Skip to main content

Using the Integration API to Configure the Filter Matcher

Manually configuring a large number of filter conditions can create administrative overhead, especially when filters and values change frequently. The Integration API provides a convenient way to reorder, add, update, or delete filter conditions and groups.

Use the Integration API to automate these configuration tasks as needed.

Get the Integration ID

Send a GET request to:

GET : https://<servername>/integrations/api/v1/integrations

The response returns a list of all installed integrations. Locate the integration that has a type_id of FilterMatcher, and note its associated id.

For example, the Filter Matcher integration ID might be 2.

[
  {
    "id": 2,
    "name": "FilterMatcher1",
    "type_id": "FilterMatcher",
    "version": "1.0",
    "config": {
      "single_instance_only": true,
      "category": "workflow",
      "description": "Evaluate a set of CEvent filter against a CEvent and set a value",
      "display_name": "Filter Matcher",
      "type_id": "FilterMatcher",
      "version": "1.0",
...
	}
]

Get the Current Filter Matcher Configuration

Send a GET request to retrieve the current Filter Matcher configuration:

GET : https://<servername>/integrations/api/v1/integrations/<id>

For example:

GET : https://<servername>/integrations/api/v1/integrations/2

The response contains the current Filter Matcher configuration, including all configured filter groups and filter conditions.

Modify the Configuration

In the response payload, locate the inputs section. Update this section as needed to add groups, reorder, add, delete, or modify filter conditions.

For example, to add a new filter group (Group2) containing two filter conditions, modify the inputs section as shown in the following example:

From:

"inputs": [
    {
      "key": "controls",
      "value": {
        "onGroupMatch": false
      }
    },
    {
      "key": "filterGroups",
      "value": [
        {
          "name": "Group1",
          "priority": 1,
          "groupitems": [
            {
              "value": "MyProdHost",
              "filter": "source == '10.0.0.1'"
            },
            {
              "value": "MyDevHost",
              "filter": "source == '10.0.0.2'"
            }
          ],
          "destination": "custom_info.hostname",
          "defaultvalue": "unknown",
          "matchbehaviour": "first",
          "hasDefaultValue": true,
          "isDefaultMatcher": true
        }
      ]
    }
  ],

To:

"inputs": [
    {
      "key": "controls",
      "value": {
        "onGroupMatch": false
      }
    },
    {
      "key": "filterGroups",
      "value": [
        {
          "name": "Group1",
          "priority": 1,
          "groupitems": [
            {
              "value": "MyProdHosy",
              "filter": "source == '10.0.0.1'"
            },
            {
              "value": "MyDevHost",
              "filter": "source == '10.0.0.2'"
            }
          ],
          "destination": "custom_info.hostname",
          "defaultvalue": "unknown",
          "matchbehaviour": "first",
          "hasDefaultValue": true,
          "isDefaultMatcher": true
        },
        {
          "name": "Group2",
          "priority": 2,
          "groupitems": [
            {
              "value": "MyLondonProdHost",
              "filter": "source == '192.168.0.1' AND custom_info.location == 'LON'"
            },
            {
              "value": "MyLondonDevHost",
              "filter": "source == '192.168.0.2' AND custom_info.location == 'LON'"
            }
          ],
          "destination": "custom_info.hostname",
          "defaultvalue": "unknown",
          "matchbehaviour": "first",
          "hasDefaultValue": true,
          "isDefaultMatcher": true
        } 
      ]
    }
  ],

GroupItems (filter conditions) have two attributes:

  • Filter – The CEvent filter expression to evaluate.

  • Value – The value to assign when the filter evaluates to true.

Update the Configuration

Send a PUT request with the modified payload:

PUT : https://<servername>/integrations/api/v1/integrations/{id}

The integration does not need to be restarted after the configuration is updated. The next time the matchFilter action runs, it uses the updated configuration.

In this section: