notification:rule : Notification rule object.

Notification rule specifies the server to which this rule is applicable, certain conditions (i.e. triggers), and the action to be taken when the rule is hit. It also specifies where this rule engine is configured to be run.

Object Reference

References to notification:rule are object references.

The name part of a notification rule reference has the following components:

  • The name of the notification rule

Example: notification:rule/ZG5zLm5ldHdvcmtfdmlldyQxMTk:rule1

Restrictions

The object does not support the following operations:

  • Scheduling
  • CSV export

The object cannot be managed on Cloud Platform members.

Fields

These fields are actual members of the object; thus, they can be requested by using _return_fields, if the fields are readable.

The basic version of the object contains the field(s): event_type, name, notification_action, notification_target.

The following fields are required to create this object:

Field Notes
event_type  
expression_list  
name  
notification_action  
notification_target  

all_members

all_members

Determines whether the notification rule is applied on all members or not. When this is set to False, the notification rule is applied only on selected_members.

Type

Bool.

Create

The default value is True.

Search

The field is not available for search.

comment

comment

The notification rule descriptive comment.

Type

String.

Create

The default value is empty.

Search

The field is available for search via

  • ‘:=’ (case insensitive search)
  • ‘=’ (exact equality)
  • ‘~=’ (regular expression)

disable

disable

Determines whether a notification rule is disabled or not. When this is set to False, the notification rule is enabled.

Type

Bool.

Create

The default value is False.

Search

The field is not available for search.

enable_event_deduplication

enable_event_deduplication

Determines whether the notification rule for event deduplication is enabled. Note that to enable event deduplication, you must set at least one deduplication field.

Type

Bool.

Create

The default value is False.

Search

The field is not available for search.

enable_event_deduplication_log

enable_event_deduplication_log

Determines whether the notification rule for the event deduplication syslog is enabled.

Type

Bool.

Create

The default value is False.

Search

The field is not available for search.

event_deduplication_fields

event_deduplication_fields

The list of fields that must be used in the notification rule for event deduplication.

Type

Enum values array.

Valid values are:
  • DISCOVERER
  • DUID
  • DXL_TOPIC
  • IP_ADDRESS
  • MAC_ADDRESS
  • NETWORK
  • NETWORK_VIEW
  • OPERATION_TYPE
  • QUERY_FQDN
  • QUERY_NAME
  • QUERY_TYPE
  • RPZ_POLICY
  • RPZ_TYPE
  • RULE_ACTION
  • RULE_CATEGORY
  • RULE_SEVERITY
  • RULE_SID
  • SOURCE_IP
  • SOURCE_PORT

Create

The default value is empty.

Search

The field is not available for search.

event_deduplication_lookback_period

event_deduplication_lookback_period

The lookback period for the notification rule for event deduplication.

Type

Unsigned integer.

Create

The default value is 600.

Search

The field is not available for search.

event_priority

event_priority

Event priority.

Type

String.

Create

The default value is NORMAL.

Search

The field is available for search via

  • ‘:=’ (case insensitive search)
  • ‘=’ (exact equality)
  • ‘~=’ (regular expression)

event_type

event_type

The notification rule event type.

Type

String.

Valid values are:
  • ANALYTICS_DNS_TUNNEL
  • DB_CHANGE_DHCP_FIXED_ADDRESS_IPV4
  • DB_CHANGE_DHCP_FIXED_ADDRESS_IPV6
  • DB_CHANGE_DHCP_NETWORK_IPV4
  • DB_CHANGE_DHCP_NETWORK_IPV6
  • DB_CHANGE_DHCP_RANGE_IPV4
  • DB_CHANGE_DHCP_RANGE_IPV6
  • DB_CHANGE_DNS_DISCOVERY_DATA
  • DB_CHANGE_DNS_HOST_ADDRESS_IPV4
  • DB_CHANGE_DNS_HOST_ADDRESS_IPV6
  • DB_CHANGE_DNS_RECORD
  • DB_CHANGE_DNS_ZONE
  • DHCP_LEASES
  • DNS_RPZ
  • DXL_EVENT_SUBSCRIBER
  • IPAM
  • SCHEDULE
  • SECURITY_ADP

Create

The field is required on creation.

Search

The field is available for search via

  • ‘=’ (exact equality)

Notes

The event_type is part of the base object.

expression_list

expression_list

The notification rule expression list.

Type

A/An Notification rule expression operand struct array.

Create

The field is required on creation.

Search

The field is not available for search.

name

name

The notification rule name.

Type

String.

Values with leading or trailing white space are not valid for this field.

Create

The field is required on creation.

Search

The field is available for search via

  • ‘:=’ (case insensitive search)
  • ‘=’ (exact equality)
  • ‘~=’ (regular expression)

Notes

The name is part of the base object.

The name cannot be updated.

notification_action

notification_action

The notification rule action is applied if expression list evaluates to True.

Type

String.

Valid values are:
  • CISCOISE_PUBLISH
  • CISCOISE_QUARANTINE
  • RESTAPI_TEMPLATE_INSTANCE

Create

The field is required on creation.

Search

The field is available for search via

  • ‘=’ (exact equality)

Notes

The notification_action is part of the base object.

notification_target

notification_target

The notification target.

Type

String.

This field supports nested return fields as described here.

Create

The field is required on creation.

Search

The field is available for search via

  • ‘=’ (exact equality)

Notes

The notification_target is part of the base object.

publish_settings

publish_settings

The publish settings.

Type

A/An Cisco ISE publish settings struct struct.

Create

The default value is empty.

Search

The field is not available for search.

Notes

publish_settings is associated with the field use_publish_settings (see use flag).

scheduled_event

scheduled_event

Schedule setting that must be specified if event_type is SCHEDULE.

Type

A/An Schedule Setting struct.

Create

The default value is empty.

Search

The field is not available for search.

selected_members

selected_members

The list of the members on which the notification rule is applied.

Type

String array.

Create

The default value is empty.

Search

The field is not available for search.

template_instance

template_instance

The notification REST template instance.

Type

A/An Notification REST template instance struct.

Create

The default value is empty.

Search

The field is not available for search.

use_publish_settings

use_publish_settings

Use flag for: publish_settings

Type

Bool.

Create

The default value is False.

Search

The field is not available for search.

Function Calls

trigger_outbound

Test notification rules by user created event.

This function does not support multiple object matches when called as part of an atomic insertion operation.

Input fields

event_text ( String. ). This parameter is mandatory. The event to trigger notification rule in a JSON text string.

Output fields

None

Fields List

Field Type Req R/O Base Search
all_members Bool N N N N/A
comment String N N N : = ~
disable Bool N N N N/A
enable_event_deduplication Bool N N N N/A
enable_event_deduplication_log Bool N N N N/A
event_deduplication_fields [Enum] N N N N/A
event_deduplication_lookback_period Unsigned int N N N N/A
event_priority String N N N : = ~
event_type String Y N Y =
expression_list [struct] Y N N N/A
name String Y N Y : = ~
notification_action String Y N Y =
notification_target String Y N Y =
publish_settings struct N N N N/A
scheduled_event struct N N N N/A
selected_members [String] N N N N/A
template_instance struct N N N N/A
use_publish_settings Bool N N N N/A