{"openapi":"3.0.1","info":{"title":"AIE API","description":"Auto-generated Swagger documentation","version":"v1"},"paths":{"/lr-aie-api/aie/rules/import":{"post":{"tags":["Rules"],"summary":"Imports an AIE rule from the specified .airx file.","description":"1. This endpoint allows you to import an AIE rule from a specified .airx file path. You can control the import behavior using the listSyncSetting parameter.\r\n\r\n2. Only files with the .airx extension are permitted for import.\r\n\r\n3. Available values for listSyncSetting include: \r\n\r\n - DoNotImportListContents \r\n - ImportListContents \r\n - MergeListContents","requestBody":{"description":"The import request containing the file path and list sync settings.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ImportRuleRequest"}]}},"text/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ImportRuleRequest"}]}},"application/*+json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ImportRuleRequest"}]}}}},"responses":{"200":{"description":"Success. If the AIE rule is imported successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/AIERuleImportResponseApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/AIERuleImportResponseApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/AIERuleImportResponseApiResponse"}}}},"400":{"description":"Bad Request: If the request is invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized: If the user is not authorized.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden: If the user does not have permission.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal server error. If an exception occurs.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules/status":{"patch":{"tags":["Rules"],"summary":"Updates the statuses of AIE rules in batch.","description":"1. This endpoint batch-updates the status of AIE rules.\r\n\r\n2. If all rules are updated successfully, no ruleIds are returned in the response.\r\n\r\n3. Any rules that fail to update appear in the notProcessedAIERules section, along with an associated error message.\r\n\r\n4. Available status values: Disabled, Enabled, Suspended, Learning, Paused, _Varies.","requestBody":{"description":"A list of rule status requests specifying rule IDs and desired statuses.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AIERulesStatusRequest"}}},"text/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AIERulesStatusRequest"}}},"application/*+json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AIERulesStatusRequest"}}}}},"responses":{"200":{"description":"Success. If all the rules are processed successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/RuleEnableDisableResponseApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/RuleEnableDisableResponseApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/RuleEnableDisableResponseApiResponse"}}}},"400":{"description":"Bad Request: If the request is invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized: If the user is not authorized.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden: If the user does not have permission.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal server error. If an exception occurs.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules/restartService":{"post":{"tags":["Rules"],"summary":"Initiates restart request of the AIE service for the specified engine.","description":"This endpoint initiates the restart process for the AIE Engine service.","parameters":[{"name":"engineId","in":"query","description":"The ID of the engine to restart.","required":true,"schema":{"type":"integer","format":"int32"}}],"responses":{"200":{"description":"Success. If the service restart request initiated successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"400":{"description":"Bad Request: If the engineId is invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized: If the user is not authorized.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden: If the user does not have permission.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal server error. If an exception occurs.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules/summary/{engineId}":{"get":{"tags":["Rules"],"summary":"Returns a collection of AIE rule summary objects associated with a specific engine.","description":"This endpoint retrieves AIE rules for the specified `engineId`.\r\n \r\nRules can be filtered using supported query parameters.\r\nAll query parameter names use camelCase.\r\n \r\nResults are returned in paged chunks using `offset` and `count`\r\nbased pagination.","parameters":[{"name":"engineId","in":"path","description":"engineId used to fetch associated AIE rules.","required":true,"schema":{"type":"integer","format":"int32"}},{"name":"offset","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"count","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"orderBy","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/RulesSummarySortField"}]}},{"name":"dir","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/SortDirectionEnum"}]}},{"name":"ruleId","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"ruleName","in":"query","schema":{"type":"string"}},{"name":"ruleGroup","in":"query","schema":{"type":"string"}},{"name":"description","in":"query","schema":{"type":"string"}},{"name":"ruleSetName","in":"query","schema":{"type":"string"}},{"name":"alarmStatus","in":"query","schema":{"type":"boolean"}},{"name":"alarmAutoDrilldown","in":"query","schema":{"type":"boolean"}},{"name":"ruleStatus","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/AIERuleStatus"}]}},{"name":"runtimePriority","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/RuntimePriorityEnum"}]}},{"name":"edf","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/EnvDepFacEnum"}]}},{"name":"fpp","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}]}},{"name":"permissions","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/AccessTypeEnum"}]}},{"name":"dataSegregationMode","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/AIEDataSegregationEnum"}]}},{"name":"dateUpdated","in":"query","schema":{"type":"string","format":"date-time"}},{"name":"activationDate","in":"query","schema":{"type":"string","format":"date-time"}},{"name":"expirationDate","in":"query","schema":{"type":"string","format":"date-time"}},{"name":"restart","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/RestartStatusEnum"}]}}],"responses":{"200":{"description":"Success. AIE rule summaries retrieved successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/AIERuleSummaryResponseIReadOnlyListApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/AIERuleSummaryResponseIReadOnlyListApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/AIERuleSummaryResponseIReadOnlyListApiResponse"}}}},"400":{"description":"Bad Request. The engineId or query parameters are invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized. The user is not authenticated.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden. The user does not have permission to access this resource.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"404":{"description":"NotFound. The particular resource not found.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal Server Error. An unexpected error occurred.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules/{ruleId}":{"patch":{"tags":["Rules"],"summary":"Partially updates an existing AIE rule.","description":"This endpoint allows partial updates to an existing AIE rule. Only the fields included in the request payload will be updated. All other fields will remain unchanged.\r\nAll requests are validated before updates are applied. If validation fails, the update request will be rejected.\r\n\r\nGeneral Behavior:\r\n- All requests are validated before updates are applied.\r\n- Fields not included in the request remain unchanged.\r\n\r\nUser Profile and Privileges:\r\n- Users must have AIE Rule Update/Edit privilege to modify a rule.\r\n- Requests from users without the required privilege will return an authorization error.\r\n- Rule updates may be restricted based on the user's profile permissions.\r\n\r\nRule Name Synchronization:\r\n- If syncWithRuleName = true:\r\n - information.ruleName is required.\r\n - The system automatically prefixes the rule name with \"AIE:\".\r\n\r\n- If syncWithRuleName = false:\r\n - commonEvent.commonEventId must be provided.\r\n - The rule links to the specified Common Event.\r\n\r\nAlarm Configuration:\r\n- If only alarmOnEventOccurrence is provided:\r\n - alarmAutoDrillDown is automatically set to the same value.\r\n\r\n- If both values are provided:\r\n - alarmAutoDrillDown can be true or false only when alarmOnEventOccurrence = true.\r\n\r\nEvent Forwarding:\r\n- If enableEventForwarding = false, the following fields will be ignored:\r\n - notify\r\n - decimalPlaces\r\n - alarmOnEventOccurrence\r\n - alarmAutoDrillDown\r\n\r\nEvent Suppression:\r\n- If enableSuppression = true and suppressionMultiple is not provided:\r\n - suppressionMultiple will default to 1.\r\n\r\n- Set enableSuppression = false to disable suppression.\r\n\r\nExpiration Date:\r\n- Must be a future date.\r\n- Past dates are not allowed.\r\n- Pass null to remove the expiration date.\r\n- If omitted, the current value remains unchanged.\r\n\r\nNullable Text Fields:\r\n- Fields: briefDesc, additionalDetails, ruleGroup\r\n- Pass null to clear the value.\r\n- If omitted, the current value remains unchanged.\r\n\r\nRuleBlocks Configuration:\r\n\r\nThe ruleBlocks array allows you to define or update the detection logic for the AIE rule. Each rule can have 1 to 3 rule blocks that work together to detect complex patterns.\r\n\r\nGeneral Rules:\r\n- Minimum: 1 rule block is required when ruleBlocks is provided\r\n- Maximum: 3 rule blocks are allowed per rule\r\n- Block Order: Rule blocks are processed in sequence (blockId: 0, 1, 2)\r\n- Block IDs: Must be sequential starting from 0 (e.g., 0, 1, or 0, 1, 2)\r\n\r\nRule Block Types and Restrictions:\r\n\r\nBlock Composition Rules:\r\n\r\n- Single Block Rules (1 block):\r\n - Can use: LogObserved, LogNotObservedScheduled, ThresholdObserved, ThresholdNotObservedScheduled, UniqueValuesObserved, UniqueValuesNotObservedScheduled, WhiteList, Statistical, Trend\r\n - Cannot use: LogNotObservedCompound, ThresholdNotObservedCompound, UniqueValuesNotObservedCompound (these require a preceding block)\r\n\r\n- Two Block Rules (2 blocks):\r\n - First block must be: LogObserved, ThresholdObserved, UniqueValuesObserved, or WhiteList\r\n - Second block can be: Any *NotObservedCompound type or *Observed type\r\n\r\n- Three Block Rules (3 blocks):\r\n - First block must be: LogObserved, ThresholdObserved, UniqueValuesObserved, or WhiteList\r\n - Second block must be: Observed type only (not *NotObserved)\r\n - Third block can be: Any *NotObservedCompound type or *Observed type\r\n\r\nRequired Properties Per Block:\r\n\r\nCommon Required Properties (All Blocks):\r\n- ruleBlockType: Type discriminator (must match one of the supported types)\r\n- blockId: Sequential ID starting from 0\r\n- dataSource: Data source configuration\r\n - dataSourceId: Must be 1 (DataProcessorLogs) or 101 (AdvancedIntelligenceEngineEvents)\r\n- filter_MsgFilters: At least one message filter required (cannot be empty)\r\n - Each filter requires fieldFilters array\r\n - Each fieldFilter requires fieldFilterValues array (unless filtering null values)\r\n - sortOrder must be sequential starting from 0\r\n\r\nGroupBy Fields:\r\n- Required for: ThresholdObserved, ThresholdNotObservedCompound, UniqueValuesObserved, UniqueValuesNotObservedCompound, WhiteList \r\n- Cannot be duplicate within the same block\r\n- Cannot use both Entity and RootEntity when dataSegregationMode is enabled\r\n- Cannot use SLocationCountry, SLocationRegion, and SLocation together (choose only one)\r\n\r\nRule Block Relationships (Blocks 1 and 2):\r\n- ruleBlockRelationship is required for blockId 1 and 2\r\n- Properties:\r\n - ruleBlockA_GUID: GUID of the preceding block\r\n - ruleBlockB_GUID: GUID of the current block\r\n - durationOffsetSeconds: Must be 0 for the first relationship\r\n - durationSeconds: Must be ≥ 60 for subsequent blocks\r\n - fieldRelationships: Array of field links between blocks\r\n - ruleBlockA_Field: Must exist in preceding block's groupByFields\r\n - ruleBlockB_Field: Must exist in current block's groupByFields\r\n - joinType: Valid values: \"0\" (Inner), \"1\" (LeftOuter), \"2\" (RightOuter), \"3\" (FullOuter)\r\n\r\nType-Specific Properties:\r\n\r\n- ThresholdObserved / ThresholdNotObservedCompound / ThresholdNotObservedScheduled:\r\n - thresholdFields: Required, at least one threshold definition\r\n - field: Field to count (must be a supported threshold field)\r\n - thresholdCount: Count threshold (must be > 0)\r\n\r\n- UniqueValuesObserved / UniqueValuesNotObservedCompound / UniqueValuesNotObservedScheduled:\r\n - distinctOccurrenceFields: Required, exactly one unique value field\r\n - field: Field to track unique values (must be supported)\r\n - count: Occurrence count (must be > 0)\r\n - Important: The unique value field cannot also be in groupByFields\r\n\r\n- NotObservedScheduled Types (LogNotObservedScheduled, ThresholdNotObservedScheduled, UniqueValuesNotObservedScheduled):\r\n - scheduleConfig: Required schedule configuration\r\n - timeZoneId: Valid timezone ID (e.g., \"India Standard Time\")\r\n - evaluationTimeSpan: Time interval for evaluation (required unless autofrequency is true)\r\n - autofrequency: Boolean, auto-calculate evaluation frequency\r\n - monitoringIntervals: Optional day/time filters\r\n - filter_DistinctOccurrence: Required for NotObservedScheduled types\r\n - fieldFilterType: Must be a supported distinct occurrence filter\r\n\r\n- WhiteList:\r\n - linkedDataBlocks: Required, at least one linked data block\r\n - Each linked block must have groupByFields\r\n - All common groupByFields must be included in ruleBlockRelationship.fieldRelationships\r\n\r\n- Statistical:\r\n - scheduleConfig: Required (same as NotObservedScheduled)\r\n - statisticalConfig: Optional filtering criteria\r\n - groupByFields: Recommended for statistical calculations\r\n\r\n- Trend:\r\n - linkedDataBlocks: Required, at least one linked data block\r\n - scheduleConfig: Required (same as NotObservedScheduled)\r\n\r\nData Source Restrictions:\r\n- When dataSourceId = 101 (AdvancedIntelligenceEngineEvents):\r\n - filter_LogSources must be empty or null\r\n - filter_LogSourceLists must be empty or null\r\n\r\nLog Source Filter Rules:\r\n- Cannot use both filter_LogSources and filter_LogSourceLists in the same block\r\n- Choose one: individual log sources OR log source lists, not both\r\n\r\nDay and Time Filters (filter_DayAndTime):\r\n- timeZoneId: Required, must be a valid timezone\r\n- dayTimeStartLocal and dayTimeEndLocal: Both required\r\n - day: Day of week (0=Sunday to 6=Saturday)\r\n - displayTime: 12-hour format with AM/PM (e.g., \"9:00 AM\")\r\n\r\nAIE Summary Fields (aieSummaryFields):\r\n- Optional, but cannot contain duplicates\r\n- Cannot contain fields that are in groupByFields or related to groupByFields\r\n\r\nData Segregation Impact:\r\n- When dataSegregationMode is set to \"logSourceEntity\" (1) or \"logSourceRootEntity\" (2):\r\n - NotObservedScheduled types are not supported\r\n - Cannot explicitly include Entity or RootEntity in groupByFields\r\n - The system automatically adds Entity or RootEntity to grouping logic\r\n\r\nMessage Filter Validation (filter_MsgFilters):\r\n- Each message filter requires:\r\n - fieldFilters array with at least one filter\r\n- Each fieldFilter requires:\r\n - fieldFilterType: The field type being filtered\r\n - filterMode: \"FilterIn\" (0) or \"FilterOut\" (1)\r\n - fieldFilterValues: Array of filter values (required unless filtering null values)\r\n - filterInNullValues and filterOutNullValues: Cannot both be true\r\n- For Application filters: supported fieldFilterTypes are KnownService, DPort, DPortRange, Protocol\r\n- For Host filters: supported fieldFilterTypes are KnownHost, IP, IPRange, SHostName, MAC, NATIP, NATIPRange\r\n\r\nField Filter Sequence:\r\n- The sequence of FieldFilter entries is determined by the order in which they are provided in the request body. To modify the sequence, update the order of the fields in the request body and resubmit the request. The system will apply the sequence accordingly.\r\n\r\nEnum Fields:\r\nThese fields accept either integer values or camelCase string values.\r\n\r\nriskRating / fpp:\r\n- none (0)\r\n- lowLow (1)\r\n- lowMedium (2)\r\n- lowHigh (3)\r\n- mediumLow (4)\r\n- mediumMedium (5)\r\n- mediumHigh (6)\r\n- highLow (7)\r\n- highMedium (8)\r\n- highHigh (9)\r\n \r\nruntimePriority:\r\n- low (0)\r\n- normal (1)\r\n- high (2)\r\n \r\nedf:\r\n- none (0)\r\n- low (1)\r\n- medium (2)\r\n- high (3)\r\n \r\ndataSegregationMode:\r\n- none (0)\r\n- logSourceEntity (1)\r\n- logSourceRootEntity (2)","parameters":[{"name":"ruleId","in":"path","description":"The unique identifier of the AIE rule.","required":true,"schema":{"type":"integer","format":"int32"}}],"requestBody":{"description":"The fields to update.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Partial update payload for an AIE rule.\r\nOnly the fields that are provided will be updated."}},"text/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Partial update payload for an AIE rule.\r\nOnly the fields that are provided will be updated."}},"application/*+json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Partial update payload for an AIE rule.\r\nOnly the fields that are provided will be updated."}}},"required":true},"responses":{"200":{"description":"The rule was updated successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/ApiAieRulePatchRequestApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/ApiAieRulePatchRequestApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/ApiAieRulePatchRequestApiResponse"}}}},"400":{"description":"Invalid request data.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Authentication is required.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"You don't have permission to update the rule.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"404":{"description":"Rule not found.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"An unexpected error occurred.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}},"get":{"tags":["Rules"],"summary":"Gets the details of an AIE rule for the specified rule ID.","description":"This endpoint retrieves the details of an AIE rule for the specified `ruleId`.","parameters":[{"name":"ruleId","in":"path","required":true,"schema":{"type":"integer","format":"int32"}}],"responses":{"200":{"description":"OK","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/ApiAieRulePatchRequestApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/ApiAieRulePatchRequestApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/ApiAieRulePatchRequestApiResponse"}}}},"400":{"description":"Bad Request","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"404":{"description":"Not Found","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal Server Error","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}}},"components":{"schemas":{"AIEDataSegregationEnum":{"enum":["none","logSourceEntity","logSourceRootEntity"],"type":"string"},"AIERuleImportResponse":{"type":"object","properties":{"aieRuleId":{"type":"integer","format":"int32"},"aieRuleName":{"type":"string","nullable":true}},"additionalProperties":false},"AIERuleImportResponseApiResponse":{"type":"object","properties":{"data":{"allOf":[{"$ref":"#/components/schemas/AIERuleImportResponse"}],"nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"AIERuleStatus":{"enum":["disabled","enabled","suspended","learning","paused","_Varies"],"type":"string"},"AIERuleSummaryResponse":{"type":"object","properties":{"ruleId":{"type":"integer","format":"int32"},"ruleName":{"type":"string","nullable":true},"ruleStatus":{"enum":["disabled","enabled","suspended","learning","paused","_Varies"],"type":"string","allOf":[{"$ref":"#/components/schemas/AIERuleStatus"}]},"restart":{"enum":["none","pending","needed"],"type":"string","allOf":[{"$ref":"#/components/schemas/RestartStatusEnum"}]},"activationDate":{"type":"string","format":"date-time","nullable":true},"expirationDate":{"type":"string","format":"date-time","nullable":true},"dataSegregationMode":{"enum":["none","logSourceEntity","logSourceRootEntity"],"type":"string","allOf":[{"$ref":"#/components/schemas/AIEDataSegregationEnum"}]},"alarmStatus":{"type":"boolean","nullable":true},"alarmAutoDrilldown":{"type":"boolean","nullable":true},"edf":{"enum":["none","low","medium","high"],"type":"string","allOf":[{"$ref":"#/components/schemas/EnvDepFacEnum"}]},"fpp":{"enum":["none","lowLow","lowMedium","lowHigh","mediumLow","mediumMedium","mediumHigh","highLow","highMedium","highHigh"],"type":"string","allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}]},"suppressFor":{"type":"string","nullable":true},"runtimePriority":{"enum":["low","normal","high"],"type":"string","allOf":[{"$ref":"#/components/schemas/RuntimePriorityEnum"}]},"ruleGroup":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"ruleSetName":{"type":"string","nullable":true},"permissions":{"type":"string","nullable":true},"dateUpdated":{"type":"string","format":"date-time"},"commonEventId":{"type":"integer","format":"int32","nullable":true},"classificationId":{"type":"integer","format":"int32","nullable":true},"ruleSetId":{"type":"integer","format":"int32","nullable":true},"notifications":{"allOf":[{"$ref":"#/components/schemas/RuleNotificationSummary"}],"nullable":true}},"additionalProperties":false},"AIERuleSummaryResponseIReadOnlyListApiResponse":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AIERuleSummaryResponse"},"nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"AIERulesStatusRequest":{"type":"object","properties":{"ruleId":{"type":"integer","format":"int32"},"status":{"allOf":[{"$ref":"#/components/schemas/AIERuleStatus"}],"nullable":true}},"additionalProperties":false},"AccessTypeEnum":{"enum":["systemGlobalAdmin","customGlobalAdmin"],"type":"string"},"AieRule":{"type":"object","properties":{"id":{"type":"integer","format":"int32"},"requestedStatus":{"enum":["disabled","enabled","suspended","learning","paused","_Varies"],"type":"string","allOf":[{"$ref":"#/components/schemas/AIERuleStatus"}]},"errorMessage":{"type":"string","nullable":true}},"additionalProperties":false},"ApiAIEArg":{"type":"object","properties":{"index":{"type":"integer","format":"int32"}},"additionalProperties":false},"ApiAIEOperationExpression":{"type":"object","properties":{"expressionType":{"type":"integer","format":"int32"},"args":{"type":"array","items":{"$ref":"#/components/schemas/ApiAIEArg"},"nullable":true}},"additionalProperties":false},"ApiAIEResultExpression":{"type":"object","properties":{"expressionType":{"type":"integer","format":"int32"},"expressionText":{"type":"string","nullable":true},"aieOperationExpressions":{"type":"array","items":{"$ref":"#/components/schemas/ApiAIEOperationExpression"},"nullable":true}},"additionalProperties":false},"ApiAieRulePatchRequest":{"type":"object","properties":{"ruleBlocks":{"type":"array","items":{"oneOf":[{"$ref":"#/components/schemas/ApiLogObservedRuleBlock"},{"$ref":"#/components/schemas/ApiLogNotObservedCompoundRuleBlock"},{"$ref":"#/components/schemas/ApiLogNotObservedScheduledRuleBlock"},{"$ref":"#/components/schemas/ApiUniqueValuesObservedRuleBlock"},{"$ref":"#/components/schemas/ApiUniqueValuesNotObservedCompoundRuleBlock"},{"$ref":"#/components/schemas/ApiUniqueValuesNotObservedScheduledRuleBlock"},{"$ref":"#/components/schemas/ApiThresholdObservedRuleBlock"},{"$ref":"#/components/schemas/ApiThresholdNotObservedCompoundRuleBlock"},{"$ref":"#/components/schemas/ApiThresholdNotObservedScheduledRuleBlock"},{"$ref":"#/components/schemas/ApiWhiteOrBlacklistRuleBlock"}]},"nullable":true},"syncWithRuleName":{"type":"boolean","description":"If true, synchronize the Alarm Rule name with the AIE Rule name.","nullable":true},"alarmOnEventOccurrence":{"type":"boolean","description":"True / false indicating alarm status.","nullable":true},"alarmAutoDrillDown":{"type":"boolean","description":"Enable / disable alarm auto drilldown for this rule.","nullable":true},"riskRating":{"allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}],"description":"Default risk rating associated with the rule (Common Event).","nullable":true},"decimalPlaces":{"type":"integer","description":"Number of decimal places.","format":"int32","nullable":true},"expirationDate":{"type":"string","description":"Rule expiration date. Set to null to remove expiration.","format":"date-time","nullable":true},"runtimePriority":{"allOf":[{"$ref":"#/components/schemas/RuntimePriorityEnum"}],"description":"Runtime priority of the rule (low, normal, high).","nullable":true},"edf":{"allOf":[{"$ref":"#/components/schemas/EnvDepFacEnum"}],"description":"EDF (none, low, medium, high).","nullable":true},"fpp":{"allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}],"description":"False positive probability (none, lowLow, lowMedium, highHigh etc).","nullable":true},"dataSegregationMode":{"allOf":[{"$ref":"#/components/schemas/AIEDataSegregationEnum"}],"description":"Data segregation mode (none, entity, rootEntity).","nullable":true},"enableEventForwarding":{"type":"boolean","description":"Enable / disable forwarding AIE events.","nullable":true},"ruleSetId":{"type":"integer","description":"Identifier of the AIE Rule Set this rule belongs to.","format":"int32","nullable":true},"commonEvent":{"allOf":[{"$ref":"#/components/schemas/PatchCommonEventModel"}],"description":"Common Event configuration associated to this AIE rule.","nullable":true},"classification":{"allOf":[{"$ref":"#/components/schemas/PatchClassificationModel"}],"description":"Classification information for the rule (MsgClass / classification).","nullable":true},"eventSuppression":{"allOf":[{"$ref":"#/components/schemas/ApiEventSuppressionPatch"}],"nullable":true},"notify":{"allOf":[{"$ref":"#/components/schemas/PatchNotifyModel"}],"description":"Notification targets (persons, groups, host roles).","nullable":true},"information":{"allOf":[{"$ref":"#/components/schemas/PatchInformationModel"}],"description":"Alarm information and group metadata.","nullable":true}},"additionalProperties":false,"description":"Partial update payload for an AIE rule.\r\nOnly the fields that are provided will be updated."},"ApiAieRulePatchRequestApiResponse":{"type":"object","properties":{"data":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Partial update payload for an AIE rule.\r\nOnly the fields that are provided will be updated.","nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"ApiBlockRelationship":{"type":"object","properties":{"durationSeconds":{"type":"integer","format":"int32"},"durationOffsetSeconds":{"type":"integer","format":"int32"},"ruleBlockA_GUID":{"type":"string","format":"uuid"},"ruleBlockB_GUID":{"type":"string","format":"uuid"},"linkCriteria":{"allOf":[{"$ref":"#/components/schemas/ApiAIEResultExpression"}],"nullable":true},"fieldRelationships":{"type":"array","items":{"$ref":"#/components/schemas/ApiFieldRelationship"},"nullable":true},"joinType":{"enum":["inner","leftOuter","rightOuter","outer"],"type":"string","allOf":[{"$ref":"#/components/schemas/JoinTypeEnum"}]}},"additionalProperties":false},"ApiDataSource":{"required":["dataSourceId"],"type":"object","properties":{"dataSourceId":{"allOf":[{"$ref":"#/components/schemas/DataSourceEnum"}]},"dataSourceSummary":{"type":"string","nullable":true}},"additionalProperties":false},"ApiDayTime":{"type":"object","properties":{"day":{"enum":["sunday","monday","tuesday","wednesday","thursday","friday","saturday"],"type":"string","allOf":[{"$ref":"#/components/schemas/DayOfWeek"}]},"displayTime":{"type":"string","nullable":true}},"additionalProperties":false},"ApiDayTimeFilter":{"type":"object","properties":{"dayTimeStartLocal":{"allOf":[{"$ref":"#/components/schemas/ApiDayTime"}],"nullable":true},"dayTimeEndLocal":{"allOf":[{"$ref":"#/components/schemas/ApiDayTime"}],"nullable":true},"timeZoneId":{"type":"string","nullable":true}},"additionalProperties":false},"ApiEventSuppressionPatch":{"type":"object","properties":{"enableSuppression":{"type":"boolean","nullable":true},"suppressionMultiple":{"type":"integer","format":"int32","nullable":true}},"additionalProperties":false},"ApiField":{"type":"object","properties":{"field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]},"fieldDisplayName":{"type":"string","nullable":true}},"additionalProperties":false},"ApiFieldFilter":{"required":["fieldFilterType","filterInNullValues","filterMode","filterOutNullValues"],"type":"object","properties":{"filterOutNullValues":{"type":"boolean"},"filterInNullValues":{"type":"boolean"},"fieldFilterType":{"enum":["mediatorMsgID","marcMsgID","direction","priority","normalMsgDateRange","normalMsgDateTimeOfDay","entity","msgSource","msgSourceHost","msgSourceType","msgClass","commonEvent","mpeRule","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","ipRange","sipRange","dipRange","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","message","alertStatus","vendorMsgID","group","domain","session","process","url","user","address","port","sPortRange","dPortRange","portRange","sNetwork","dNetwork","network","idmGroupForLogin","idmGroupForAccount","idmGroupForUser","idmGroupToLogin_OBS","idmGroupToAccount_OBS","idmGroupToUser_OBS","bytesIn","bytesOut","itemsIn","itemsOut","duration","quantity","amount","rate","size","fkValue_SNameID","fkValue_DNameID","fkValue_LoginID","fkValue_AccountID","fkValue_SenderID","fkValue_RecipientID","fkValue_ObjectID","fkValue_VendorMsgIdentifierID","fkValue_GroupID","fkValue_DomainID","fkValue_ProcessID","fkValue_URLID","fkValue_User","fkValue_Address","fkValue_HostName","fkValue_IDMGroupToLoginID","fkValue_IDMGroupToAccountID","fkValue_IDMGroupToUser","sLocation","dLocation","location","sLocationToKey","dLocationToKey","locationToKey","sEntity","dEntity","sZone","dZone","bytesInOut","itemsInOut","application","host","sHost","dHost","sEntityOrDEntity","sZoneOrDZone","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","fkValue_SMAC","fkValue_DMAC","fkValue_SInterface","fkValue_DInterface","fkValue_Severity","fkValue_Version","fkValue_Command","fkValue_ObjectName","snatipRange","dnatipRange","natip","natipRange","snatPortRange","dnatPortRange","natPort","natPortRange","mac","interface","fkValue_MAC","fkValue_Interface","rootEntity","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","fkValue_Action","fkValue_CVE","fkValue_ObjectType","fkValue_ParentProcessName","fkValue_ParentProcessPath","fkValue_Policy","fkValue_ResponseCode","fkValue_Result","fkValue_SerialNumber","fkValue_SessionType","fkValue_Status","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","filterGroup","polyListItem"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldFilterTypeEnum"}]},"fieldFilterValues":{"type":"array","items":{"$ref":"#/components/schemas/ApiFieldFilterValue"},"nullable":true},"fieldOperatorEnum":{"enum":["none","and","or","andPrevious","orPrevious","primary_MsgSources"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldOperatorEnum"}]},"displayValue":{"type":"string","nullable":true},"filterMode":{"enum":["filterIn","filterOut"],"type":"string","allOf":[{"$ref":"#/components/schemas/FilterModeEnum"}]}},"additionalProperties":false},"ApiFieldFilterValue":{"required":["fieldFilterType","fieldFilterValueType","value"],"type":"object","properties":{"displayValue":{"type":"string","nullable":true},"value":{},"fieldFilterValueType":{"allOf":[{"$ref":"#/components/schemas/FieldFilterValueTypeEnum"}]},"fieldFilterType":{"enum":["mediatorMsgID","marcMsgID","direction","priority","normalMsgDateRange","normalMsgDateTimeOfDay","entity","msgSource","msgSourceHost","msgSourceType","msgClass","commonEvent","mpeRule","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","ipRange","sipRange","dipRange","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","message","alertStatus","vendorMsgID","group","domain","session","process","url","user","address","port","sPortRange","dPortRange","portRange","sNetwork","dNetwork","network","idmGroupForLogin","idmGroupForAccount","idmGroupForUser","idmGroupToLogin_OBS","idmGroupToAccount_OBS","idmGroupToUser_OBS","bytesIn","bytesOut","itemsIn","itemsOut","duration","quantity","amount","rate","size","fkValue_SNameID","fkValue_DNameID","fkValue_LoginID","fkValue_AccountID","fkValue_SenderID","fkValue_RecipientID","fkValue_ObjectID","fkValue_VendorMsgIdentifierID","fkValue_GroupID","fkValue_DomainID","fkValue_ProcessID","fkValue_URLID","fkValue_User","fkValue_Address","fkValue_HostName","fkValue_IDMGroupToLoginID","fkValue_IDMGroupToAccountID","fkValue_IDMGroupToUser","sLocation","dLocation","location","sLocationToKey","dLocationToKey","locationToKey","sEntity","dEntity","sZone","dZone","bytesInOut","itemsInOut","application","host","sHost","dHost","sEntityOrDEntity","sZoneOrDZone","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","fkValue_SMAC","fkValue_DMAC","fkValue_SInterface","fkValue_DInterface","fkValue_Severity","fkValue_Version","fkValue_Command","fkValue_ObjectName","snatipRange","dnatipRange","natip","natipRange","snatPortRange","dnatPortRange","natPort","natPortRange","mac","interface","fkValue_MAC","fkValue_Interface","rootEntity","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","fkValue_Action","fkValue_CVE","fkValue_ObjectType","fkValue_ParentProcessName","fkValue_ParentProcessPath","fkValue_Policy","fkValue_ResponseCode","fkValue_Result","fkValue_SerialNumber","fkValue_SessionType","fkValue_Status","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","filterGroup","polyListItem"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldFilterTypeEnum"}]}},"additionalProperties":false},"ApiFieldRelationship":{"type":"object","properties":{"ruleBlockA_Field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]},"ruleBlockB_Field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]}},"additionalProperties":false},"ApiHarmonyLinkedDataBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true}},"additionalProperties":false},"ApiHarmonyRuleBlockBase":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true}},"additionalProperties":false},"ApiLogNotObservedCompoundRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true}},"additionalProperties":false},"ApiLogNotObservedScheduledRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"distinctOccurrences":{"allOf":[{"$ref":"#/components/schemas/ApiFieldFilter"}],"nullable":true},"schedule":{"allOf":[{"$ref":"#/components/schemas/ApiRuleBlockSchedule"}],"nullable":true}},"additionalProperties":false},"ApiLogObservedRuleBlock":{"type":"object","allOf":[{"$ref":"#/components/schemas/ApiHarmonyRuleBlockBase"}],"additionalProperties":false},"ApiLogSource":{"type":"object","properties":{"logSourceId":{"type":"integer","format":"int32"},"logSourceName":{"type":"string","nullable":true},"entity":{"type":"string","nullable":true},"host":{"type":"string","nullable":true},"logSourceType":{"type":"string","nullable":true}},"additionalProperties":false},"ApiLogSourceList":{"type":"object","properties":{"logSourceListId":{"type":"integer","format":"int32"},"logSourceListName":{"type":"string","nullable":true}},"additionalProperties":false},"ApiMonitoringInterval":{"type":"object","properties":{"dayTimeStartLocal":{"allOf":[{"$ref":"#/components/schemas/ApiDayTime"}],"nullable":true},"dayTimeEndLocal":{"allOf":[{"$ref":"#/components/schemas/ApiDayTime"}],"nullable":true},"guid":{"type":"string","format":"uuid"}},"additionalProperties":false},"ApiMsgFilter":{"required":["isSavedFilter"],"type":"object","properties":{"msgFilterType":{"enum":["flatLegacy","grouped"],"type":"string","allOf":[{"$ref":"#/components/schemas/MsgFilterTypeEnum"}]},"isSavedFilter":{"type":"boolean"},"fieldFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiFieldFilter"},"nullable":true}},"additionalProperties":false},"ApiRuleBlockSchedule":{"type":"object","properties":{"autofrequency":{"type":"boolean"},"timeZoneId":{"type":"string","nullable":true},"evaluationTimeSpan":{"type":"string","format":"date-span"},"useDayLightSavingTime":{"type":"boolean"},"monitoringIntervals":{"type":"array","items":{"$ref":"#/components/schemas/ApiMonitoringInterval"},"nullable":true}},"additionalProperties":false},"ApiThresholdField":{"type":"object","properties":{"field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]},"thresholdCount":{"type":"number","format":"double"}},"additionalProperties":false},"ApiThresholdNotObservedCompoundRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"thresholdFields":{"type":"array","items":{"$ref":"#/components/schemas/ApiThresholdField"},"nullable":true},"thresholdsBooleanOperator":{"allOf":[{"$ref":"#/components/schemas/ThresholdBooleanOperatorEnum"}],"nullable":true}},"additionalProperties":false},"ApiThresholdNotObservedScheduledRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"thresholdFields":{"type":"array","items":{"$ref":"#/components/schemas/ApiThresholdField"},"nullable":true},"thresholdsBooleanOperator":{"allOf":[{"$ref":"#/components/schemas/ThresholdBooleanOperatorEnum"}],"nullable":true},"schedule":{"allOf":[{"$ref":"#/components/schemas/ApiRuleBlockSchedule"}],"nullable":true},"distinctOccurrences":{"allOf":[{"$ref":"#/components/schemas/ApiFieldFilter"}],"nullable":true}},"additionalProperties":false},"ApiThresholdObservedRuleBlock":{"type":"object","allOf":[{"$ref":"#/components/schemas/ApiHarmonyRuleBlockBase"}],"properties":{"thresholdFields":{"type":"array","items":{"$ref":"#/components/schemas/ApiThresholdField"},"nullable":true},"thresholdsBooleanOperator":{"allOf":[{"$ref":"#/components/schemas/ThresholdBooleanOperatorEnum"}],"nullable":true}},"additionalProperties":false},"ApiUniqueValuesNotObservedCompoundRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"uniqueValues":{"type":"array","items":{"$ref":"#/components/schemas/UniqueValuesField"},"nullable":true},"uniqueValuesReoccurranceCount":{"type":"integer","format":"int32"},"queryDurationSeconds":{"type":"integer","format":"int32"}},"additionalProperties":false},"ApiUniqueValuesNotObservedScheduledRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"uniqueValues":{"type":"array","items":{"$ref":"#/components/schemas/UniqueValuesField"},"nullable":true},"uniqueValuesReoccurranceCount":{"type":"integer","format":"int32"},"queryDurationSeconds":{"type":"integer","format":"int32"},"schedule":{"allOf":[{"$ref":"#/components/schemas/ApiRuleBlockSchedule"}],"nullable":true},"distinctOccurrences":{"allOf":[{"$ref":"#/components/schemas/ApiFieldFilter"}],"nullable":true}},"additionalProperties":false},"ApiUniqueValuesObservedRuleBlock":{"type":"object","allOf":[{"$ref":"#/components/schemas/ApiHarmonyRuleBlockBase"}],"properties":{"uniqueValues":{"type":"array","items":{"$ref":"#/components/schemas/UniqueValuesField"},"nullable":true},"uniqueValuesReoccurranceCount":{"type":"integer","format":"int32"},"queryDurationSeconds":{"type":"integer","format":"int32"}},"additionalProperties":false},"ApiWhiteOrBlacklistRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"linkedDataBlocks":{"type":"array","items":{"$ref":"#/components/schemas/ApiHarmonyLinkedDataBlock"},"nullable":true}},"additionalProperties":false},"DataSourceEnum":{"enum":["dataProcessorLogs","advancedIntelligenceEngineEvents"],"type":"string"},"DayOfWeek":{"enum":["sunday","monday","tuesday","wednesday","thursday","friday","saturday"],"type":"string"},"EnvDepFacEnum":{"enum":["none","low","medium","high"],"type":"string"},"FalsePositiveProbEnum":{"enum":["none","lowLow","lowMedium","lowHigh","mediumLow","mediumMedium","mediumHigh","highLow","highMedium","highHigh"],"type":"string"},"FieldEnum":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string"},"FieldFilterTypeEnum":{"enum":["mediatorMsgID","marcMsgID","direction","priority","normalMsgDateRange","normalMsgDateTimeOfDay","entity","msgSource","msgSourceHost","msgSourceType","msgClass","commonEvent","mpeRule","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","ipRange","sipRange","dipRange","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","message","alertStatus","vendorMsgID","group","domain","session","process","url","user","address","port","sPortRange","dPortRange","portRange","sNetwork","dNetwork","network","idmGroupForLogin","idmGroupForAccount","idmGroupForUser","idmGroupToLogin_OBS","idmGroupToAccount_OBS","idmGroupToUser_OBS","bytesIn","bytesOut","itemsIn","itemsOut","duration","quantity","amount","rate","size","fkValue_SNameID","fkValue_DNameID","fkValue_LoginID","fkValue_AccountID","fkValue_SenderID","fkValue_RecipientID","fkValue_ObjectID","fkValue_VendorMsgIdentifierID","fkValue_GroupID","fkValue_DomainID","fkValue_ProcessID","fkValue_URLID","fkValue_User","fkValue_Address","fkValue_HostName","fkValue_IDMGroupToLoginID","fkValue_IDMGroupToAccountID","fkValue_IDMGroupToUser","sLocation","dLocation","location","sLocationToKey","dLocationToKey","locationToKey","sEntity","dEntity","sZone","dZone","bytesInOut","itemsInOut","application","host","sHost","dHost","sEntityOrDEntity","sZoneOrDZone","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","fkValue_SMAC","fkValue_DMAC","fkValue_SInterface","fkValue_DInterface","fkValue_Severity","fkValue_Version","fkValue_Command","fkValue_ObjectName","snatipRange","dnatipRange","natip","natipRange","snatPortRange","dnatPortRange","natPort","natPortRange","mac","interface","fkValue_MAC","fkValue_Interface","rootEntity","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","fkValue_Action","fkValue_CVE","fkValue_ObjectType","fkValue_ParentProcessName","fkValue_ParentProcessPath","fkValue_Policy","fkValue_ResponseCode","fkValue_Result","fkValue_SerialNumber","fkValue_SessionType","fkValue_Status","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","filterGroup","polyListItem"],"type":"string"},"FieldFilterValueTypeEnum":{"enum":["byte","int16","int32","int64","string","ipAddress","ipAddressRange","timeOfDay","dateRange","portRange","quantity","listReference","listSet","null","invalid"],"type":"string"},"FieldOperatorEnum":{"enum":["none","and","or","andPrevious","orPrevious","primary_MsgSources"],"type":"string"},"FilterModeEnum":{"enum":["filterIn","filterOut"],"type":"string"},"GroupNotification":{"type":"object","properties":{"alarmNfnGroupId":{"type":"integer","format":"int32"},"notificationGroup":{"type":"string","nullable":true},"isNfnSilent":{"type":"boolean"},"canBatchNfy":{"type":"boolean"}},"additionalProperties":false},"HostRoleEnum":{"enum":["businessOwner","operationsOwner","primaryAdministrator","secondaryAdministrator","securityAdministrator","auditor"],"type":"string"},"HostRoleNotification":{"type":"object","properties":{"hostRoleId":{"type":"integer","format":"int32"},"hostRole":{"enum":["businessOwner","operationsOwner","primaryAdministrator","secondaryAdministrator","securityAdministrator","auditor"],"type":"string","allOf":[{"$ref":"#/components/schemas/HostRoleEnum"}]},"isNfnSilent":{"type":"boolean"},"canBatchNfy":{"type":"boolean"}},"additionalProperties":false},"ImportRuleRequest":{"type":"object","properties":{"file":{"type":"string","nullable":true},"listSyncSetting":{"allOf":[{"$ref":"#/components/schemas/ListSyncSetting"}],"nullable":true}},"additionalProperties":false},"JoinTypeEnum":{"enum":["inner","leftOuter","rightOuter","outer"],"type":"string"},"ListSyncSetting":{"enum":["doNotImportListContents","importListContents","mergeListContents"],"type":"string"},"MsgFilterTypeEnum":{"enum":["flatLegacy","grouped"],"type":"string"},"PatchClassificationModel":{"type":"object","properties":{"classificationId":{"type":"integer","description":"Classification identifier (MsgClass / classification ID).","format":"int32","nullable":true},"classificationName":{"type":"string","description":"Classification name displayed in UI.","nullable":true}},"additionalProperties":false},"PatchCommonEventModel":{"type":"object","properties":{"commonEventId":{"type":"integer","description":"ID of the Common Event to associate with this rule.","format":"int32","nullable":true},"commonEventName":{"type":"string","description":"Name of the Common Event.","nullable":true}},"additionalProperties":false},"PatchInformationModel":{"type":"object","properties":{"ruleName":{"type":"string","description":"Display name of the alarm/rule in the console.","nullable":true},"briefDesc":{"type":"string","description":"Brief description shown in the console.","nullable":true},"additionalDetails":{"type":"string","description":"Full description / additional details.","nullable":true},"ruleGroup":{"type":"string","description":"Alarm rule group.","nullable":true}},"additionalProperties":false},"PatchNotifyGroup":{"type":"object","properties":{"include":{"type":"boolean","nullable":true},"alarmNfnGroupId":{"type":"integer","description":"AlarmNfnGroupID to notify.","format":"int32","nullable":true},"canBatchNotify":{"type":"boolean","nullable":true},"isSilent":{"type":"boolean","nullable":true}},"additionalProperties":{}},"PatchNotifyHostRole":{"type":"object","properties":{"include":{"type":"boolean","nullable":true},"hostRoleId":{"type":"integer","description":"Host role identifier to notify.","format":"int32","nullable":true},"canBatchNotify":{"type":"boolean","nullable":true},"isSilent":{"type":"boolean","nullable":true}},"additionalProperties":{}},"PatchNotifyModel":{"type":"object","properties":{"persons":{"type":"array","items":{"$ref":"#/components/schemas/PatchNotifyPerson"},"description":"Person-based notification targets.","nullable":true},"groups":{"type":"array","items":{"$ref":"#/components/schemas/PatchNotifyGroup"},"description":"Group-based notification targets.","nullable":true},"hostRoles":{"type":"array","items":{"$ref":"#/components/schemas/PatchNotifyHostRole"},"description":"Host-role-based notification targets.","nullable":true}},"additionalProperties":false},"PatchNotifyPerson":{"type":"object","properties":{"include":{"type":"boolean","description":"Whether this entry is selected in UI / should be applied.","nullable":true},"personId":{"type":"integer","description":"PersonID to notify.","format":"int32","nullable":true},"canBatchNotify":{"type":"boolean","description":"Whether notifications to this person can be batched.","nullable":true},"isSilent":{"type":"boolean","description":"Whether this is a silent notification.","nullable":true}},"additionalProperties":{}},"PersonNotification":{"type":"object","properties":{"personId":{"type":"integer","format":"int32"},"fullName":{"type":"string","nullable":true},"isNfnSilent":{"type":"boolean"},"canBatchNfy":{"type":"boolean"}},"additionalProperties":false},"RestartStatusEnum":{"enum":["none","pending","needed"],"type":"string"},"RuleEnableDisableResponse":{"type":"object","properties":{"notProcessedAIERules":{"type":"array","items":{"$ref":"#/components/schemas/AieRule"},"nullable":true}},"additionalProperties":false},"RuleEnableDisableResponseApiResponse":{"type":"object","properties":{"data":{"allOf":[{"$ref":"#/components/schemas/RuleEnableDisableResponse"}],"nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"RuleNotificationSummary":{"type":"object","properties":{"persons":{"type":"array","items":{"$ref":"#/components/schemas/PersonNotification"},"nullable":true},"groups":{"type":"array","items":{"$ref":"#/components/schemas/GroupNotification"},"nullable":true},"hostRoles":{"type":"array","items":{"$ref":"#/components/schemas/HostRoleNotification"},"nullable":true}},"additionalProperties":false},"RulesSummarySortField":{"enum":["ruleId","ruleName","ruleStatus","restart","activationDate","expirationDate","dataSegregationMode","alarmStatus","alarmAutoDrilldown","edf","fpp","runtimePriority","ruleGroup","description","ruleSetName","permissions","dateUpdated"],"type":"string"},"RuntimePriorityEnum":{"enum":["low","normal","high"],"type":"string"},"SortDirectionEnum":{"enum":["ascending","descending"],"type":"string"},"StringApiResponse":{"type":"object","properties":{"data":{"type":"string","nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"ThresholdBooleanOperatorEnum":{"enum":["and","or"],"type":"string"},"UniqueValuesField":{"type":"object","properties":{"field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]},"count":{"type":"integer","format":"int32"}},"additionalProperties":false}},"securitySchemes":{"Bearer":{"type":"http","description":"Enter your JWT token.\n\nExample: `eyJhbGciOi...`","scheme":"bearer","bearerFormat":"JWT"}}},"security":[{"Bearer":[]}]}