Documentation
Table of Contents
correlation.create
§°§á§Ú§ã
object correlation.create(object/array correlations)
§¸§Ö§Û §Þ§Ö§ä§à§Õ §Õ§à§Ù§Ó§à§Ý§ñ? §ã§ä§Ó§à§â§ð§Ó§Ñ§ä§Ú §ß§à§Ó? §Ü§à§â§Ö§Ý§ñ§è??.
§¸§Ö§Û §Þ§Ö§ä§à§Õ §Õ§à§ã§ä§å§á§ß§Ú§Û §Ý§Ú§ê§Ö §Õ§Ý§ñ §Ü§à§â§Ú§ã§ä§å§Ó§Ñ§é?§Ó §ä§Ú§á§å §³§å§á§Ö§â§Ñ§Õ§Þ?§ß?§ã§ä§â§Ñ§ä§à§â. §¥§à§Ù§Ó§à§Ý§Ú §ß§Ñ §Ó§Ú§Ü§Ý§Ú§Ü §Þ§Ö§ä§à§Õ§å §Þ§à§Ø§ß§Ñ §ã§Ü§Ñ§ã§å§Ó§Ñ§ä§Ú §Ó §ß§Ñ§Ý§Ñ§ê§ä§å§Ó§Ñ§ß§ß§ñ§ç §â§à§Ý? §Ü§à§â§Ú§ã§ä§å§Ó§Ñ§é§Ñ. §¥§Ú§Ó. §²§à§Ý? §Ü§à§â§Ú§ã§ä§å§Ó§Ñ§é§Ñ §Õ§Ý§ñ §à§ä§â§Ú§Þ§Ñ§ß§ß§ñ §Õ§à§Õ§Ñ§ä§Ü§à§Ó§à? ?§ß§æ§à§â§Þ§Ñ§è??.
§±§Ñ§â§Ñ§Þ§Ö§ä§â§Ú
(object/array) §¬§à§â§Ö§Ý§ñ§è?? §Õ§Ý§ñ §ã§ä§Ó§à§â§Ö§ß§ß§ñ.
§°§Ü§â?§Þ §ã§ä§Ñ§ß§Õ§Ñ§â§ä§ß§Ú§ç §Ó§Ý§Ñ§ã§ä§Ú§Ó§à§ã§ä§Ö§Û §Ü§à§â§Ö§Ý§ñ§è??, §Þ§Ö§ä§à§Õ §á§â§Ú§Û§Þ§Ñ? §ä§Ñ§Ü? §á§Ñ§â§Ñ§Þ§Ö§ä§â§Ú.
| §±§Ñ§â§Ñ§Þ§Ö§ä§â | §´§Ú§á | §°§á§Ú§ã |
|---|---|---|
| operations (§à§Ò§à§Ó¡¯§ñ§Ù§Ü§à§Ó§à) |
§Þ§Ñ§ã§Ú§Ó | §¬§à§â§Ö§Ý§ñ§è?§Û§ß? §à§á§Ö§â§Ñ§è?? §Õ§Ý§ñ §ã§ä§Ó§à§â§Ö§ß§ß§ñ §Ü§à§â§Ö§Ý§ñ§è??. |
| filter (§à§Ò§à§Ó¡¯§ñ§Ù§Ü§à§Ó§à) |
§à§Ò¡¯?§Ü§ä | §°§Ò¡¯?§Ü§ä §Ü§à§â§Ö§Ý§ñ§è?? §æ?§Ý§î§ä§â §Õ§Ý§ñ §Ü§à§â§Ö§Ý§ñ§è??. |
§±§à§Ó§Ö§â§ß§å§ä? §Ù§ß§Ñ§é§Ö§ß§ß§ñ
(object) §±§à§Ó§Ö§â§ä§Ñ? §à§Ò¡¯?§Ü§ä, §ë§à §Þ?§ã§ä§Ú§ä§î ?§Õ§Ö§ß§ä§Ú§æ?§Ü§Ñ§ä§à§â§Ú §ã§ä§Ó§à§â§Ö§ß§Ú§ç §Ü§à§â§Ö§Ý§ñ§è?§Û §å §Ó§Ý§Ñ§ã§ä§Ú§Ó§à§ã§ä? correlationids. §±§à§â§ñ§Õ§à§Ü §á§à§Ó§Ö§â§ß§Ö§ß§Ú§ç ?§Õ§Ö§ß§ä§Ú§æ?§Ü§Ñ§ä§à§â?§Ó §Ó?§Õ§á§à§Ó?§Õ§Ñ? §á§à§â§ñ§Õ§Ü§å §á§Ö§â§Ö§Õ§Ñ§ß§Ú§ç §Ü§à§â§Ö§Ý§ñ§è?§Û.
§±§â§Ú§Ü§Ý§Ñ§Õ§Ú
§³§ä§Ó§à§â?§ä§î §ß§à§Ó§å §Ü§à§â§Ö§Ý§ñ§è?§ð §ä§Ö§Ô?§Ó §á§à§Õ??
§³§ä§Ó§à§â?§ä§î §Ü§à§â§Ö§Ý§ñ§è?§ð §Ù§Ñ §Õ§à§á§à§Þ§à§Ô§à§ð §Þ§Ö§ä§à§Õ§å §à§è?§ß§Ü§Ú ??/§¡§¢§°? §Ù §à§Õ§ß??§ð §å§Þ§à§Ó§à§ð §ä§Ñ §à§Õ§ß??§ð §à§á§Ö§â§Ñ§è??§ð. §©§Ñ §Ù§Ñ§Þ§à§Ó§é§å§Ó§Ñ§ß§ß§ñ§Þ §Ü§à§â§Ö§Ý§ñ§è?§ñ §Ò§å§Õ§Ö §Ó§Ó?§Þ§Ü§ß§Ö§ß§Ñ.
§©§Ñ§á§Ú§ä:
{
"jsonrpc": "2.0",
"method": "correlation.create",
"params": {
"name": "new event tag correlation",
"filter": {
"evaltype": 0,
"conditions": [
{
"type": 1,
"tag": "ok"
}
]
},
"operations": [
{
"type": 0
}
]
},
"auth": "343baad4f88b4106b9b5961e77437688",
"id": 1
}§£?§Õ§á§à§Ó?§Õ§î:
§£§Ú§Ü§à§â§Ú§ã§ä§Ñ§ß§ß§ñ §ã§á§Ö§è?§Ñ§Ý§î§ß§à§Ô§à §æ?§Ý§î§ä§â§Ñ §Ó§Ú§â§Ñ§Ù?§Ó
§³§ä§Ó§à§â?§ä§î §Ü§à§â§Ö§Ý§ñ§è?§ð, §ñ§Ü§Ñ §Ó§Ú§Ü§à§â§Ú§ã§ä§à§Ó§å§Ó§Ñ§ä§Ú§Þ§Ö §ã§á§Ö§è?§Ñ§Ý§î§ß§å §å§Þ§à§Ó§å §æ?§Ý§î§ä§â§Ñ. ?§Õ§Ö§ß§ä§Ú§æ?§Ü§Ñ§ä§à§â§Ú §æ§à§â§Þ§å§Ý "A" §Ñ§Ò§à "B" §Ó§Ú§Ò§â§Ñ§ß§à §Õ§à§Ó?§Ý§î§ß§à. §´§Ú§á §å§Þ§à§Ó§Ú §Ò§å§Õ§Ö ?§¤§â§å§á§Ñ §ç§à§ã§ä?§Ó? §Ù §à§á§Ö§â§Ñ§ä§à§â§à§Þ ?<>?.
§©§Ñ§á§Ú§ä:
{
"jsonrpc": "2.0",
"method": "correlation.create",
"params": {
"name": "new host group correlation",
"description": "a custom description",
"status": 0,
"filter": {
"evaltype": 3,
"formula": "A or B",
"conditions": [
{
"type": 2,
"operator": 1,
"formulaid": "A"
},
{
"type": 2,
"operator": 1,
"formulaid": "B"
}
]
},
"operations": [
{
"type": 1
}
]
},
"auth": "343baad4f88b4106b9b5961e77437688",
"id": 1
}§£?§Õ§á§à§Ó?§Õ§î:
§¥§Ú§Ó§Ú§ã§î §ä§Ñ§Ü§à§Ø
§¥§Ø§Ö§â§Ö§Ý§à
CCorrelation::create() §Ó ui/include/classes/api/services/CCorrelation.php.