",
"support_async": true,
"title": "Delete"
}
},
{
"clone": {
"method": "GET",
"class": "clone",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58b4/clone/?schema=&schema_rules=true",
"support_async": false,
"title": "Clone"
}
},
{
"export": {
"method": "GET",
"class": "export",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58b4/export/",
"support_async": false,
"title": "Export",
"view": "/api/view/ExportData/add/",
"submit": "payload"
}
},
{
"get": {
"method": "GET",
"class": "get",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58b4/",
"support_async": false,
"title": "Get"
}
},
{
"help": {
"method": "GET",
"class": "help",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58b4/help",
"support_async": false,
"title": "Help"
}
}
],
"summary": "false"
},
"pkid": "69ee3a3062dfd021865c58b4"
},
{
"data": {
"name": "Default Example - Exchange - Oversized Quota Underutilized",
"description": "Template: users on high mailbox quotas (for example E5-sized) with storage usage far below quota (for example under 10% of provisioned space). Example email: potential savings from downsizing SKU or quota, and a future [View Recommendations] remediation picker.\n\nFILTER SETUP: Confirm LXT column names for quota, used bytes, and premium license linkage on Microsoft Exchange Online User Mailbox (or a derived analytics resource). Replace the sentinel filter before enabling.",
"enabled": false,
"severity": "Minor",
"evaluation_frequency": "1w",
"rule_type": "Database",
"firing_actions": [
{
"workflow": "AlertingSendEmail"
}
],
"database_rule": {
"datasource": "LXT0",
"resource": "Microsoft Exchange Online User Mailbox",
"_range": "Last 30 Days",
"_outputType": "raw",
"_limit": "0",
"_offset": "0",
"fields": [
{
"ruleName": "UserPrincipalName",
"headerName": "match_count",
"ruleTypeString": 0,
"ruleType": 0,
"valueType": 0,
"operation": "Count"
}
],
"filters": [
{
"ruleName": "UserPrincipalName",
"operation": "=",
"filterValue": "__voss_template_replace_filters_before_enable__"
}
],
"condition": {
"queryOutputType": "number",
"condition_groups": [
{
"operand": "AND",
"conditions": [
{
"operand": "AND",
"field": "match_count",
"operator": ">",
"value": "0"
}
]
}
]
}
},
"pkid": "69ee3a3062dfd021865c58bd",
"hierarchy_friendly_name": "sys (System)",
"hierarchy_path": "sys"
},
"meta": {
"model_type": "data/AlertingRule",
"summary_attrs": [
{
"name": "name",
"title": "Rule Name"
},
{
"name": "description",
"title": "Description"
},
{
"name": "enabled",
"title": "Enabled"
},
{
"name": "severity",
"title": "Severity"
},
{
"name": "evaluation_frequency",
"title": "Evaluation Frequency"
},
{
"name": "hierarchy_friendly_name",
"title": "Located At",
"allow_filtering": true
}
],
"tagged_versions": [],
"tags": [
"alerting",
"V4UC",
"ba_CommonOverlay",
"V4UC",
"ba_CommonOverlay"
],
"title": "Default Example - Exchange - Oversized Quota Underutilized",
"business_key": {
"unique": [
"name"
],
"hierarchy": true
},
"api_version": "21.2",
"cached": true,
"references": {
"parent": [
{
"pkid": "6t0ggef2c0deab00hb595101",
"href": "/api/data/HierarchyNode/6t0ggef2c0deab00hb595101"
}
],
"device": [
{
"href": "",
"pkid": ""
}
],
"foreign_key": [
{
"path": "firing_actions.0.workflow",
"model_type": "data/ProvisioningWorkflow"
}
],
"owner": [
{
"pkid": ""
}
],
"self": [
{
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58bc/",
"pkid": "69ee3a3062dfd021865c58bc"
}
]
},
"path": [
"6t0ggef2c0deab00hb595101",
"69ee3a3062dfd021865c58bc"
],
"schema_version": "1.0",
"actions": [
{
"update": {
"method": "PUT",
"class": "update",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58bc/",
"support_async": true,
"title": "Modify"
}
},
{
"remove": {
"method": "DELETE",
"class": "delete",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58bc/",
"support_async": true,
"title": "Delete"
}
},
{
"clone": {
"method": "GET",
"class": "clone",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58bc/clone/?schema=&schema_rules=true",
"support_async": false,
"title": "Clone"
}
},
{
"export": {
"method": "GET",
"class": "export",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58bc/export/",
"support_async": false,
"title": "Export",
"view": "/api/view/ExportData/add/",
"submit": "payload"
}
},
{
"get": {
"method": "GET",
"class": "get",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58bc/",
"support_async": false,
"title": "Get"
}
},
{
"help": {
"method": "GET",
"class": "help",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58bc/help",
"support_async": false,
"title": "Help"
}
}
],
"summary": "false"
},
"pkid": "69ee3a3062dfd021865c58bc"
}
]
}
(Show the first instance)
{
"data": {
"name": "Default Example - Exchange - Inactive Licensed Mailbox",
"description": "Template: mailbox exists, an Exchange-relevant license is present, and there has been no send/receive activity for N days. Example email: licensed mailboxes with no email activity in 60 days, annual savings estimate, patterns (former employees, mis-licensed shared mailboxes), and a future [Review Mailboxes] action (offboard license, contact user, or training links).\n\nFILTER SETUP: The bundled filter uses a sentinel UserPrincipalName so the rule never matches until you replace it with real Reporter/LXT columns (e.g. last activity age, license flags) from Microsoft Exchange Online User Mailbox or an analytics join. Remove the sentinel row and add validated filters before enabling.",
"enabled": false,
"severity": "Major",
"evaluation_frequency": "1d",
"rule_type": "Database",
"firing_actions": [
{
"workflow": "AlertingSendEmail"
}
],
"database_rule": {
"datasource": "LXT0",
"resource": "Microsoft Exchange Online User Mailbox",
"_range": "Last 30 Days",
"_outputType": "raw",
"_limit": "0",
"_offset": "0",
"fields": [
{
"ruleName": "UserPrincipalName",
"headerName": "match_count",
"ruleTypeString": 0,
"ruleType": 0,
"valueType": 0,
"operation": "Count"
}
],
"filters": [
{
"ruleName": "UserPrincipalName",
"operation": "=",
"filterValue": "__voss_template_replace_filters_before_enable__"
}
],
"condition": {
"queryOutputType": "number",
"condition_groups": [
{
"operand": "AND",
"conditions": [
{
"operand": "AND",
"field": "match_count",
"operator": ">",
"value": "0"
}
]
}
]
}
},
"pkid": "69ee3a3062dfd021865c58ad"
},
"meta": {
"model_type": "data/AlertingRule",
"summary_attrs": [
{
"name": "name",
"title": "Rule Name"
},
{
"name": "description",
"title": "Description"
},
{
"name": "enabled",
"title": "Enabled"
},
{
"name": "severity",
"title": "Severity"
},
{
"name": "evaluation_frequency",
"title": "Evaluation Frequency"
},
{
"name": "hierarchy_friendly_name",
"title": "Located At",
"allow_filtering": true
}
],
"tagged_versions": [],
"tags": [
"alerting",
"V4UC",
"ba_CommonOverlay",
"V4UC",
"ba_CommonOverlay"
],
"title": "Default Example - Exchange - Inactive Licensed Mailbox",
"business_key": {
"unique": [
"name"
],
"hierarchy": true
},
"api_version": "21.2",
"cached": false,
"references": {
"parent": [
{
"href": "/api/data/HierarchyNode/6t0ggef2c0deab00hb595101",
"pkid": "6t0ggef2c0deab00hb595101"
}
],
"device": [
{
"href": "",
"pkid": ""
}
],
"foreign_key": [
{
"path": "firing_actions.0.workflow",
"model_type": "data/ProvisioningWorkflow"
}
],
"owner": [
{
"pkid": ""
}
],
"children": [],
"self": [
{
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/",
"pkid": "69ee3a3062dfd021865c58ac"
}
]
},
"path": [
"6t0ggef2c0deab00hb595101",
"69ee3a3062dfd021865c58ac"
],
"schema_version": "1.0",
"actions": [
{
"update": {
"method": "PUT",
"class": "update",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/?hierarchy=[hierarchy]",
"support_async": true,
"title": "Modify"
}
},
{
"remove": {
"method": "DELETE",
"class": "delete",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/?hierarchy=[hierarchy]",
"support_async": true,
"title": "Delete"
}
},
{
"clone": {
"method": "GET",
"class": "clone",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/clone/?hierarchy=[hierarchy]&schema=&schema_rules=true",
"support_async": false,
"title": "Clone"
}
},
{
"export": {
"method": "GET",
"class": "export",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/export/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Export",
"view": "/api/view/ExportData/add/?auth_token=[authtoken],
"submit": "payload"
}
},
{
"get": {
"method": "GET",
"class": "get",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Get"
}
},
{
"help": {
"method": "GET",
"class": "help",
"href": "/api/data/AlertingRule/69ee3a3062dfd021865c58ac/help?hierarchy=[hierarchy]",
"support_async": false,
"title": "Help"
}
}
]
},
"pkid": "69ee3a3062dfd021865c58ac"
}
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get the on-line Help for data/AlertingRule. | GET | /api/data/AlertingRule/help | hierarchy=[hierarchy] | On-line help of Model ref.: data/AlertingRule as HTML |
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Modify | PUT | /api/data/AlertingRule/[pkid] | hierarchy=[hierarchy] | (For payload specification) |
For Bulk modification, refer to the Bulk Modify section.
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Delete | DELETE | /api/data/AlertingRule/[pkid] | hierarchy=[hierarchy] |
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Clone instance with [pkid]. The schema rules are applied. | GET | /api/data/AlertingRule/[pkid]/clone/?schema=&schema_rules=true |
|
A JSON payload with:
|
GET http://[host-proxy]/api/data/AlertingRule/?hierarchy=[hierarchy]&format=json
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get a selected [export_format] of the schema and a single instance with [pkid] of data/AlertingRule; optionally with tag_version at [version] and Configuration Template as [configtemplate]. | GET | /api/data/AlertingRule/[pkid]/export |
|
The response is an attachment. Refer to the list below. |
For export_format=raw_xlsx, the response is a "raw" MS Excel spreadsheet with columns corresponding to the JSON format export and a response format:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
For export_format=xlsx, the response is a MS Excel spreadsheet, formatted to show all columns and a response format:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_formatted_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
For export_format=json, the response is a time stamped zip file of data in JSON and a response format:
Content-Disposition: attachment; filename=export_2013-05-17_14:20:19.186444.json.zip
Content-Language:en
Content-Type:application/x-zip
The XLSX format can be used to bulk load instances of data/AlertingRule and the JSON format can be used to import instances of data/AlertingRule.
For Bulk Export, refer to the Bulk Export section.
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get | GET | /api/data/AlertingRule/[pkid] | hierarchy=[hierarchy] | The data/AlertingRule instance with [pkid]. |
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Help | GET | /api/data/AlertingRule/[pkid]/help | hierarchy=[hierarchy] | The on-line Help for data/AlertingRule. |