Correlation - Get Correlation Rule Test

URI

https://164.99.19.131:8443/SentinelRESTServices/correlation/ruletest/{id}

Supported Methods

GET

This API gets the status and results of a currently running or recently finished correlation rule test specified by {id}.

Authentication

Authentication Types

X-SAML

Sentinel Permissions Needed

manageCorrelation
_adminRole_

URL Parameters

None.

Success Codes

200 OK
204 No Content

Fault Codes

Response Data

Object type: Correlation rule test object
Correlation rule test object along with status of rule test and trigger events
Field	Description
Cardinality	Number of strings and related structures held in memory by the rule.
endTime	End time for event search.
EPSCapacity	The processing time this rule consumes relative to the capacity of the engine.
errorMessage	Error message if any. Will get in case of stauts Stopped and Error.
EventRefCount	Number of events held in memory by the rule.
eventsProcessed	Number of events processed.
LastEventTime	Event time of the last event that triggered the Correlation rule while testing.
luceneFilter	Lucene expression for event search.
OutputRate	The number of times the rule has fired relative to the events processed.
percentComplete	Current level of percentage of overall test.
progressPhase	Phase the test is currently in. e.g. 1-Searching event, 2-Testing rule.
rulelg	Correlation expression to be tested.
startTime	Begin time for event search.
status	Current state of test. e.g. Running, Stopped, Completed, Error.
testFinishedAt	Time, rule test finished at.
testId	ID generated for this test.
testStartedAt	Time, rule test started at.
TotalProcessingTime	Total time taken for processing events.
triggers	List of events triggering this correlation rule.

Sample Request

GET correlation/ruletest/84BEC330-C575-102E-A876-000FFEE403E9

Sample Response for application/json

Status: 200

{"rulelg":"filter(((e.Severity &gt;= 0)))","startTime":1316410041962,"endTime":1316496441966,"luceneFilter":"sev:[0 TO 5]","testId":"84BEC330-C575-102E-A876-000FFEE403E9","progressPhase":2,"percentComplete":0,"status":"stopped","eventsProcessed":20,"LastEventTime":1316494234030,"testStartedAt":1316496470908,"TotalProcessingTime":0,"EPSCapacity":0,"OutputRate":100,"testFinishedAt":1316496496251,"Cardinality":0,"EventRefCount":0,"errorMessage":"Correlation rule test was aborted: rule fire limit was reached.","triggers":[[{"obssvcname":"Server","RefId01":"0","estzmin":"20","rv172":"9BCC3D40-C571-102E-8E14-000FFEE403E9","rv171":"6E1CCA35-4BD4-102D-91CD-000C2907C76D","xdasprov":"0","CustomerId":"101000","rv145":"Sentinel","st":"A","vul":"0","estzdiy":"263","dmac":"00-0F-FE-E4-03-E9","sn":"bvishal-test-sles1164","estzdiw":"3","rv1":"0","rv77":"0","sres":"EventDataSyncPolicy","estzdim":"20","agent":"Audit","msg":"Created table evt_rpt_1422613491 in SIEM database on host localhost, DB platform: PostgreSQL, DB version: 9.0, Columns in table: 15, TableSpace: rpt_data1.","xdasoutcome":"0","repip":"164.99.135.46","rv41":"blr.novell.com","obsip":"164.99.135.46","repdom":"blr.novell.com","obsmac":"00-0F-FE-E4-03-E9","pn":"Internal","dhn":"bvishal-test-sles1164","repassetid":"0","dt":"1316494233481","sev":"1","res":"Server","rn":"bvishal-test-sles1164","xdasdetail":"0","xdasclass":"3","rv192":"System Events","estzmonth":"8","sun":"System","id":"9BCC3D40-C571-102E-8EC6-000FFEE403E9","estz":"Asia\/Kolkata","dip":"164.99.135.46","rv32":"SIEM","rv121":"9BCC3D40-C571-102E-8D71-000FFEE403E9","rv164":"1324339200000","src":"9BCC3D40-C571-102E-8C14-000FFEE403E9","xdastaxname":"XDAS_AE_CREATE_DATA_ITEM","xdasreg":"0","rv99":"0","xdasid":"0","repmac":"00-0F-FE-E4-03-E9","evtgrpid":"9BCC3D40-C571-102E-8E1C-000FFEE403E9","obsdom":"blr.novell.com","evt":"CreateTable","xdasoutcomename":"XDAS_OUT_SUCCESS","rv150":"EventDataSyncPolicy","piu":"101000","obsassetid":"0","estzhour":"10"}],[{"obssvcname":"Server","RefId01":"0","estzmin":"20","rv172":"9BCC3D40-C571-102E-8E14-000FFEE403E9","rv171":"6E1CCA35-4BD4-102D-91CD-000C2907C76D","xdasprov":"0","CustomerId":"101000","rv145":"Sentinel","st":"A","vul":"0","estzdiy":"263","dmac":"00-0F-FE-E4-03-E9","sn":"bvishal-test-sles1164","estzdiw":"3","rv1":"0","rv77":"0","sres":"EventDataSyncPolicy","estzdim":"20","agent":"Audit","msg":"Granted permission ALL to user dbauser on table evt_rpt_1422613491 in SIEM database on host localhost, DB platform: PostgreSQL, DB version: 9.0.","xdasoutcome":"0","repip":"164.99.135.46","rv41":"blr.novell.com","obsip":"164.99.135.46","repdom":"blr.novell.com","obsmac":"00-0F-FE-E4-03-E9","pn":"Internal","dhn":"bvishal-test-sles1164","repassetid":"0","dt":"1316494233483","sev":"1","res":"Server","rn":"bvishal-test-sles1164","xdasdetail":"0","xdasclass":"1","rv192":"System Events","estzmonth":"8","sun":"System","id":"9BCC3D40-C571-102E-8EC7-000FFEE403E9","estz":"Asia\/Kolkata","dip":"164.99.135.46","rv32":"SIEM","rv121":"9BCC3D40-C571-102E-8D71-000FFEE403E9","rv164":"1324339200000","src":"9BCC3D40-C571-102E-8C14-000FFEE403E9","xdastaxname":"XDAS_AE_GRANT_TRUST_ACCESS","xdasreg":"0","rv99":"0","xdasid":"7","repmac":"00-0F-FE-E4-03-E9","evtgrpid":"9BCC3D40-C571-102E-8E1C-000FFEE403E9","obsdom":"blr.novell.com","evt":"GrantTablePermission","xdasoutcomename":"XDAS_OUT_SUCCESS","rv150":"EventDataSyncPolicy","piu":"101000","obsassetid":"0","estzhour":"10"}]]}&#10;

Back to main API page