This endpoint creates a new AIE (Advanced Intelligence Engine) rule. The caller must supply all
required fields; unlike the PATCH endpoint, optional fields that are omitted receive system
defaults rather than inheriting from an existing record.

Prerequisites / Authorization:

• The caller must hold the AIERuleMgmt privilege.
• Requests without a valid bearer token are rejected with 401.
• Requests with a valid token but without the required privilege are rejected with 403.

MINIMUM REQUIRED FIELDS TO CREATE AN AIE RULE:

Mandatory Top-Level Fields:

• information.ruleName: non-empty; minimum 3 characters, maximum 100 characters.
• classification.classificationId: non-zero integer; must reference an existing classification.
• ruleBlocks: at least one rule block is required (unlike PATCH where ruleBlocks may be omitted).
• commonEvent.commonEventId: required when syncWithRuleName is false. May be omitted when syncWithRuleName is true or not provided.

Mandatory Fields Per Rule Block (RuleBlocks array):

• ruleBlockType: Type discriminator (e.g., "LogObserved", "ThresholdObserved")
• blockId: Sequential ID starting from 0 (0, 1, 2)
• dataSource.dataSourceId: Must be 1 (DataProcessorLogs) or 101 (AdvancedIntelligenceEngineEvents)
• filter_MsgFilters: At least one message filter required (cannot be empty)
  • Each filter requires fieldFilters array
  • Each fieldFilter requires:
    • fieldFilterType: The field type being filtered
    • filterMode: "FilterIn" (0) or "FilterOut" (1)
    • fieldFilterValues: Array of filter values (required unless filtering null values)

Additional Mandatory Fields by Rule Block Type:

• ThresholdObserved / ThresholdNotObservedCompound / ThresholdNotObservedScheduled:

  • groupByFields: At least one groupBy field required
  • thresholdFields: At least one threshold definition required
    • field: Field to count (must be supported threshold field)
    • thresholdCount: Count threshold (must be > 0)

• UniqueValuesObserved / UniqueValuesNotObservedCompound / UniqueValuesNotObservedScheduled:

  • groupByFields: At least one groupBy field required
  • uniqueValues: Exactly one unique value field required
    • field: Field to track unique values
    • count: Occurrence count (must be > 0)

• WhiteList:

  • groupByFields: At least one groupBy field required
  • linkedDataBlocks: At least one linked data block required
    • Each linked block must have groupByFields

• Statistical:

  • schedule: Required schedule configuration
    • timeZoneId: Valid timezone ID (e.g., "India Standard Time")
    • evaluationTimeSpan: Required unless autofrequency = true
  • groupByFields: Recommended for statistical calculations

• Trend:

  • linkedDataBlocks: At least one linked data block required
  • schedule: Required schedule configuration
    • timeZoneId: Valid timezone ID
    • evaluationTimeSpan: Required unless autofrequency = true

• NotObservedScheduled Types (LogNotObservedScheduled, ThresholdNotObservedScheduled, UniqueValuesNotObservedScheduled):

  • schedule: Required schedule configuration
    • timeZoneId: Valid timezone ID
    • evaluationTimeSpan: Required unless autofrequency = true
  • filter_DistinctOccurrence: Required
    • fieldFilterType: Must be a supported distinct occurrence filter

For Rule Blocks with BlockId > 0 (Blocks 1 and 2):

• ruleBlockRelationship: Required
  • ruleBlockA_GUID: GUID of the preceding block
  • ruleBlockB_GUID: GUID of the current block
  • durationOffsetSeconds: Must be 0 for first relationship
  • durationSeconds: Must be ≥ 60 for subsequent blocks
  • fieldRelationships: Array of field links between blocks
    • ruleBlockA_Field: Must exist in preceding block's groupByFields
    • ruleBlockB_Field: Must exist in current block's groupByFields
  • joinType: Valid values: "0" (Inner), "1" (LeftOuter), "2" (RightOuter), "3" (FullOuter)

FIELDS WITH DEFAULT VALUES (Optional):

When the following fields are omitted, the system assigns these default values:

• riskRating: Defaults to "None" (0)
• fpp (False Positive Probability): Defaults to "None" (0)
• edf (Event Duration Field): Defaults to "None" (0)
• runtimePriority: Defaults to "Normal" (1)
• dataSegregationMode: Defaults to "None" (0)
• enableEventForwarding: Defaults to true
• alarmOnEventOccurrence: Defaults to false
• alarmAutoDrillDown: Defaults to false
• decimalPlaces: Defaults to 2
• enableSuppression: Defaults to false
• suppressionMultiple: Defaults to 1 when enableSuppression = true
• syncWithRuleName: Defaults to true (system creates linked Common Event)
• expirationDate: Defaults to null (no expiration)
• information.briefDesc: Defaults to empty string
• information.additionalDetails: Defaults to empty string
• information.ruleGroup: Defaults to empty string
• notify.persons: Defaults to empty array (no person notifications)
• notify.groups: Defaults to empty array (no group notifications)
• ruleSet: Defaults to null (no rule set assignment)
• schedule.autofrequency: Defaults to false
• schedule.monitoringIntervals: Defaults to null (no day/time restrictions)
• filter_LogSources: Defaults to empty array
• filter_LogSourceLists: Defaults to empty array
• filter_DayAndTime: Defaults to empty array
• filter_MsgFiltersIn: Defaults to empty array
• filter_MsgFiltersOut: Defaults to empty array
• aieSummaryFields: Defaults to empty array

DATA SOURCE-SPECIFIC VALIDATIONS:

When dataSourceId = 101 (Advanced Intelligence Engine Events / AIEE):

• filter_LogSources must be empty or null (not applicable for AIEE)
• filter_LogSourceLists must be empty or null (not applicable for AIEE)
• Reason: AIEE analyzes events generated by other AIE rules, not raw log sources

When dataSourceId = 1 (Data Processor Logs):

• filter_LogSources and filter_LogSourceLists are both supported
• Cannot use both simultaneously - choose one: individual log sources OR log source lists

IMPORTANT VALIDATION RULES AND DEPENDENCIES:

GroupBy vs Unique Values Conflict:

• For UniqueValuesObserved blocks: The unique value field CANNOT be the same as any groupBy field
• Example: If groupByFields contains "UserLogin", uniqueValues.field cannot be "UserLogin"
• Reason: Grouping and counting unique values on the same field creates logical inconsistency

GroupBy Field Restrictions:

• Cannot include duplicate fields within the same block
• Cannot use both Entity and RootEntity when dataSegregationMode is enabled
• Cannot use SLocationCountry, SLocationRegion, and SLocation together (choose only one)

Data Segregation Impact:

• When dataSegregationMode = "logSourceEntity" (1) or "logSourceRootEntity" (2):
  • NotObservedScheduled types are NOT supported
  • Cannot explicitly include Entity or RootEntity in groupByFields
  • The system automatically adds Entity or RootEntity to grouping logic

AIE Summary Fields Restrictions:

• Cannot contain duplicate fields
• Cannot contain fields that are in groupByFields or related to groupByFields
• Example: If groupByFields contains "UserOrigin", aieSummaryFields cannot contain "UserLogin" (related field)

DETAILED FIELD-LEVEL GUIDANCE:

For comprehensive field-level documentation including:

• Message Filter Validation rules
• Field Filter Sequence behavior
• Enum field accepted values
• Complete RuleBlock configuration details
• Type-specific properties per rule block type
• Log Source filter rules
• Day and Time filter format requirements

Please refer to the PATCH /aie/rules/{ruleId} endpoint documentation, which provides
detailed guidance applicable to both POST and PATCH operations. The primary difference
is that PATCH allows partial updates with field inheritance, while POST requires
complete specification of mandatory fields with system defaults for optional fields.

Key sections in PATCH documentation relevant to POST:

• RuleBlocks Configuration (detailed type-specific requirements)
• Message Filter Validation (filter_MsgFilters structure)
• Field Filter Sequence (ordering behavior)
• Enum Fields (accepted values for riskRating, fpp, edf, runtimePriority, dataSegregationMode)
• Day and Time Filters (format requirements)
• Log Source Filter Rules (mutual exclusivity)

Rule Name Synchronization (syncWithRuleName):

• When syncWithRuleName = true: the system automatically prefixes the rule name with "AIE: " (5 characters) when creating the linked Alarm Rule. The effective stored name must therefore not exceed 95 characters (100 − 5 prefix characters). The same prefix budget applies to briefDesc (≤ 250 characters effective) and additionalDetails (≤ 1995 characters effective).
• When syncWithRuleName = false: commonEvent.commonEventId must be supplied so the rule can be linked to an existing Common Event.

Alarm Configuration:

• alarmAutoDrillDown may only be true when alarmOnEventOccurrence is also true. Setting alarmAutoDrillDown = true while alarmOnEventOccurrence = false is rejected with 400.

Event Forwarding:

• If enableEventForwarding = false, the following fields will be ignored:
  • notify
  • decimalPlaces
  • alarmOnEventOccurrence
  • alarmAutoDrillDown

Event Suppression (eventSuppression):

• If suppressionMultiple is supplied, enableSuppression must also be provided.
• When enableSuppression = true and suppressionMultiple is provided, the value must be a positive integer between 1 and 9999 (inclusive).

Expiration Date:

• Must be a future date/time (UTC). Dates in the past are rejected with 400.
• Accepted formats: yyyy-MM-dd, yyyy-MM-ddTHH:mm:ss, yyyy-MM-dd HH:mm:ss.fff.

Text Field Lengths:

• information.ruleName: 3–100 characters.
• information.briefDesc: ≤ 255 characters (≤ 250 when syncWithRuleName = true).
• information.additionalDetails: ≤ 2000 characters (≤ 1995 when syncWithRuleName = true).
• information.ruleGroup: ≤ 100 characters.

RuleBlocks — overview:
A rule may contain 1 to 3 rule blocks that together define its detection logic. Block IDs must be sequential starting at 0 (i.e. 0; 0,1; or 0,1,2).

Allowed block types per composition:

• Single block (1 block): LogObserved, LogNotObservedScheduled, ThresholdObserved, ThresholdNotObservedScheduled, UniqueValuesObserved, UniqueValuesNotObservedScheduled, WhiteList, Statistical, Trend. The compound *NotObserved types (LogNotObservedCompound, ThresholdNotObservedCompound, UniqueValuesNotObservedCompound) are NOT valid as the sole block.
• Two-block rule: first block must be LogObserved, ThresholdObserved, UniqueValuesObserved, or WhiteList. Second block may be any NotObservedCompound or Observed type.
• Three-block rule: first block same as above; second block must be an Observed type (not NotObserved); third block may be any NotObservedCompound or Observed type.

DB-backed validation:
After structural validation passes, the service additionally verifies that referenced entities exist in the database (classification, common event, rule set, notification persons/groups, and rule block fields). Failures at this stage are returned as 400 with a descriptive message, or as 500 if the created rule cannot be reloaded after persistence.