{"openapi":"3.0.1","info":{"title":"AIE API","description":"Auto-generated Swagger documentation","version":"v1"},"paths":{"/lr-aie-api/aie/rules/import":{"post":{"tags":["Rules"],"summary":"Imports an AIE rule from the specified .airx file.","description":"1. This endpoint allows you to import an AIE rule from a specified .airx file path. You can control the import behavior using the listSyncSetting parameter.\r\n\r\n2. Only files with the .airx extension are permitted for import.\r\n\r\n3. Available values for listSyncSetting include: \r\n\r\n   - DoNotImportListContents \r\n   - ImportListContents \r\n   - MergeListContents","requestBody":{"description":"The import request containing the file path and list sync settings.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ImportRuleRequest"}]}},"text/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ImportRuleRequest"}]}},"application/*+json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ImportRuleRequest"}]}}}},"responses":{"200":{"description":"Success. If the AIE rule is imported successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/AIERuleImportResponseApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/AIERuleImportResponseApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/AIERuleImportResponseApiResponse"}}}},"400":{"description":"Bad Request: If the request is invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized: If the user is not authorized.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden: If the user does not have permission.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal server error. If an exception occurs.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules/status":{"patch":{"tags":["Rules"],"summary":"Updates the statuses of AIE rules in batch.","description":"1. This endpoint batch-updates the status of AIE rules.\r\n\r\n2. If all rules are updated successfully, no ruleIds are returned in the response.\r\n\r\n3. Any rules that fail to update appear in the notProcessedAIERules section, along with an associated error message.\r\n\r\n4. Available status values: Disabled, Enabled, Suspended, Learning, Paused, _Varies.","requestBody":{"description":"A list of rule status requests specifying rule IDs and desired statuses.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AIERulesStatusRequest"}}},"text/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AIERulesStatusRequest"}}},"application/*+json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AIERulesStatusRequest"}}}}},"responses":{"200":{"description":"Success. If all the rules are processed successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/RuleEnableDisableResponseApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/RuleEnableDisableResponseApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/RuleEnableDisableResponseApiResponse"}}}},"400":{"description":"Bad Request: If the request is invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized: If the user is not authorized.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden: If the user does not have permission.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal server error. If an exception occurs.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules/restartService":{"post":{"tags":["Rules"],"summary":"Initiates restart request of the AIE service for the specified engine.","description":"This endpoint initiates the restart process for the AIE Engine service.","parameters":[{"name":"engineId","in":"query","description":"The ID of the engine to restart.","required":true,"schema":{"type":"integer","format":"int32"}}],"responses":{"200":{"description":"Success. If the service restart request initiated successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"400":{"description":"Bad Request: If the engineId is invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized: If the user is not authorized.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden: If the user does not have permission.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal server error. If an exception occurs.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules/summary/{engineId}":{"get":{"tags":["Rules"],"summary":"Returns a collection of AIE rule summary objects associated with a specific engine.","description":"This endpoint retrieves AIE rules for the specified `engineId`.\r\n            \r\nRules can be filtered using supported query parameters.\r\nAll query parameter names use <b>camelCase</b>.\r\n            \r\nResults are returned in paged chunks using `offset` and `count`\r\nbased pagination.","parameters":[{"name":"engineId","in":"path","description":"engineId used to fetch associated AIE rules.","required":true,"schema":{"type":"integer","format":"int32"}},{"name":"offset","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"count","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"orderBy","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/RulesSummarySortField"}]}},{"name":"dir","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/SortDirectionEnum"}]}},{"name":"ruleId","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"ruleName","in":"query","schema":{"type":"string"}},{"name":"ruleGroup","in":"query","schema":{"type":"string"}},{"name":"description","in":"query","schema":{"type":"string"}},{"name":"ruleSetName","in":"query","schema":{"type":"string"}},{"name":"alarmStatus","in":"query","schema":{"type":"boolean"}},{"name":"alarmAutoDrilldown","in":"query","schema":{"type":"boolean"}},{"name":"ruleStatus","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/AIERuleStatus"}]}},{"name":"runtimePriority","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/RuntimePriorityEnum"}]}},{"name":"edf","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/EnvDepFacEnum"}]}},{"name":"fpp","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}]}},{"name":"permissions","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/AccessTypeEnum"}]}},{"name":"dataSegregationMode","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/AIEDataSegregationEnum"}]}},{"name":"dateUpdated","in":"query","schema":{"type":"string","format":"date-time"}},{"name":"activationDate","in":"query","schema":{"type":"string","format":"date-time"}},{"name":"expirationDate","in":"query","schema":{"type":"string","format":"date-time"}},{"name":"restart","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/RestartStatusEnum"}]}}],"responses":{"200":{"description":"Success. AIE rule summaries retrieved successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/AIERuleSummaryResponseIReadOnlyListApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/AIERuleSummaryResponseIReadOnlyListApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/AIERuleSummaryResponseIReadOnlyListApiResponse"}}}},"400":{"description":"Bad Request. The engineId or query parameters are invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized. The user is not authenticated.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden. The user does not have permission to access this resource.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"404":{"description":"NotFound. The particular resource not found.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal Server Error. An unexpected error occurred.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules/{ruleId}":{"patch":{"tags":["Rules"],"summary":"Partially updates an existing AIE rule.","description":"This endpoint allows partial updates to an existing AIE rule. Only the fields included in the request payload will be updated. All other fields will remain unchanged.\r\nAll requests are validated before updates are applied. If validation fails, the update request will be rejected.\r\n\r\nGeneral Behavior:\r\n- All requests are validated before updates are applied.\r\n- Fields not included in the request remain unchanged.\r\n\r\nUser Profile and Privileges:\r\n- Users must have AIE Rule Update/Edit privilege to modify a rule.\r\n- Requests from users without the required privilege will return an authorization error.\r\n- Rule updates may be restricted based on the user's profile permissions.\r\n\r\nRule Name Synchronization:\r\n- If syncWithRuleName = true:\r\n    - information.ruleName is required.\r\n    - The system automatically prefixes the rule name with \"AIE:\".\r\n\r\n- If syncWithRuleName = false:\r\n    - commonEvent.commonEventId must be provided.\r\n    - The rule links to the specified Common Event.\r\n\r\nAlarm Configuration:\r\n- If only alarmOnEventOccurrence is provided:\r\n    - alarmAutoDrillDown is automatically set to the same value.\r\n\r\n- If both values are provided:\r\n    - alarmAutoDrillDown can be true or false only when alarmOnEventOccurrence = true.\r\n\r\nEvent Forwarding:\r\n- If enableEventForwarding = false, the following fields will be ignored:\r\n    - notify\r\n    - decimalPlaces\r\n    - alarmOnEventOccurrence\r\n    - alarmAutoDrillDown\r\n\r\nEvent Suppression:\r\n- If enableSuppression = true and suppressionMultiple is not provided:\r\n    - suppressionMultiple will default to 1.\r\n\r\n- Set enableSuppression = false to disable suppression.\r\n\r\nExpiration Date:\r\n- Must be a future date.\r\n- Past dates are not allowed.\r\n- Pass null to remove the expiration date.\r\n- If omitted, the current value remains unchanged.\r\n\r\nNullable Text Fields:\r\n- Fields: briefDesc, additionalDetails, ruleGroup\r\n- Pass null to clear the value.\r\n- If omitted, the current value remains unchanged.\r\n\r\nRuleBlocks Configuration:\r\n\r\nThe ruleBlocks array allows you to define or update the detection logic for the AIE rule. Each rule can have 1 to 3 rule blocks that work together to detect complex patterns.\r\n\r\nGeneral Rules:\r\n- Minimum: 1 rule block is required when ruleBlocks is provided\r\n- Maximum: 3 rule blocks are allowed per rule\r\n- Block Order: Rule blocks are processed in sequence (blockId: 0, 1, 2)\r\n- Block IDs: Must be sequential starting from 0 (e.g., 0, 1, or 0, 1, 2)\r\n\r\nRule Block Types and Restrictions:\r\n\r\nBlock Composition Rules:\r\n\r\n- Single Block Rules (1 block):\r\n    - Can use: LogObserved, LogNotObservedScheduled, ThresholdObserved, ThresholdNotObservedScheduled, UniqueValuesObserved, UniqueValuesNotObservedScheduled, WhiteList, Statistical, Trend\r\n    - Cannot use: LogNotObservedCompound, ThresholdNotObservedCompound, UniqueValuesNotObservedCompound (these require a preceding block)\r\n\r\n- Two Block Rules (2 blocks):\r\n    - First block must be: LogObserved, ThresholdObserved, UniqueValuesObserved, or WhiteList\r\n    - Second block can be: Any *NotObservedCompound type or *Observed type\r\n\r\n- Three Block Rules (3 blocks):\r\n    - First block must be: LogObserved, ThresholdObserved, UniqueValuesObserved, or WhiteList\r\n    - Second block must be: Observed type only (not *NotObserved)\r\n    - Third block can be: Any *NotObservedCompound type or *Observed type\r\n\r\nRequired Properties Per Block:\r\n\r\nCommon Required Properties (All Blocks):\r\n- ruleBlockType: Type discriminator (must match one of the supported types)\r\n- blockId: Sequential ID starting from 0\r\n- dataSource: Data source configuration\r\n    - dataSourceId: Must be 1 (DataProcessorLogs) or 101 (AdvancedIntelligenceEngineEvents)\r\n- filter_MsgFilters: At least one message filter required (cannot be empty)\r\n    - Each filter requires fieldFilters array\r\n    - Each fieldFilter requires fieldFilterValues array (unless filtering null values)\r\n    - sortOrder must be sequential starting from 0\r\n\r\nGroupBy Fields:\r\n- Required for: ThresholdObserved, ThresholdNotObservedCompound, UniqueValuesObserved, UniqueValuesNotObservedCompound, WhiteList \r\n- Cannot be duplicate within the same block\r\n- Cannot use both Entity and RootEntity when dataSegregationMode is enabled\r\n- Cannot use SLocationCountry, SLocationRegion, and SLocation together (choose only one)\r\n\r\nRule Block Relationships (Blocks 1 and 2):\r\n- ruleBlockRelationship is required for blockId 1 and 2\r\n- Properties:\r\n    - ruleBlockA_GUID: GUID of the preceding block\r\n    - ruleBlockB_GUID: GUID of the current block\r\n    - durationOffsetSeconds: Must be 0 for the first relationship\r\n    - durationSeconds: Must be ≥ 60 for subsequent blocks\r\n    - fieldRelationships: Array of field links between blocks\r\n        - ruleBlockA_Field: Must exist in preceding block's groupByFields\r\n        - ruleBlockB_Field: Must exist in current block's groupByFields\r\n    - joinType: Valid values: \"0\" (Inner), \"1\" (LeftOuter), \"2\" (RightOuter), \"3\" (FullOuter)\r\n\r\nType-Specific Properties:\r\n\r\n- ThresholdObserved / ThresholdNotObservedCompound / ThresholdNotObservedScheduled:\r\n    - thresholdFields: Required, at least one threshold definition\r\n        - field: Field to count (must be a supported threshold field)\r\n        - thresholdCount: Count threshold (must be > 0)\r\n\r\n- UniqueValuesObserved / UniqueValuesNotObservedCompound / UniqueValuesNotObservedScheduled:\r\n    - distinctOccurrenceFields: Required, exactly one unique value field\r\n        - field: Field to track unique values (must be supported)\r\n        - count: Occurrence count (must be > 0)\r\n    - Important: The unique value field cannot also be in groupByFields\r\n\r\n- NotObservedScheduled Types (LogNotObservedScheduled, ThresholdNotObservedScheduled, UniqueValuesNotObservedScheduled):\r\n    - scheduleConfig: Required schedule configuration\r\n        - timeZoneId: Valid timezone ID (e.g., \"India Standard Time\")\r\n        - evaluationTimeSpan: Time interval for evaluation (required unless autofrequency is true)\r\n        - autofrequency: Boolean, auto-calculate evaluation frequency\r\n        - monitoringIntervals: Optional day/time filters\r\n    - filter_DistinctOccurrence: Required for NotObservedScheduled types\r\n        - fieldFilterType: Must be a supported distinct occurrence filter\r\n\r\n- WhiteList:\r\n    - linkedDataBlocks: Required, at least one linked data block\r\n        - Each linked block must have groupByFields\r\n        - All common groupByFields must be included in ruleBlockRelationship.fieldRelationships\r\n\r\n- Statistical:\r\n    - scheduleConfig: Required (same as NotObservedScheduled)\r\n    - statisticalConfig: Optional filtering criteria\r\n    - groupByFields: Recommended for statistical calculations\r\n\r\n- Trend:\r\n    - linkedDataBlocks: Required, at least one linked data block\r\n    - scheduleConfig: Required (same as NotObservedScheduled)\r\n\r\nData Source Restrictions:\r\n- When dataSourceId = 101 (AdvancedIntelligenceEngineEvents):\r\n    - filter_LogSources must be empty or null\r\n    - filter_LogSourceLists must be empty or null\r\n\r\nLog Source Filter Rules:\r\n- Cannot use both filter_LogSources and filter_LogSourceLists in the same block\r\n- Choose one: individual log sources OR log source lists, not both\r\n\r\nDay and Time Filters (filter_DayAndTime):\r\n- timeZoneId: Required, must be a valid timezone\r\n- dayTimeStartLocal and dayTimeEndLocal: Both required\r\n    - day: Day of week (0=Sunday to 6=Saturday)\r\n    - displayTime: 12-hour format with AM/PM (e.g., \"9:00 AM\")\r\n\r\nAIE Summary Fields (aieSummaryFields):\r\n- Optional, but cannot contain duplicates\r\n- Cannot contain fields that are in groupByFields or related to groupByFields\r\n\r\nData Segregation Impact:\r\n- When dataSegregationMode is set to \"logSourceEntity\" (1) or \"logSourceRootEntity\" (2):\r\n    - NotObservedScheduled types are not supported\r\n    - Cannot explicitly include Entity or RootEntity in groupByFields\r\n    - The system automatically adds Entity or RootEntity to grouping logic\r\n\r\nMessage Filter Validation (filter_MsgFilters):\r\n- Each message filter requires:\r\n    - fieldFilters array with at least one filter\r\n- Each fieldFilter requires:\r\n    - fieldFilterType: The field type being filtered\r\n    - filterMode: \"FilterIn\" (0) or \"FilterOut\" (1)\r\n    - fieldFilterValues: Array of filter values (required unless filtering null values)\r\n    - filterInNullValues and filterOutNullValues: Cannot both be true\r\n- For Application filters: supported fieldFilterTypes are KnownService, DPort, DPortRange, Protocol\r\n- For Host filters: supported fieldFilterTypes are KnownHost, IP, IPRange, SHostName, MAC, NATIP, NATIPRange\r\n\r\nField Filter Sequence:\r\n- The sequence of FieldFilter entries is determined by the order in which they are provided in the request body. To modify the sequence, update the order of the fields in the request body and resubmit the request. The system will apply the sequence accordingly.\r\n\r\nEnum Fields:\r\nThese fields accept either integer values or camelCase string values.\r\n\r\nriskRating / fpp:\r\n- none (0)\r\n- lowLow (1)\r\n- lowMedium (2)\r\n- lowHigh (3)\r\n- mediumLow (4)\r\n- mediumMedium (5)\r\n- mediumHigh (6)\r\n- highLow (7)\r\n- highMedium (8)\r\n- highHigh (9)\r\n            \r\nruntimePriority:\r\n- low (0)\r\n- normal (1)\r\n- high (2)\r\n            \r\nedf:\r\n- none (0)\r\n- low (1)\r\n- medium (2)\r\n- high (3)\r\n            \r\ndataSegregationMode:\r\n- none (0)\r\n- logSourceEntity (1)\r\n- logSourceRootEntity (2)","parameters":[{"name":"ruleId","in":"path","description":"The unique identifier of the AIE rule.","required":true,"schema":{"type":"integer","format":"int32"}}],"requestBody":{"description":"The fields to update.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Patch/Post payload for an AIE rule.\r\nOnly the fields that are provided will be updated for Patch operations."}},"text/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Patch/Post payload for an AIE rule.\r\nOnly the fields that are provided will be updated for Patch operations."}},"application/*+json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Patch/Post payload for an AIE rule.\r\nOnly the fields that are provided will be updated for Patch operations."}}},"required":true},"responses":{"200":{"description":"The rule was updated successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/ApiAIERuleApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/ApiAIERuleApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/ApiAIERuleApiResponse"}}}},"400":{"description":"Invalid request data.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Authentication is required.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"You don't have permission to update the rule.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"404":{"description":"Rule not found.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"An unexpected error occurred.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}},"get":{"tags":["Rules"],"summary":"Gets the details of an AIE rule for the specified rule ID.","description":"This endpoint retrieves the details of an AIE rule for the specified `ruleId`.","parameters":[{"name":"ruleId","in":"path","required":true,"schema":{"type":"integer","format":"int32"}}],"responses":{"200":{"description":"OK","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/ApiAIERuleApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/ApiAIERuleApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/ApiAIERuleApiResponse"}}}},"400":{"description":"Bad Request","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"404":{"description":"Not Found","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal Server Error","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules":{"post":{"tags":["Rules"],"summary":"Creates a new AIE rule with the provided details.","description":"This endpoint creates a new AIE (Advanced Intelligence Engine) rule. The caller must supply all\r\nrequired fields; unlike the PATCH endpoint, optional fields that are omitted receive system\r\ndefaults rather than inheriting from an existing record.\r\n            \r\nPrerequisites / Authorization:\r\n- The caller must hold the AIERuleMgmt privilege.\r\n- Requests without a valid bearer token are rejected with 401.\r\n- Requests with a valid token but without the required privilege are rejected with 403.\r\n            \r\nMINIMUM REQUIRED FIELDS TO CREATE AN AIE RULE:\r\n\r\nMandatory Top-Level Fields:\r\n- information.ruleName: non-empty; minimum 3 characters, maximum 100 characters.\r\n- classification.classificationId: non-zero integer; must reference an existing classification.\r\n- ruleBlocks: at least one rule block is required (unlike PATCH where ruleBlocks may be omitted).\r\n- commonEvent.commonEventId: required when syncWithRuleName is false. May be omitted when syncWithRuleName is true or not provided.\r\n\r\nMandatory Fields Per Rule Block (RuleBlocks array):\r\n- ruleBlockType: Type discriminator (e.g., \"LogObserved\", \"ThresholdObserved\")\r\n- blockId: Sequential ID starting from 0 (0, 1, 2)\r\n- dataSource.dataSourceId: Must be 1 (DataProcessorLogs) or 101 (AdvancedIntelligenceEngineEvents)\r\n- filter_MsgFilters: At least one message filter required (cannot be empty)\r\n    - Each filter requires fieldFilters array\r\n    - Each fieldFilter requires:\r\n        - fieldFilterType: The field type being filtered\r\n        - filterMode: \"FilterIn\" (0) or \"FilterOut\" (1)\r\n        - fieldFilterValues: Array of filter values (required unless filtering null values)\r\n\r\nAdditional Mandatory Fields by Rule Block Type:\r\n- ThresholdObserved / ThresholdNotObservedCompound / ThresholdNotObservedScheduled:\r\n    - groupByFields: At least one groupBy field required\r\n    - thresholdFields: At least one threshold definition required\r\n        - field: Field to count (must be supported threshold field)\r\n        - thresholdCount: Count threshold (must be > 0)\r\n\r\n- UniqueValuesObserved / UniqueValuesNotObservedCompound / UniqueValuesNotObservedScheduled:\r\n    - groupByFields: At least one groupBy field required\r\n    - uniqueValues: Exactly one unique value field required\r\n        - field: Field to track unique values\r\n        - count: Occurrence count (must be > 0)\r\n\r\n- WhiteList:\r\n    - groupByFields: At least one groupBy field required\r\n    - linkedDataBlocks: At least one linked data block required\r\n        - Each linked block must have groupByFields\r\n\r\n- Statistical:\r\n    - schedule: Required schedule configuration\r\n        - timeZoneId: Valid timezone ID (e.g., \"India Standard Time\")\r\n        - evaluationTimeSpan: Required unless autofrequency = true\r\n    - groupByFields: Recommended for statistical calculations\r\n\r\n- Trend:\r\n    - linkedDataBlocks: At least one linked data block required\r\n    - schedule: Required schedule configuration\r\n        - timeZoneId: Valid timezone ID\r\n        - evaluationTimeSpan: Required unless autofrequency = true\r\n\r\n- NotObservedScheduled Types (LogNotObservedScheduled, ThresholdNotObservedScheduled, UniqueValuesNotObservedScheduled):\r\n    - schedule: Required schedule configuration\r\n        - timeZoneId: Valid timezone ID\r\n        - evaluationTimeSpan: Required unless autofrequency = true\r\n    - filter_DistinctOccurrence: Required\r\n        - fieldFilterType: Must be a supported distinct occurrence filter\r\n\r\nFor Rule Blocks with BlockId > 0 (Blocks 1 and 2):\r\n- ruleBlockRelationship: Required\r\n    - ruleBlockA_GUID: GUID of the preceding block\r\n    - ruleBlockB_GUID: GUID of the current block\r\n    - durationOffsetSeconds: Must be 0 for first relationship\r\n    - durationSeconds: Must be ≥ 60 for subsequent blocks\r\n    - fieldRelationships: Array of field links between blocks\r\n        - ruleBlockA_Field: Must exist in preceding block's groupByFields\r\n        - ruleBlockB_Field: Must exist in current block's groupByFields\r\n    - joinType: Valid values: \"0\" (Inner), \"1\" (LeftOuter), \"2\" (RightOuter), \"3\" (FullOuter)\r\n            \r\nFIELDS WITH DEFAULT VALUES (Optional):\r\n\r\nWhen the following fields are omitted, the system assigns these default values:\r\n\r\n- riskRating: Defaults to \"None\" (0)\r\n- fpp (False Positive Probability): Defaults to \"None\" (0)\r\n- edf (Event Duration Field): Defaults to \"None\" (0)\r\n- runtimePriority: Defaults to \"Normal\" (1)\r\n- dataSegregationMode: Defaults to \"None\" (0)\r\n- enableEventForwarding: Defaults to true\r\n- alarmOnEventOccurrence: Defaults to false\r\n- alarmAutoDrillDown: Defaults to false\r\n- decimalPlaces: Defaults to 2\r\n- enableSuppression: Defaults to false\r\n- suppressionMultiple: Defaults to 1 when enableSuppression = true\r\n- syncWithRuleName: Defaults to true (system creates linked Common Event)\r\n- expirationDate: Defaults to null (no expiration)\r\n- information.briefDesc: Defaults to empty string\r\n- information.additionalDetails: Defaults to empty string\r\n- information.ruleGroup: Defaults to empty string\r\n- notify.persons: Defaults to empty array (no person notifications)\r\n- notify.groups: Defaults to empty array (no group notifications)\r\n- ruleSet: Defaults to null (no rule set assignment)\r\n- schedule.autofrequency: Defaults to false\r\n- schedule.monitoringIntervals: Defaults to null (no day/time restrictions)\r\n- filter_LogSources: Defaults to empty array\r\n- filter_LogSourceLists: Defaults to empty array\r\n- filter_DayAndTime: Defaults to empty array\r\n- filter_MsgFiltersIn: Defaults to empty array\r\n- filter_MsgFiltersOut: Defaults to empty array\r\n- aieSummaryFields: Defaults to empty array\r\n            \r\nDATA SOURCE-SPECIFIC VALIDATIONS:\r\n\r\nWhen dataSourceId = 101 (Advanced Intelligence Engine Events / AIEE):\r\n- filter_LogSources must be empty or null (not applicable for AIEE)\r\n- filter_LogSourceLists must be empty or null (not applicable for AIEE)\r\n- Reason: AIEE analyzes events generated by other AIE rules, not raw log sources\r\n\r\nWhen dataSourceId = 1 (Data Processor Logs):\r\n- filter_LogSources and filter_LogSourceLists are both supported\r\n- Cannot use both simultaneously - choose one: individual log sources OR log source lists\r\n            \r\nIMPORTANT VALIDATION RULES AND DEPENDENCIES:\r\n\r\nGroupBy vs Unique Values Conflict:\r\n- For UniqueValuesObserved blocks: The unique value field CANNOT be the same as any groupBy field\r\n- Example: If groupByFields contains \"UserLogin\", uniqueValues.field cannot be \"UserLogin\"\r\n- Reason: Grouping and counting unique values on the same field creates logical inconsistency\r\n\r\nGroupBy Field Restrictions:\r\n- Cannot include duplicate fields within the same block\r\n- Cannot use both Entity and RootEntity when dataSegregationMode is enabled\r\n- Cannot use SLocationCountry, SLocationRegion, and SLocation together (choose only one)\r\n\r\nData Segregation Impact:\r\n- When dataSegregationMode = \"logSourceEntity\" (1) or \"logSourceRootEntity\" (2):\r\n    - NotObservedScheduled types are NOT supported\r\n    - Cannot explicitly include Entity or RootEntity in groupByFields\r\n    - The system automatically adds Entity or RootEntity to grouping logic\r\n\r\nAIE Summary Fields Restrictions:\r\n- Cannot contain duplicate fields\r\n- Cannot contain fields that are in groupByFields or related to groupByFields\r\n- Example: If groupByFields contains \"UserOrigin\", aieSummaryFields cannot contain \"UserLogin\" (related field)\r\n            \r\nDETAILED FIELD-LEVEL GUIDANCE:\r\n\r\nFor comprehensive field-level documentation including:\r\n- Message Filter Validation rules\r\n- Field Filter Sequence behavior\r\n- Enum field accepted values\r\n- Complete RuleBlock configuration details\r\n- Type-specific properties per rule block type\r\n- Log Source filter rules\r\n- Day and Time filter format requirements\r\n\r\nPlease refer to the PATCH /aie/rules/{ruleId} endpoint documentation, which provides\r\ndetailed guidance applicable to both POST and PATCH operations. The primary difference\r\nis that PATCH allows partial updates with field inheritance, while POST requires\r\ncomplete specification of mandatory fields with system defaults for optional fields.\r\n            \r\nKey sections in PATCH documentation relevant to POST:\r\n- RuleBlocks Configuration (detailed type-specific requirements)\r\n- Message Filter Validation (filter_MsgFilters structure)\r\n- Field Filter Sequence (ordering behavior)\r\n- Enum Fields (accepted values for riskRating, fpp, edf, runtimePriority, dataSegregationMode)\r\n- Day and Time Filters (format requirements)\r\n- Log Source Filter Rules (mutual exclusivity)\r\n            \r\n\r\nRule Name Synchronization (syncWithRuleName):\r\n- When syncWithRuleName = true: the system automatically prefixes the rule name with \"AIE: \" (5 characters) when creating the linked Alarm Rule. The effective stored name must therefore not exceed 95 characters (100 − 5 prefix characters). The same prefix budget applies to briefDesc (≤ 250 characters effective) and additionalDetails (≤ 1995 characters effective).\r\n- When syncWithRuleName = false: commonEvent.commonEventId must be supplied so the rule can be linked to an existing Common Event.\r\n            \r\nAlarm Configuration:\r\n- alarmAutoDrillDown may only be true when alarmOnEventOccurrence is also true. Setting alarmAutoDrillDown = true while alarmOnEventOccurrence = false is rejected with 400.\r\n            \r\nEvent Forwarding:\r\n- If enableEventForwarding = false, the following fields will be ignored:\r\n    - notify\r\n    - decimalPlaces\r\n    - alarmOnEventOccurrence\r\n    - alarmAutoDrillDown\r\n            \r\nEvent Suppression (eventSuppression):\r\n- If suppressionMultiple is supplied, enableSuppression must also be provided.\r\n- When enableSuppression = true and suppressionMultiple is provided, the value must be a positive integer between 1 and 9999 (inclusive).\r\n            \r\nExpiration Date:\r\n- Must be a future date/time (UTC). Dates in the past are rejected with 400.\r\n- Accepted formats: yyyy-MM-dd, yyyy-MM-ddTHH:mm:ss, yyyy-MM-dd HH:mm:ss.fff.\r\n            \r\nText Field Lengths:\r\n- information.ruleName: 3–100 characters.\r\n- information.briefDesc: ≤ 255 characters (≤ 250 when syncWithRuleName = true).\r\n- information.additionalDetails: ≤ 2000 characters (≤ 1995 when syncWithRuleName = true).\r\n- information.ruleGroup: ≤ 100 characters.\r\n            \r\nRuleBlocks — overview:\r\nA rule may contain 1 to 3 rule blocks that together define its detection logic. Block IDs must be sequential starting at 0 (i.e. 0; 0,1; or 0,1,2).\r\n            \r\nAllowed block types per composition:\r\n- Single block (1 block): LogObserved, LogNotObservedScheduled, ThresholdObserved, ThresholdNotObservedScheduled, UniqueValuesObserved, UniqueValuesNotObservedScheduled, WhiteList, Statistical, Trend. The compound *NotObserved types (LogNotObservedCompound, ThresholdNotObservedCompound, UniqueValuesNotObservedCompound) are NOT valid as the sole block.\r\n- Two-block rule: first block must be LogObserved, ThresholdObserved, UniqueValuesObserved, or WhiteList. Second block may be any *NotObservedCompound or *Observed type.\r\n- Three-block rule: first block same as above; second block must be an *Observed type (not *NotObserved); third block may be any *NotObservedCompound or *Observed type.\r\n            \r\nDB-backed validation:\r\nAfter structural validation passes, the service additionally verifies that referenced entities exist in the database (classification, common event, rule set, notification persons/groups, and rule block fields). Failures at this stage are returned as 400 with a descriptive message, or as 500 if the created rule cannot be reloaded after persistence.","requestBody":{"description":"The AIE rule details to create.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Patch/Post payload for an AIE rule.\r\nOnly the fields that are provided will be updated for Patch operations."}},"text/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Patch/Post payload for an AIE rule.\r\nOnly the fields that are provided will be updated for Patch operations."}},"application/*+json":{"schema":{"allOf":[{"$ref":"#/components/schemas/ApiAieRulePatchRequest"}],"description":"Patch/Post payload for an AIE rule.\r\nOnly the fields that are provided will be updated for Patch operations."}}},"required":true},"responses":{"201":{"description":"Created. The AIE rule was created successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/ApiAIERuleApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/ApiAIERuleApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/ApiAIERuleApiResponse"}}}},"400":{"description":"Bad Request: If the request is invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized: If the user is not authorized.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden: If the user does not have permission.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"404":{"description":"NotFound: If the particular resource not found.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal server error. If an exception occurs.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}},"/lr-aie-api/aie/rules/stats/{engineId}":{"get":{"tags":["Rules"],"summary":"Returns runtime performance statistics for AIE rules associated with a specific engine.","description":"This endpoint retrieves runtime performance metrics for AIE rules loaded on the specified `engineId`.\r\n            \r\nStatistics include event rates (current and 24-hour average), memory usage, and CPU cost\r\nfor each rule actively running on the engine.\r\n            \r\nResults can be filtered by `aieRuleID` or `aieRuleName` and are returned in paged\r\nchunks using `offset` and `count` based pagination.\r\n            \r\nAll query parameter names use <b>camelCase</b>.\r\n            \r\nSorting:\r\n- `orderBy` — field to sort results by. Supported values:\r\n  - aieRuleID (1) — default\r\n  - aieRuleName (2)\r\n- `dir` — sort direction. Supported values:\r\n  - ascending (1) — default\r\n  - descending (2)\r\n            \r\nResponse Fields:\r\n- `aieRuleID`: Unique identifier of the AIE rule.\r\n- `aieRuleName`: Name of the AIE rule.\r\n- `averageEventFeedbackRate`: Average feedback event rate in Events Per Hour (EPH), computed over a 24-hour window.\r\n- `currentEventFeedbackRate`: Current feedback event rate in EPH, based on the most recent 3-minute window.\r\n- `averageEventForwardRate`: Average forward event rate in EPH, computed over a 24-hour window.\r\n- `currentEventForwardRate`: Current forward event rate in EPH, based on the most recent 3-minute window.\r\n- `totalMemKB`: Total memory usage in kilobytes (shared + unshared).\r\n- `sharedMemKB`: Shared memory usage in kilobytes (memory shared across rule instances on the engine).\r\n- `unsharedMemKB`: Unshared memory usage in kilobytes (memory exclusive to this rule instance).\r\n- `sharedMemCost`: Percentage of available shared memory consumed by this rule.\r\n- `unsharedMemCost`: Percentage of available unshared memory consumed by this rule.\r\n- `cpuCost`: CPU processing cost as a percentage.\r\n            \r\nNote: Memory and CPU fields (`totalMemKB`, `sharedMemKB`, `unsharedMemKB`,\r\n`sharedMemCost`, `unsharedMemCost`, `cpuCost`) are populated only for enabled\r\nrules. These fields are `null` for disabled rules.\r\n            \r\nPagination metadata is returned in response headers:\r\n- `X-Offset`: The offset applied to the result set.\r\n- `X-Count`: The count requested.\r\n- `X-Results-Returned`: The number of results included in this response.\r\n- `X-Total-Results`: The total number of matching records available.","parameters":[{"name":"engineId","in":"path","description":"The ID of the AI Engine to retrieve statistics for.","required":true,"schema":{"type":"integer","format":"int32"}},{"name":"aieRuleID","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"aieRuleName","in":"query","schema":{"type":"string"}},{"name":"offset","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"count","in":"query","schema":{"type":"integer","format":"int32"}},{"name":"dir","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/SortDirectionEnum"}]}},{"name":"orderBy","in":"query","schema":{"allOf":[{"$ref":"#/components/schemas/StatisticsSortFieldsEnum"}]}}],"responses":{"200":{"description":"Success. Statistical fields retrieved successfully.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/RuleStatisticFieldDetailsListApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/RuleStatisticFieldDetailsListApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/RuleStatisticFieldDetailsListApiResponse"}}}},"400":{"description":"Bad Request: If the engineId, offset, or count is invalid.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"401":{"description":"Unauthorized: If the user is not authorized.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"403":{"description":"Forbidden: If the user does not have permission.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"404":{"description":"NotFound: If the engine is not found.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}},"500":{"description":"Internal server error. If an exception occurs.","content":{"text/plain":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"application/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}},"text/json":{"schema":{"$ref":"#/components/schemas/StringApiResponse"}}}}}}}},"components":{"schemas":{"AIEDataSegregationEnum":{"enum":["none","logSourceEntity","logSourceRootEntity"],"type":"string"},"AIERuleImportResponse":{"type":"object","properties":{"aieRuleId":{"type":"integer","format":"int32"},"aieRuleName":{"type":"string","nullable":true}},"additionalProperties":false},"AIERuleImportResponseApiResponse":{"type":"object","properties":{"data":{"allOf":[{"$ref":"#/components/schemas/AIERuleImportResponse"}],"nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"AIERuleStatus":{"enum":["disabled","enabled","suspended","learning","paused","_Varies"],"type":"string"},"AIERuleSummaryResponse":{"type":"object","properties":{"ruleId":{"type":"integer","format":"int32"},"ruleName":{"type":"string","nullable":true},"ruleStatus":{"enum":["disabled","enabled","suspended","learning","paused","_Varies"],"type":"string","allOf":[{"$ref":"#/components/schemas/AIERuleStatus"}]},"restart":{"enum":["none","pending","needed"],"type":"string","allOf":[{"$ref":"#/components/schemas/RestartStatusEnum"}]},"activationDate":{"type":"string","format":"date-time","nullable":true},"expirationDate":{"type":"string","format":"date-time","nullable":true},"dataSegregationMode":{"enum":["none","logSourceEntity","logSourceRootEntity"],"type":"string","allOf":[{"$ref":"#/components/schemas/AIEDataSegregationEnum"}]},"alarmStatus":{"type":"boolean","nullable":true},"alarmAutoDrilldown":{"type":"boolean","nullable":true},"edf":{"enum":["none","low","medium","high"],"type":"string","allOf":[{"$ref":"#/components/schemas/EnvDepFacEnum"}]},"fpp":{"enum":["none","lowLow","lowMedium","lowHigh","mediumLow","mediumMedium","mediumHigh","highLow","highMedium","highHigh"],"type":"string","allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}]},"suppressFor":{"type":"string","nullable":true},"runtimePriority":{"enum":["low","normal","high"],"type":"string","allOf":[{"$ref":"#/components/schemas/RuntimePriorityEnum"}]},"ruleGroup":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"ruleSetName":{"type":"string","nullable":true},"permissions":{"type":"string","nullable":true},"dateUpdated":{"type":"string","format":"date-time"},"commonEventId":{"type":"integer","format":"int32","nullable":true},"classificationId":{"type":"integer","format":"int32","nullable":true},"ruleSetId":{"type":"integer","format":"int32","nullable":true},"notifications":{"allOf":[{"$ref":"#/components/schemas/RuleNotificationSummary"}],"nullable":true}},"additionalProperties":false},"AIERuleSummaryResponseIReadOnlyListApiResponse":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AIERuleSummaryResponse"},"nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"AIERulesStatusRequest":{"type":"object","properties":{"ruleId":{"type":"integer","format":"int32"},"status":{"allOf":[{"$ref":"#/components/schemas/AIERuleStatus"}],"nullable":true}},"additionalProperties":false},"AccessTypeEnum":{"enum":["systemGlobalAdmin","customGlobalAdmin"],"type":"string"},"AieRule":{"type":"object","properties":{"id":{"type":"integer","format":"int32"},"requestedStatus":{"enum":["disabled","enabled","suspended","learning","paused","_Varies"],"type":"string","allOf":[{"$ref":"#/components/schemas/AIERuleStatus"}]},"errorMessage":{"type":"string","nullable":true}},"additionalProperties":false},"ApiAIEArg":{"type":"object","properties":{"index":{"type":"integer","format":"int32"}},"additionalProperties":false},"ApiAIEOperationExpression":{"type":"object","properties":{"expressionType":{"type":"integer","format":"int32"},"args":{"type":"array","items":{"$ref":"#/components/schemas/ApiAIEArg"},"nullable":true}},"additionalProperties":false},"ApiAIEResultExpression":{"type":"object","properties":{"expressionType":{"type":"integer","format":"int32"},"expressionText":{"type":"string","nullable":true},"aieOperationExpressions":{"type":"array","items":{"$ref":"#/components/schemas/ApiAIEOperationExpression"},"nullable":true}},"additionalProperties":false},"ApiAIERule":{"type":"object","properties":{"ruleBlocks":{"type":"array","items":{"oneOf":[{"$ref":"#/components/schemas/ApiLogObservedRuleBlock"},{"$ref":"#/components/schemas/ApiLogNotObservedCompoundRuleBlock"},{"$ref":"#/components/schemas/ApiLogNotObservedScheduledRuleBlock"},{"$ref":"#/components/schemas/ApiUniqueValuesObservedRuleBlock"},{"$ref":"#/components/schemas/ApiUniqueValuesNotObservedCompoundRuleBlock"},{"$ref":"#/components/schemas/ApiUniqueValuesNotObservedScheduledRuleBlock"},{"$ref":"#/components/schemas/ApiThresholdObservedRuleBlock"},{"$ref":"#/components/schemas/ApiThresholdNotObservedCompoundRuleBlock"},{"$ref":"#/components/schemas/ApiThresholdNotObservedScheduledRuleBlock"},{"$ref":"#/components/schemas/ApiWhiteOrBlacklistRuleBlock"}]},"nullable":true},"syncWithRuleName":{"type":"boolean","description":"If true, synchronize the Alarm Rule name with the AIE Rule name.","nullable":true},"alarmOnEventOccurrence":{"type":"boolean","description":"True / false indicating alarm status.","nullable":true},"alarmAutoDrillDown":{"type":"boolean","description":"Enable / disable alarm auto drilldown for this rule.","nullable":true},"riskRating":{"allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}],"description":"Default risk rating associated with the rule (Common Event).","nullable":true},"decimalPlaces":{"type":"integer","description":"Number of decimal places.","format":"int32","nullable":true},"expirationDate":{"type":"string","description":"Rule expiration date. Set to null to remove expiration.","format":"date-time","nullable":true},"runtimePriority":{"allOf":[{"$ref":"#/components/schemas/RuntimePriorityEnum"}],"description":"Runtime priority of the rule (low, normal, high).","nullable":true},"edf":{"allOf":[{"$ref":"#/components/schemas/EnvDepFacEnum"}],"description":"EDF (none, low, medium, high).","nullable":true},"fpp":{"allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}],"description":"False positive probability (none, lowLow, lowMedium, highHigh etc).","nullable":true},"dataSegregationMode":{"allOf":[{"$ref":"#/components/schemas/AIEDataSegregationEnum"}],"description":"Data segregation mode (none, entity, rootEntity).","nullable":true},"enableEventForwarding":{"type":"boolean","description":"Enable / disable forwarding AIE events.","nullable":true},"ruleSetId":{"type":"integer","description":"Identifier of the AIE Rule Set this rule belongs to.","format":"int32","nullable":true},"commonEvent":{"allOf":[{"$ref":"#/components/schemas/PatchCommonEventModel"}],"description":"Common Event configuration associated to this AIE rule.","nullable":true},"classification":{"allOf":[{"$ref":"#/components/schemas/PatchClassificationModel"}],"description":"Classification information for the rule (MsgClass / classification).","nullable":true},"eventSuppression":{"allOf":[{"$ref":"#/components/schemas/ApiEventSuppressionPatch"}],"nullable":true},"notify":{"allOf":[{"$ref":"#/components/schemas/PatchNotifyModel"}],"description":"Notification targets (persons, groups, host roles).","nullable":true},"information":{"allOf":[{"$ref":"#/components/schemas/PatchInformationModel"}],"description":"Alarm information and group metadata.","nullable":true},"aieRuleId":{"type":"integer","format":"int32"}},"additionalProperties":false},"ApiAIERuleApiResponse":{"type":"object","properties":{"data":{"allOf":[{"$ref":"#/components/schemas/ApiAIERule"}],"nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"ApiAieRulePatchRequest":{"type":"object","properties":{"ruleBlocks":{"type":"array","items":{"oneOf":[{"$ref":"#/components/schemas/ApiLogObservedRuleBlock"},{"$ref":"#/components/schemas/ApiLogNotObservedCompoundRuleBlock"},{"$ref":"#/components/schemas/ApiLogNotObservedScheduledRuleBlock"},{"$ref":"#/components/schemas/ApiUniqueValuesObservedRuleBlock"},{"$ref":"#/components/schemas/ApiUniqueValuesNotObservedCompoundRuleBlock"},{"$ref":"#/components/schemas/ApiUniqueValuesNotObservedScheduledRuleBlock"},{"$ref":"#/components/schemas/ApiThresholdObservedRuleBlock"},{"$ref":"#/components/schemas/ApiThresholdNotObservedCompoundRuleBlock"},{"$ref":"#/components/schemas/ApiThresholdNotObservedScheduledRuleBlock"},{"$ref":"#/components/schemas/ApiWhiteOrBlacklistRuleBlock"}]},"nullable":true},"syncWithRuleName":{"type":"boolean","description":"If true, synchronize the Alarm Rule name with the AIE Rule name.","nullable":true},"alarmOnEventOccurrence":{"type":"boolean","description":"True / false indicating alarm status.","nullable":true},"alarmAutoDrillDown":{"type":"boolean","description":"Enable / disable alarm auto drilldown for this rule.","nullable":true},"riskRating":{"allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}],"description":"Default risk rating associated with the rule (Common Event).","nullable":true},"decimalPlaces":{"type":"integer","description":"Number of decimal places.","format":"int32","nullable":true},"expirationDate":{"type":"string","description":"Rule expiration date. Set to null to remove expiration.","format":"date-time","nullable":true},"runtimePriority":{"allOf":[{"$ref":"#/components/schemas/RuntimePriorityEnum"}],"description":"Runtime priority of the rule (low, normal, high).","nullable":true},"edf":{"allOf":[{"$ref":"#/components/schemas/EnvDepFacEnum"}],"description":"EDF (none, low, medium, high).","nullable":true},"fpp":{"allOf":[{"$ref":"#/components/schemas/FalsePositiveProbEnum"}],"description":"False positive probability (none, lowLow, lowMedium, highHigh etc).","nullable":true},"dataSegregationMode":{"allOf":[{"$ref":"#/components/schemas/AIEDataSegregationEnum"}],"description":"Data segregation mode (none, entity, rootEntity).","nullable":true},"enableEventForwarding":{"type":"boolean","description":"Enable / disable forwarding AIE events.","nullable":true},"ruleSetId":{"type":"integer","description":"Identifier of the AIE Rule Set this rule belongs to.","format":"int32","nullable":true},"commonEvent":{"allOf":[{"$ref":"#/components/schemas/PatchCommonEventModel"}],"description":"Common Event configuration associated to this AIE rule.","nullable":true},"classification":{"allOf":[{"$ref":"#/components/schemas/PatchClassificationModel"}],"description":"Classification information for the rule (MsgClass / classification).","nullable":true},"eventSuppression":{"allOf":[{"$ref":"#/components/schemas/ApiEventSuppressionPatch"}],"nullable":true},"notify":{"allOf":[{"$ref":"#/components/schemas/PatchNotifyModel"}],"description":"Notification targets (persons, groups, host roles).","nullable":true},"information":{"allOf":[{"$ref":"#/components/schemas/PatchInformationModel"}],"description":"Alarm information and group metadata.","nullable":true}},"additionalProperties":false,"description":"Patch/Post payload for an AIE rule.\r\nOnly the fields that are provided will be updated for Patch operations."},"ApiBlockRelationship":{"type":"object","properties":{"durationSeconds":{"type":"integer","format":"int32"},"durationOffsetSeconds":{"type":"integer","format":"int32"},"ruleBlockA_GUID":{"type":"string","format":"uuid"},"ruleBlockB_GUID":{"type":"string","format":"uuid"},"linkCriteria":{"allOf":[{"$ref":"#/components/schemas/ApiAIEResultExpression"}],"nullable":true},"fieldRelationships":{"type":"array","items":{"$ref":"#/components/schemas/ApiFieldRelationship"},"nullable":true},"joinType":{"enum":["inner","leftOuter","rightOuter","outer"],"type":"string","allOf":[{"$ref":"#/components/schemas/JoinTypeEnum"}]}},"additionalProperties":false},"ApiDataSource":{"required":["dataSourceId"],"type":"object","properties":{"dataSourceId":{"allOf":[{"$ref":"#/components/schemas/DataSourceEnum"}]},"dataSourceSummary":{"type":"string","nullable":true}},"additionalProperties":false},"ApiDayTime":{"type":"object","properties":{"day":{"enum":["sunday","monday","tuesday","wednesday","thursday","friday","saturday"],"type":"string","allOf":[{"$ref":"#/components/schemas/DayOfWeek"}]},"displayTime":{"type":"string","nullable":true}},"additionalProperties":false},"ApiDayTimeFilter":{"type":"object","properties":{"dayTimeStartLocal":{"allOf":[{"$ref":"#/components/schemas/ApiDayTime"}],"nullable":true},"dayTimeEndLocal":{"allOf":[{"$ref":"#/components/schemas/ApiDayTime"}],"nullable":true},"timeZoneId":{"type":"string","nullable":true}},"additionalProperties":false},"ApiEventSuppressionPatch":{"type":"object","properties":{"enableSuppression":{"type":"boolean","nullable":true},"suppressionMultiple":{"type":"integer","format":"int32","nullable":true}},"additionalProperties":false},"ApiField":{"type":"object","properties":{"field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","logID","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]},"fieldDisplayName":{"type":"string","nullable":true}},"additionalProperties":false},"ApiFieldFilter":{"required":["fieldFilterType","filterInNullValues","filterMode","filterOutNullValues"],"type":"object","properties":{"filterOutNullValues":{"type":"boolean"},"filterInNullValues":{"type":"boolean"},"fieldFilterType":{"enum":["mediatorMsgID","marcMsgID","direction","priority","normalMsgDateRange","normalMsgDateTimeOfDay","entity","msgSource","msgSourceHost","msgSourceType","msgClass","commonEvent","mpeRule","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","ipRange","sipRange","dipRange","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","message","alertStatus","vendorMsgID","group","domain","session","process","url","user","address","port","sPortRange","dPortRange","portRange","sNetwork","dNetwork","network","idmGroupForLogin","idmGroupForAccount","idmGroupForUser","idmGroupToLogin_OBS","idmGroupToAccount_OBS","idmGroupToUser_OBS","bytesIn","bytesOut","itemsIn","itemsOut","duration","quantity","amount","rate","size","fkValue_SNameID","fkValue_DNameID","fkValue_LoginID","fkValue_AccountID","fkValue_SenderID","fkValue_RecipientID","fkValue_ObjectID","fkValue_VendorMsgIdentifierID","fkValue_GroupID","fkValue_DomainID","fkValue_ProcessID","fkValue_URLID","fkValue_User","fkValue_Address","fkValue_HostName","fkValue_IDMGroupToLoginID","fkValue_IDMGroupToAccountID","fkValue_IDMGroupToUser","sLocation","dLocation","location","sLocationToKey","dLocationToKey","locationToKey","sEntity","dEntity","sZone","dZone","bytesInOut","itemsInOut","application","host","sHost","dHost","sEntityOrDEntity","sZoneOrDZone","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","fkValue_SMAC","fkValue_DMAC","fkValue_SInterface","fkValue_DInterface","fkValue_Severity","fkValue_Version","fkValue_Command","fkValue_ObjectName","snatipRange","dnatipRange","natip","natipRange","snatPortRange","dnatPortRange","natPort","natPortRange","mac","interface","fkValue_MAC","fkValue_Interface","rootEntity","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","fkValue_Action","fkValue_CVE","fkValue_ObjectType","fkValue_ParentProcessName","fkValue_ParentProcessPath","fkValue_Policy","fkValue_ResponseCode","fkValue_Result","fkValue_SerialNumber","fkValue_SessionType","fkValue_Status","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","filterGroup","polyListItem"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldFilterTypeEnum"}]},"fieldFilterValues":{"type":"array","items":{"$ref":"#/components/schemas/ApiFieldFilterValue"},"nullable":true},"fieldOperatorEnum":{"allOf":[{"$ref":"#/components/schemas/FieldOperatorEnum"}],"nullable":true},"displayValue":{"type":"string","nullable":true},"filterMode":{"enum":["filterIn","filterOut"],"type":"string","allOf":[{"$ref":"#/components/schemas/FilterModeEnum"}]}},"additionalProperties":false},"ApiFieldFilterValue":{"required":["fieldFilterType","fieldFilterValueType","value"],"type":"object","properties":{"matchTypeEnum":{"enum":["value","sqlPattern","regex","term"],"type":"string","allOf":[{"$ref":"#/components/schemas/MatchTypeEnum"}]},"regexIgnoreCase":{"type":"boolean"},"displayValue":{"type":"string","nullable":true},"value":{},"fieldFilterValueType":{"allOf":[{"$ref":"#/components/schemas/FieldFilterValueTypeEnum"}]},"fieldFilterType":{"enum":["mediatorMsgID","marcMsgID","direction","priority","normalMsgDateRange","normalMsgDateTimeOfDay","entity","msgSource","msgSourceHost","msgSourceType","msgClass","commonEvent","mpeRule","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","ipRange","sipRange","dipRange","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","message","alertStatus","vendorMsgID","group","domain","session","process","url","user","address","port","sPortRange","dPortRange","portRange","sNetwork","dNetwork","network","idmGroupForLogin","idmGroupForAccount","idmGroupForUser","idmGroupToLogin_OBS","idmGroupToAccount_OBS","idmGroupToUser_OBS","bytesIn","bytesOut","itemsIn","itemsOut","duration","quantity","amount","rate","size","fkValue_SNameID","fkValue_DNameID","fkValue_LoginID","fkValue_AccountID","fkValue_SenderID","fkValue_RecipientID","fkValue_ObjectID","fkValue_VendorMsgIdentifierID","fkValue_GroupID","fkValue_DomainID","fkValue_ProcessID","fkValue_URLID","fkValue_User","fkValue_Address","fkValue_HostName","fkValue_IDMGroupToLoginID","fkValue_IDMGroupToAccountID","fkValue_IDMGroupToUser","sLocation","dLocation","location","sLocationToKey","dLocationToKey","locationToKey","sEntity","dEntity","sZone","dZone","bytesInOut","itemsInOut","application","host","sHost","dHost","sEntityOrDEntity","sZoneOrDZone","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","fkValue_SMAC","fkValue_DMAC","fkValue_SInterface","fkValue_DInterface","fkValue_Severity","fkValue_Version","fkValue_Command","fkValue_ObjectName","snatipRange","dnatipRange","natip","natipRange","snatPortRange","dnatPortRange","natPort","natPortRange","mac","interface","fkValue_MAC","fkValue_Interface","rootEntity","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","fkValue_Action","fkValue_CVE","fkValue_ObjectType","fkValue_ParentProcessName","fkValue_ParentProcessPath","fkValue_Policy","fkValue_ResponseCode","fkValue_Result","fkValue_SerialNumber","fkValue_SessionType","fkValue_Status","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","filterGroup","polyListItem"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldFilterTypeEnum"}]}},"additionalProperties":false},"ApiFieldRelationship":{"type":"object","properties":{"ruleBlockA_Field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","logID","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]},"ruleBlockB_Field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","logID","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]}},"additionalProperties":false},"ApiHarmonyLinkedDataBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true}},"additionalProperties":false},"ApiHarmonyRuleBlockBase":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true}},"additionalProperties":false},"ApiLogNotObservedCompoundRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true}},"additionalProperties":false},"ApiLogNotObservedScheduledRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"distinctOccurrences":{"allOf":[{"$ref":"#/components/schemas/ApiFieldFilter"}],"nullable":true},"schedule":{"allOf":[{"$ref":"#/components/schemas/ApiRuleBlockSchedule"}],"nullable":true}},"additionalProperties":false},"ApiLogObservedRuleBlock":{"type":"object","allOf":[{"$ref":"#/components/schemas/ApiHarmonyRuleBlockBase"}],"additionalProperties":false},"ApiLogSource":{"type":"object","properties":{"logSourceId":{"type":"integer","format":"int32"},"logSourceName":{"type":"string","nullable":true},"entity":{"type":"string","nullable":true},"host":{"type":"string","nullable":true},"logSourceType":{"type":"string","nullable":true}},"additionalProperties":false},"ApiLogSourceList":{"type":"object","properties":{"logSourceListId":{"type":"integer","format":"int32"},"logSourceListName":{"type":"string","nullable":true}},"additionalProperties":false},"ApiMonitoringInterval":{"type":"object","properties":{"dayTimeStartLocal":{"allOf":[{"$ref":"#/components/schemas/ApiDayTime"}],"nullable":true},"dayTimeEndLocal":{"allOf":[{"$ref":"#/components/schemas/ApiDayTime"}],"nullable":true},"guid":{"type":"string","format":"uuid"}},"additionalProperties":false},"ApiMsgFilter":{"required":["isSavedFilter"],"type":"object","properties":{"msgFilterType":{"enum":["flatLegacy","grouped"],"type":"string","allOf":[{"$ref":"#/components/schemas/MsgFilterTypeEnum"}]},"isSavedFilter":{"type":"boolean"},"fieldFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiFieldFilter"},"nullable":true}},"additionalProperties":false},"ApiRuleBlockSchedule":{"type":"object","properties":{"autofrequency":{"type":"boolean"},"timeZoneId":{"type":"string","nullable":true},"evaluationTimeSpan":{"type":"string","format":"date-span"},"useDayLightSavingTime":{"type":"boolean"},"monitoringIntervals":{"type":"array","items":{"$ref":"#/components/schemas/ApiMonitoringInterval"},"nullable":true}},"additionalProperties":false},"ApiThresholdField":{"type":"object","properties":{"field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","logID","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]},"thresholdCount":{"type":"number","format":"double"}},"additionalProperties":false},"ApiThresholdNotObservedCompoundRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"thresholdFields":{"type":"array","items":{"$ref":"#/components/schemas/ApiThresholdField"},"nullable":true},"thresholdsBooleanOperator":{"allOf":[{"$ref":"#/components/schemas/ThresholdBooleanOperatorEnum"}],"nullable":true}},"additionalProperties":false},"ApiThresholdNotObservedScheduledRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"thresholdFields":{"type":"array","items":{"$ref":"#/components/schemas/ApiThresholdField"},"nullable":true},"thresholdsBooleanOperator":{"allOf":[{"$ref":"#/components/schemas/ThresholdBooleanOperatorEnum"}],"nullable":true},"schedule":{"allOf":[{"$ref":"#/components/schemas/ApiRuleBlockSchedule"}],"nullable":true},"distinctOccurrences":{"allOf":[{"$ref":"#/components/schemas/ApiFieldFilter"}],"nullable":true}},"additionalProperties":false},"ApiThresholdObservedRuleBlock":{"type":"object","allOf":[{"$ref":"#/components/schemas/ApiHarmonyRuleBlockBase"}],"properties":{"thresholdFields":{"type":"array","items":{"$ref":"#/components/schemas/ApiThresholdField"},"nullable":true},"thresholdsBooleanOperator":{"allOf":[{"$ref":"#/components/schemas/ThresholdBooleanOperatorEnum"}],"nullable":true}},"additionalProperties":false},"ApiUniqueValuesNotObservedCompoundRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"uniqueValues":{"type":"array","items":{"$ref":"#/components/schemas/UniqueValuesField"},"nullable":true},"uniqueValuesReoccurranceCount":{"type":"integer","format":"int32"},"queryDurationSeconds":{"type":"integer","format":"int32"}},"additionalProperties":false},"ApiUniqueValuesNotObservedScheduledRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"uniqueValues":{"type":"array","items":{"$ref":"#/components/schemas/UniqueValuesField"},"nullable":true},"uniqueValuesReoccurranceCount":{"type":"integer","format":"int32"},"queryDurationSeconds":{"type":"integer","format":"int32"},"schedule":{"allOf":[{"$ref":"#/components/schemas/ApiRuleBlockSchedule"}],"nullable":true},"distinctOccurrences":{"allOf":[{"$ref":"#/components/schemas/ApiFieldFilter"}],"nullable":true}},"additionalProperties":false},"ApiUniqueValuesObservedRuleBlock":{"type":"object","allOf":[{"$ref":"#/components/schemas/ApiHarmonyRuleBlockBase"}],"properties":{"uniqueValues":{"type":"array","items":{"$ref":"#/components/schemas/UniqueValuesField"},"nullable":true},"uniqueValuesReoccurranceCount":{"type":"integer","format":"int32"},"queryDurationSeconds":{"type":"integer","format":"int32"}},"additionalProperties":false},"ApiWhiteOrBlacklistRuleBlock":{"required":["dataSource","filter_MsgFilters"],"type":"object","properties":{"blockId":{"type":"integer","format":"int32"},"dataSource":{"allOf":[{"$ref":"#/components/schemas/ApiDataSource"}]},"guid":{"type":"string","format":"uuid"},"description":{"type":"string","nullable":true},"additionalDetails":{"type":"string","nullable":true},"ruleBlockRelationship":{"allOf":[{"$ref":"#/components/schemas/ApiBlockRelationship"}],"nullable":true},"filter_MsgFilters":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"}},"filter_MsgFiltersIn":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"filter_MsgFiltersOut":{"type":"array","items":{"$ref":"#/components/schemas/ApiMsgFilter"},"nullable":true},"dataFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"filter_LogSources":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSource"},"nullable":true},"filter_LogSourceLists":{"type":"array","items":{"$ref":"#/components/schemas/ApiLogSourceList"},"nullable":true},"filter_DayAndTime":{"type":"array","items":{"$ref":"#/components/schemas/ApiDayTimeFilter"},"nullable":true},"groupByFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"aieSummaryFields":{"uniqueItems":true,"type":"array","items":{"$ref":"#/components/schemas/ApiField"},"nullable":true},"linkedDataBlocks":{"type":"array","items":{"$ref":"#/components/schemas/ApiHarmonyLinkedDataBlock"},"nullable":true}},"additionalProperties":false},"DataSourceEnum":{"enum":["dataProcessorLogs","advancedIntelligenceEngineEvents"],"type":"string"},"DayOfWeek":{"enum":["sunday","monday","tuesday","wednesday","thursday","friday","saturday"],"type":"string"},"EnvDepFacEnum":{"enum":["none","low","medium","high"],"type":"string"},"FalsePositiveProbEnum":{"enum":["none","lowLow","lowMedium","lowHigh","mediumLow","mediumMedium","mediumHigh","highLow","highMedium","highHigh"],"type":"string"},"FieldEnum":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","logID","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string"},"FieldFilterTypeEnum":{"enum":["mediatorMsgID","marcMsgID","direction","priority","normalMsgDateRange","normalMsgDateTimeOfDay","entity","msgSource","msgSourceHost","msgSourceType","msgClass","commonEvent","mpeRule","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","ipRange","sipRange","dipRange","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","message","alertStatus","vendorMsgID","group","domain","session","process","url","user","address","port","sPortRange","dPortRange","portRange","sNetwork","dNetwork","network","idmGroupForLogin","idmGroupForAccount","idmGroupForUser","idmGroupToLogin_OBS","idmGroupToAccount_OBS","idmGroupToUser_OBS","bytesIn","bytesOut","itemsIn","itemsOut","duration","quantity","amount","rate","size","fkValue_SNameID","fkValue_DNameID","fkValue_LoginID","fkValue_AccountID","fkValue_SenderID","fkValue_RecipientID","fkValue_ObjectID","fkValue_VendorMsgIdentifierID","fkValue_GroupID","fkValue_DomainID","fkValue_ProcessID","fkValue_URLID","fkValue_User","fkValue_Address","fkValue_HostName","fkValue_IDMGroupToLoginID","fkValue_IDMGroupToAccountID","fkValue_IDMGroupToUser","sLocation","dLocation","location","sLocationToKey","dLocationToKey","locationToKey","sEntity","dEntity","sZone","dZone","bytesInOut","itemsInOut","application","host","sHost","dHost","sEntityOrDEntity","sZoneOrDZone","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","fkValue_SMAC","fkValue_DMAC","fkValue_SInterface","fkValue_DInterface","fkValue_Severity","fkValue_Version","fkValue_Command","fkValue_ObjectName","snatipRange","dnatipRange","natip","natipRange","snatPortRange","dnatPortRange","natPort","natPortRange","mac","interface","fkValue_MAC","fkValue_Interface","rootEntity","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","fkValue_Action","fkValue_CVE","fkValue_ObjectType","fkValue_ParentProcessName","fkValue_ParentProcessPath","fkValue_Policy","fkValue_ResponseCode","fkValue_Result","fkValue_SerialNumber","fkValue_SessionType","fkValue_Status","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","filterGroup","polyListItem"],"type":"string"},"FieldFilterValueTypeEnum":{"enum":["byte","int16","int32","int64","string","ipAddress","ipAddressRange","timeOfDay","dateRange","portRange","quantity","listReference","listSet","null","invalid"],"type":"string"},"FieldOperatorEnum":{"enum":["none","and","or","andPrevious","orPrevious","primary_MsgSources"],"type":"string"},"FilterModeEnum":{"enum":["filterIn","filterOut"],"type":"string"},"GroupNotification":{"type":"object","properties":{"alarmNfnGroupId":{"type":"integer","format":"int32"},"notificationGroup":{"type":"string","nullable":true},"isNfnSilent":{"type":"boolean"},"canBatchNfy":{"type":"boolean"}},"additionalProperties":false},"HostRoleEnum":{"enum":["businessOwner","operationsOwner","primaryAdministrator","secondaryAdministrator","securityAdministrator","auditor"],"type":"string"},"HostRoleNotification":{"type":"object","properties":{"hostRoleId":{"type":"integer","format":"int32"},"hostRole":{"enum":["businessOwner","operationsOwner","primaryAdministrator","secondaryAdministrator","securityAdministrator","auditor"],"type":"string","allOf":[{"$ref":"#/components/schemas/HostRoleEnum"}]},"isNfnSilent":{"type":"boolean"},"canBatchNfy":{"type":"boolean"}},"additionalProperties":false},"ImportRuleRequest":{"type":"object","properties":{"file":{"type":"string","nullable":true},"listSyncSetting":{"allOf":[{"$ref":"#/components/schemas/ListSyncSetting"}],"nullable":true}},"additionalProperties":false},"JoinTypeEnum":{"enum":["inner","leftOuter","rightOuter","outer"],"type":"string"},"ListSyncSetting":{"enum":["doNotImportListContents","importListContents","mergeListContents"],"type":"string"},"MatchTypeEnum":{"enum":["value","sqlPattern","regex","term"],"type":"string"},"MsgFilterTypeEnum":{"enum":["flatLegacy","grouped"],"type":"string"},"PatchClassificationModel":{"type":"object","properties":{"classificationId":{"type":"integer","description":"Classification identifier (MsgClass / classification ID).","format":"int32","nullable":true},"classificationName":{"type":"string","description":"Classification name displayed in UI.","nullable":true}},"additionalProperties":false},"PatchCommonEventModel":{"type":"object","properties":{"commonEventId":{"type":"integer","description":"ID of the Common Event to associate with this rule.","format":"int32","nullable":true},"commonEventName":{"type":"string","description":"Name of the Common Event.","nullable":true}},"additionalProperties":false},"PatchInformationModel":{"type":"object","properties":{"ruleName":{"type":"string","description":"Display name of the alarm/rule in the console.","nullable":true},"briefDesc":{"type":"string","description":"Brief description shown in the console.","nullable":true},"additionalDetails":{"type":"string","description":"Full description / additional details.","nullable":true},"ruleGroup":{"type":"string","description":"Alarm rule group.","nullable":true}},"additionalProperties":false},"PatchNotifyGroup":{"type":"object","properties":{"include":{"type":"boolean","nullable":true},"alarmNfnGroupId":{"type":"integer","description":"AlarmNfnGroupID to notify.","format":"int32","nullable":true},"canBatchNotify":{"type":"boolean","nullable":true},"isSilent":{"type":"boolean","nullable":true}},"additionalProperties":{}},"PatchNotifyHostRole":{"type":"object","properties":{"include":{"type":"boolean","nullable":true},"hostRoleId":{"type":"integer","description":"Host role identifier to notify.","format":"int32","nullable":true},"canBatchNotify":{"type":"boolean","nullable":true},"isSilent":{"type":"boolean","nullable":true}},"additionalProperties":{}},"PatchNotifyModel":{"type":"object","properties":{"persons":{"type":"array","items":{"$ref":"#/components/schemas/PatchNotifyPerson"},"description":"Person-based notification targets.","nullable":true},"groups":{"type":"array","items":{"$ref":"#/components/schemas/PatchNotifyGroup"},"description":"Group-based notification targets.","nullable":true},"hostRoles":{"type":"array","items":{"$ref":"#/components/schemas/PatchNotifyHostRole"},"description":"Host-role-based notification targets.","nullable":true}},"additionalProperties":false},"PatchNotifyPerson":{"type":"object","properties":{"include":{"type":"boolean","description":"Whether this entry is selected in UI / should be applied.","nullable":true},"personId":{"type":"integer","description":"PersonID to notify.","format":"int32","nullable":true},"canBatchNotify":{"type":"boolean","description":"Whether notifications to this person can be batched.","nullable":true},"isSilent":{"type":"boolean","description":"Whether this is a silent notification.","nullable":true}},"additionalProperties":{}},"PersonNotification":{"type":"object","properties":{"personId":{"type":"integer","format":"int32"},"fullName":{"type":"string","nullable":true},"isNfnSilent":{"type":"boolean"},"canBatchNfy":{"type":"boolean"}},"additionalProperties":false},"RestartStatusEnum":{"enum":["none","pending","needed"],"type":"string"},"RuleEnableDisableResponse":{"type":"object","properties":{"notProcessedAIERules":{"type":"array","items":{"$ref":"#/components/schemas/AieRule"},"nullable":true}},"additionalProperties":false},"RuleEnableDisableResponseApiResponse":{"type":"object","properties":{"data":{"allOf":[{"$ref":"#/components/schemas/RuleEnableDisableResponse"}],"nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"RuleNotificationSummary":{"type":"object","properties":{"persons":{"type":"array","items":{"$ref":"#/components/schemas/PersonNotification"},"nullable":true},"groups":{"type":"array","items":{"$ref":"#/components/schemas/GroupNotification"},"nullable":true},"hostRoles":{"type":"array","items":{"$ref":"#/components/schemas/HostRoleNotification"},"nullable":true}},"additionalProperties":false},"RuleStatisticFieldDetails":{"type":"object","properties":{"aieRuleID":{"type":"integer","format":"int32"},"aieRuleName":{"type":"string","nullable":true},"averageEventFeedbackRate":{"type":"number","format":"double","nullable":true},"currentEventFeedbackRate":{"type":"number","format":"double","nullable":true},"averageEventForwardRate":{"type":"number","format":"double","nullable":true},"currentEventForwardRate":{"type":"number","format":"double","nullable":true},"totalMemKB":{"type":"integer","format":"int64","nullable":true},"sharedMemKB":{"type":"integer","format":"int64","nullable":true},"unsharedMemKB":{"type":"integer","format":"int64","nullable":true},"sharedMemCost":{"type":"number","format":"double","nullable":true},"unsharedMemCost":{"type":"number","format":"double","nullable":true},"cpuCost":{"type":"number","format":"double","nullable":true}},"additionalProperties":false},"RuleStatisticFieldDetailsListApiResponse":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/RuleStatisticFieldDetails"},"nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"RulesSummarySortField":{"enum":["ruleId","ruleName","ruleStatus","restart","activationDate","expirationDate","dataSegregationMode","alarmStatus","alarmAutoDrilldown","edf","fpp","runtimePriority","ruleGroup","description","ruleSetName","permissions","dateUpdated"],"type":"string"},"RuntimePriorityEnum":{"enum":["low","normal","high"],"type":"string"},"SortDirectionEnum":{"enum":["ascending","descending"],"type":"string"},"StatisticsSortFieldsEnum":{"enum":["aieRuleID","aieRuleName"],"type":"string"},"StringApiResponse":{"type":"object","properties":{"data":{"type":"string","nullable":true},"success":{"type":"boolean"},"message":{"type":"string","nullable":true}},"additionalProperties":false},"ThresholdBooleanOperatorEnum":{"enum":["and","or"],"type":"string"},"UniqueValuesField":{"type":"object","properties":{"field":{"enum":["null","direction","priority","normalMsgDate","firstNormalMsgDate","lastNormalMsgDate","count","msgDate","entity","msgSource","msgSourceHost","msgSourceType","msgClassType","msgClass","commonEvent","mpeRule","source","destination","service","knownHost","knownSHost","knownDHost","knownService","ip","sip","dip","hostName","sHostName","dHostName","sPort","dPort","protocol","login","account","sender","recipient","subject","object","vendorMessageID","vendorMessageName","bytesIn","bytesOut","itemsIn","itemsOut","duration","timeStart","timeEnd","process","amount","quantity","rate","size","domain","group","url","session","sequence","sNetwork","dNetwork","sLocation","sLocationCountry","sLocationRegion","sLocationCity","dLocation","dLocationCountry","dLocationRegion","dLocationCity","sEntity","dEntity","sZone","dZone","zone","user","address","mac","natip","interface","natPort","sEntityOrDEntity","rootEntity","message","mediatorMsgID","marcMsgID","ucF_A","ucF_B","ucF_C","ucF_D","ucF_E","ucF_F","ucF_G","ucF_H","ucF_I","ucF_J","uC50_A","uC50_B","uC50_C","uC50_D","uC50_E","uC50_F","uC50_G","uC50_H","uC50_I","uC50_J","uC100_A","uC100_B","uC100_C","uC100_D","uC100_E","uC100_F","uC100_G","uC100_H","uC100_I","uC100_J","uC255_A","uC255_B","uC255_C","uC255_D","uC255_E","uC1000_A","uC1000_B","uC1000_C","uC1000_D","uC1000_E","smac","dmac","snatip","dnatip","sInterface","dInterface","pid","severity","version","command","objectName","snatPort","dnatPort","domainOrigin","hash","policy","vendorInfo","result","objectType","cve","userAgent","parentProcessId","parentProcessName","parentProcessPath","serialNumber","reason","status","threatId","threatName","sessionType","action","responseCode","userOriginIdentityID","userImpactedIdentityID","senderIdentityID","recipientIdentityID","userOriginIdentity","userImpactedIdentity","senderIdentity","recipientIdentity","userOriginIdentityDomain","userImpactedIdentityDomain","senderIdentityDomain","recipientIdentityDomain","userOriginIdentityCompany","userImpactedIdentityCompany","senderIdentityCompany","recipientIdentityCompany","userOriginIdentityDepartment","userImpactedIdentityDepartment","senderIdentityDepartment","recipientIdentityDepartment","userOriginIdentityTitle","userImpactedIdentityTitle","senderIdentityTitle","recipientIdentityTitle","logID","sourceOrDestination","sPortOrDPort","sNetworkOrDNetwork","sLocationOrDLocation","sLocationCountryOrDLocationCountry","sLocationRegionOrDLocationRegion","sLocationCityOrDLocationCity","bytesInOut","itemsInOut","invalid"],"type":"string","allOf":[{"$ref":"#/components/schemas/FieldEnum"}]},"count":{"type":"integer","format":"int32"}},"additionalProperties":false}},"securitySchemes":{"Bearer":{"type":"http","description":"Enter your JWT token.\n\nExample: `eyJhbGciOi...`","scheme":"bearer","bearerFormat":"JWT"}}},"security":[{"Bearer":[]}]}