Skip to main content
Matrix42 Self-Service Help Center

Rest API – Aggregate Event Definitions

Attibute values can be aggregated to provide new values that represent the sum (or product) of their individual values. This article documents how to Create, delete and retrieve details about Aggregate Event Definitions (AEDs) using the FireScope REST API.


The REST API allows you to work with Aggregate Event Definitions (AEDs) in FireScope SPM using a REST client in lieu of the SPM user interface. Specifically, you can: 

  • Retrieve AED Details
  • Retrieve the AED Schema
  • Create or Update an AED
  • Delete an AED

Retrieve AED Details

To retrieve the current information about an AED in SPM, send unique query parameters in a GET request to the following URL:

http://[SPM IP address]:38050/web_services/aed?account=[Account name]&logicalgroup=[Logical Group name]&fname=[AED name]



A JSON response will be returned similar in structure to the payload for creating an AED.

Query Parameter Descriptions

Property Description Type Required
account Name of the SPM Account. String Yes
logicalgroup Name of the Logical Group String Yes
name Name of the AED. String Yes

Retrieve the AED Schema

To retrieve the full SPM schema for AEDs, send the Account name in a GET request to the following URL:http://[SPM IP address]:38050/web_services/aed?account=[Account name]&schema=true

Create or Update an AED

To create an AED, send a POST operation with a JSON document to the following URL:http://[SPM IP address]:38050/web_services/aed

Note: Don’t forget to change the domain name (localhost) to match your environment and data.

You can use the following example as a guide, but note that it may not include all optional properties.

  "account_id" : "firescope",
  "adbuilder" : "@A&@B",
  "description" : "web_servers_unavailable",
  "eventdefmembers" : [{
      "builder_symbol" : "@A",
      "memberid" : {"edge_device" : "edge1", "ci" : "ci1", "eventdef" : "ed1"}
      "builder_symbol" : "@B",
      "memberid" : {"edge_device" : "edge1", "ci" : "ci1", "eventdef" : "ed2"}
  "fs_eventdef_concat" : "&",
  "fs_eventdef_type" : {
    "perf" : 1
  "fs_groupid" : "web_servers_logicalgroup",
  "modetype" : 0,
  "priority" : 3,
  "status" : 0

Property Descriptions

Property Description Type Default Value Required
account_id Name of the SPM account. String   Yes
adbuilder The list of member variables (@A, @B, etc.) and the logic needed to perform this evaluation.Examples:@A|@B    ((@A|@B)&@C)    ((@A&@B)|(@C&@D)) String   Yes
comments Comments or other notes for the AED. String   No
custom_1 Use these custom fields to store and assign additional information that will be associated with any generated events. The custom fields are accessible for notifications as macros {EVENT.CUSTOM_1} … {EVENT.CUSTOM_5}. String   No
custom_2 String   No
custom_3 String   No
custom_4 String   No
custom_5 String   No
description Unique name of the AED. String   Yes
eventdefmembers Nested array of member EDs that make up this AED.
PropertyDescriptionTypeDefault ValueRequiredbuilder_symbolCorresponding symbol (e.g., @A) from the adbuilder.String YesmemberidA complex foreign key to an ED.Object[] Yes
Object[]   Yes
fs_eventdef_concat For simple mode, the AND (&) or OR (|) operator for evaluation. String & Yes, when modetype=0
fs_eventdef_type Classify how identified events will impact IT operations. At least one of the following flags must be enabled: avail, bus, perf, sec.
PropertyDescriptionTypeDefault ValueRequiredavailAvailability: Indicates that either this asset is offline or users will not be able to perform tasks.BooleanFALSEYesbusBusiness flag: Indicates this event directly impacts key business processes or the business will lose money if the event occurs.BooleanFALSEYesperfPerformance flag: Indicates end users will experience slowness or degraded service as a result of this event.BooleanFALSEYessecSecurity flag: Indicates sensitive data may be compromised or unauthorized actions have been identified.BooleanFALSEYes
Object   Yes
fs_groupid Name of the associated Logical Group. String   Yes
modetype 0 = Simple1 = Advanced Number 0 No
priority The severity for events generated by this definition. Severity is used in dashboards, reports and notifications. The severity level of events can determine if a notification is create and/or sent to users or not.0 = Not Classified1 = Information2 = Average3 = Warning4 = High5 = Major Number 0 Yes
resetinterval The interval in seconds after which a failed AED should be automatically reset. Number   No
status 0 = Enabled1 = Disabled Number 0 Yes
url Link to a useful KB article or process document that should be followed if this event occurs. String   No
value The read only result of the last calculation of the aggregate event definition.0 = OK1 = Failed Number 0 No

 Delete an AED

To delete an AED, send an HTTP DELETE request with the same query parameters as the GET request.See the Retrieve for the URL format and query parameter descriptions.

  • Was this article helpful?