Get event processing policy rule
Retrieve a single event processing policy rule by its GUID.
Path parameters
Rule GUID
Response
Rule retrieved successfully
Rule GUID. A new random GUID is generated on input if omitted.
1-based position of the rule in the policy (output only; ignored on input - array order is authoritative)
Rule flags bitmask: 0x000001 stop processing, 0x000002 negated source match, 0x000004 negated event match, 0x000008 generate alarm, 0x000010 disabled, 0x000020 terminate alarms by regular expression, 0x000100..0x001000 match severity (info/warning/minor/major/critical), 0x002000 create helpdesk ticket, 0x004000 accept correlated events, 0x008000 negated time frame match, 0x010000 start downtime, 0x020000 end downtime, 0x040000 request AI comment, 0x080000 create incident, 0x100000 AI analyze incident, 0x200000 AI auto-assign incident
Source object IDs the rule matches (empty = match any source)
Source object IDs explicitly excluded from matching
Event codes the rule matches (empty = match any event)
NXSL filter script source; rule matches only if the script returns true
Severity of the generated alarm: 0=Normal, 1=Warning, 2=Minor, 3=Major, 4=Critical, 5=same as event, 6=terminate alarms, 7=resolve alarms
Alarm key template (supports macro expansion)
Alarm message template (supports macro expansion)
Alarm impact description template
Alarm timeout in seconds (0 = no timeout)
Event code generated when the alarm times out
Alarm category IDs assigned to the generated alarm
Name of the library script used for root cause analysis
Timer keys to cancel when the rule matches
NXSL action script executed when the rule matches
Persistent storage entries to set (key/value pairs; values support macro expansion)
Persistent storage keys to delete
Custom attributes to set on the source object (key/value pairs; values support macro expansion)
Custom attribute names to delete from the source object
Downtime tag used when starting or ending maintenance downtime
Delay in seconds before an incident is created (0 = immediate)
Incident title template (empty = use alarm message)
Incident description template
Depth of AI incident analysis (0=quick, 1=standard, 2=thorough)
Custom AI analysis instructions for the incident
Instructions for the AI agent when generating an alarm comment
Rule description