Create v2¶
POST /api/v1/alert_policy/add_v2
Overview¶
Create an alert strategy. v2 supports synchronously updating associated monitors/intelligent monitors/intelligent inspections/SLOs, and security checks.
Body Request Parameters¶
| Parameter Name | Type | Required | Description |
|---|---|---|---|
| name | string | Y | Alert strategy name Allow Empty: False |
| desc | string | Description Allow Empty: False Allow Empty String: True Max Length: 256 |
|
| openPermissionSet | boolean | Enable custom permission configuration (default false: not enabled). After enabling, the operational permissions of this rule are based on permissionSet. Allow Empty: False |
|
| permissionSet | array | Operational permission configuration, can be configured with (roles (except owner), member UUIDs, team UUIDs) Example: ['wsAdmin', 'acnt_xxxx', 'group_yyyy'] Allow Empty: False |
|
| checkerUUIDs | array | Monitor/Intelligent Monitor/Intelligent Inspection/SLO UUIDs (newly added in the 2024-12-11 iteration) Example: ['rule_xxx', 'monitor_xxx'] Allow Empty: False |
|
| securityRuleUUIDs | array | Security Check (CSPM, SIEM, ABA) UUIDs Example: ['srul_xxx', 'srul_xxx', 'srul_xxx'] Allow Empty: False |
|
| ruleTimezone | str | Y | Alert strategy timezone Example: Asia/Shanghai Allow Empty: False |
| alertOpt | json | Alert settings Allow Empty: False |
|
| alertOpt.aggType | string | Alert aggregation type. If not passed, the old version logic is used. (Newly added in the 2024-12-25 iteration) Allow Empty: True Optional values: ['byFields', 'byCluster', 'byAI', 'byCustom'] |
|
| alertOpt.ignoreOK | boolean | Advanced configuration: normal level only generates events, does not send notifications (whether to ignore OK notifications). (Newly added field in 2025-10-22) Allow Empty: False |
|
| alertOpt.alertType | string | Alert strategy notification type, level (status)/member (member), default is level. Allow Empty: False Optional values: ['status', 'member'] |
|
| alertOpt.alertTarget | array | Trigger actions. Note the trigger time, parameter handling. Example: [{'name': 'Notification Configuration1', 'targets': [{'to': ['acnt_xxxx32'], 'status': 'critical', 'tags': {'pod_name': ['coredns-7769b554cf-w95fk']}, 'upgradeTargets': [{'to': ['acnt_xxxx32'], 'duration': 600}, {'to': ['group_xxxx32'], 'duration': 6000}]}], 'crontabDuration': 600, 'crontab': '0 9 * * 0,1,2,3,4'}, {'name': 'Notification Configuration2', 'targets': [{'status': 'error', 'to': ['group_xxxx32'], 'upgradeTargets': [{'to': ['acnt_xxxx32'], 'duration': 600}, {'to': ['group_xxxx32'], 'duration': 6000}]}], 'customDateUUIDs': ['ndate_xxxx32'], 'customStartTime': '09:30:10', 'crontabDuration': 600}] Allow Empty: False |
|
| alertOpt.silentTimeout | integer | Repeat alert configuration Allow Empty: False |
|
| alertOpt.silentTimeoutByStatusEnable | boolean | Whether to enable repeat alerts by level. Default is false, using silentTimeout configuration. Allow Empty: False |
|
| alertOpt.silentTimeoutByStatus | array | Repeat alerts by level, minimum alert interval configuration by level. Allow Empty: False |
|
| alertOpt.aggInterval | integer | Y | Alert aggregation interval, in seconds. 0 means no aggregation. Allow Empty: False $minValue: 0 $maxValue: 1800 |
| alertOpt.aggFields | array | Aggregation field list. An empty list [] means "Aggregation rule: all". df_monitor_checker_id: Monitor/Intelligent Inspection/SLO, df_dimension_tags: Detection dimension, df_label: Label, CLUSTER: Intelligent aggregation.Example: ['CLUSTER'] Allow Empty: False |
|
| alertOpt.aggLabels | array | Label value list when aggregating by label. Only takes effect if df_label is specified in aggFields.Allow Empty: False |
|
| alertOpt.aggClusterFields | array | Field list for intelligent aggregation. Only takes effect if CLUSTER is specified in aggFields. Optional values: "df_title": Title, "df_message": Content.Example: ['df_title'] Allow Empty: False |
|
| alertOpt.aggSendFirst | boolean | Whether the first alert is sent directly when aggregating. (Newly added parameter in the 2025-09-03 iteration) Allow Empty: False |
Supplementary Parameter Description¶
Data Description.
1. alertOpt Parameter Description
| Parameter Name | type | Required | Description |
|---|---|---|---|
| name | string | Required | Rule name |
| desc | string | Description | |
| type | string | Required | Checker type |
| ruleTimezone | string | Required | Alert strategy timezone (newly added parameter in the 2024-01-31 iteration) |
| alertOpt | Dict | Required | Alert settings |
| alertOpt.silentTimeout | integer | Minimum alert interval. How long the same alert will not be sent again (i.e., alert silence duration). Unit: seconds. 0/null means send only once (i.e., infinite interval). | |
| alertOpt.silentTimeoutByStatusEnable | boolean | Whether to enable repeat alerts by level configuration. | |
| alertOpt.silentTimeoutByStatus | array | Minimum alert interval by level, unit: seconds. Use security_ prefix for security check levels. |
|
| alertOpt.aggInterval | integer | Alert aggregation interval, unit: seconds. 0 means no aggregation. Range [0,1800]. | |
| alertOpt.aggFields | array | Aggregation field list. An empty list [] means "Aggregation rule: all". df_monitor_checker_id: Monitor/Intelligent Inspection/SLO, df_dimension_tags: Detection dimension, df_label: Label, CLUSTER: Intelligent aggregation, or when aggType=byCustom it represents custom aggregation fields. |
|
| alertOpt.aggLabels | array | Label value list when aggregating by label. Only takes effect if df_label is specified in aggFields. |
|
| alertOpt.aggClusterFields | array | Field list for intelligent aggregation. Only takes effect if CLUSTER is specified in aggFields. Optional values: "df_title": Title, "df_message": Content. |
|
| alertOpt.aggSendFirst | boolean | Whether the first alert is sent directly when aggregating. (Newly added parameter in the 2025-09-03 iteration) | |
| alertOpt.aggType | string | Default not passed: old version logic. byFields: Rule aggregation, byCluster: Intelligent aggregation, byAI: AI aggregation, byCustom: Rule aggregation - custom. (Newly added field in the 2024-12-25 iteration) |
|
| alertOpt.alertTarget | Array[Dict] | Alert actions | |
| alertOpt.alertType | string | Alert strategy notification type, level (status)/member (member). Default is level. (Newly added in the 2024-11-06 iteration) | |
| alertOpt.ignoreOK | boolean | Advanced configuration: normal level only generates events, does not send notifications (whether to ignore OK notifications). (Newly added field in 2025-10-22) | |
| openPermissionSet | boolean | Whether to enable custom permission configuration. Default is false. (Newly added in the 2024-11-06 iteration) | |
| permissionSet | array | Operational permission configuration. (Newly added in the 2024-11-06 iteration) | |
| checkerUUIDs | array | Associated monitor/intelligent monitor/intelligent inspection/SLO UUIDs. (Newly added in the 2024-12-11 iteration) | |
| securityRuleUUIDs | array | Associated security check (CSPM, SIEM, ABA) UUIDs. (Newly added in the 2025-05-14 iteration) |
1.1 alertOpt.aggType Parameter Description
2024-12-25
Alert aggregation types:
null: No aggregation
byFields: Rule aggregation
byCluster: Intelligent aggregation
byAI: AI aggregation
Since the old data structure does not have the aggType field and instead determines the aggregation type based on the aggFields content, the following compatibility handling will be performed after adding the aggType field:
When aggType is specified, aggregation is performed according to the method specified by aggType.
When aggType is not specified or aggType is None (following the old logic):
If aggFields contains "CLUSTER", aggregation is performed using the intelligent aggregation method.
If aggFields does not contain "CLUSTER", aggregation is performed using the rule aggregation method.
Derived rules:
Specifying aggInterval=0 or aggInterval=null still means "no aggregation".
When aggType="byCluster" is specified, it is no longer necessary to pass "CLUSTER" in aggFields (whether passed or not has no effect).
When aggType="byFields" is specified but aggFields contains "CLUSTER", "CLUSTER" will be ignored (i.e., aggType has higher priority).
When aggType="byCustom" is specified, aggregation is performed according to the custom fields in aggFields.
2. When the alert strategy is of level type, alertOpt.alertTarget Parameter Description
| key | Type | Required | Description |
|---|---|---|---|
| name | string | Configuration name | |
| targets | Array[dict] | Required | Notification target configuration (Note the position of this field when the alert strategy is of level/member type) |
| crontab | String | When selecting a recurring time period, the start Crontab (Crontab syntax) | |
| crontabDuration | integer | When selecting a recurring time period, the duration from the start of the Crontab (in seconds) | |
| customDateUUIDs | Array[String] | When selecting a custom time period, the UUID list of custom notification dates. Example: ['ndate_xxxx32', 'ndate_xxxx32']. Refer to (Monitoring - Alert Strategies - Custom Notification Dates API) for custom notification dates. | |
| customStartTime | String | When selecting a custom time period, the daily start time, format: HH |
|
| customDuration | integer | When selecting a custom time period, the duration from the customStartTime (in seconds) |
3. When the alert strategy is of member type, alertOpt.alertTarget Parameter Description
| key | Type | Required | Description |
|---|---|---|---|
| alertTarget[#] | dict | Element of the alertTarget list | |
| alertTarget[#].name | string | Configuration name | |
| alertTarget[#].crontab | String | When selecting a recurring time period, the start Crontab (Crontab syntax) | |
| alertTarget[#].crontabDuration | integer | When selecting a recurring time period, the duration from the start of the Crontab (in seconds) | |
| alertTarget[#].customDateUUIDs | Array[String] | When selecting a custom time period, the UUID list of custom notification dates. Example: ['ndate_xxxx32', 'ndate_xxxx32']. Refer to (Monitoring - Alert Strategies - Custom Notification Dates API) for custom notification dates. | |
| alertTarget[#].customStartTime | String | When selecting a custom time period, the daily start time, format: HH |
|
| alertTarget[#].customDuration | integer | When selecting a custom time period, the duration from the customStartTime (in seconds) | |
| alertTarget[#].alertInfo | Array[dict] | Required | Notification-related information configuration for the member-type alert strategy. (Newly added in the 2024-11-27 iteration) |
4. When the alert strategy is of member type, alertOpt.alertTarget.alertInfo Parameter Description
| key | Type | Required | Description |
|---|---|---|---|
| alertInfo[#] | string | Element of the alertInfo list | |
| alertInfo[#].name | string | Configuration name | |
| alertInfo[#].targets | Array[dict] | Required | Notification target configuration (Note the position of this field when the alert strategy is of level/member type) |
| alertInfo[#].filterString | string | When alertType is member, this field is used. The raw filter condition string. (Newly added in the 2024-11-27 iteration) |
|
| alertInfo[#].memberInfo | array | When alertType is member, this field is used (team UUIDs, member UUIDs). Example: [group_xxxx, acnt_xxxx]. (Newly added in the 2024-11-27 iteration) |
5. Time Configuration Related Notes
If selecting a recurring time period, the crontab and crontabDuration fields are required.
If selecting a custom time period, the customDateUUIDs, customDuration, and customStartTime fields are required.
If selecting other times, the crontab, crontabDuration, customDateUUIDs, customStartTime, and customDuration fields should not be passed.
Note: Each alert strategy will have one notification rule for other times, i.e., the fallback notification target without time configuration.
6. Notification Target Field targets Description
When alertType is status, the targets position is alertOpt.alertTarget.targets.
When alertType is member, the targets position is alertOpt.alertTarget.alertInfo.targets.
targets is a list, with each internal element being a dict. The internal field descriptions are as follows:
| key | Type | Required | Description |
|---|---|---|---|
| to | Array[String] | Required | Notification targets/members/teams. Example: [group_xxxx, acnt_xxxx, notify_xxxx]. (When alertType is member, only notification targets and fixed fields email, sms (SaaS version supports SMS) can be selected. Example: [email, notify_xxxx]. (Newly added in the 2024-11-06 iteration) |
| status | Enum | Required | The event status value that needs to send alerts. Multiple statuses can be separated by commas. All means all. For non-security check types, the status values are: fatal, critical, error, warning, nodata, info. For security check types, the status values are: critical, high, medium, low, info. (Newly added security check enumeration values in the 2025-05-14 iteration) |
| df_source | Enum | When the status needs to be a security check status, df_source must be specified as security. Default not passed means non-security check status. (Newly added in the 2025-05-14 iteration) |
|
| upgradeTargets | Array | Upgrade notification for each alert configuration status. | |
| tags | dict | Filter conditions | |
| filterString | dict | Raw filter condition string. Can replace tags. filterString has higher priority than tags. (Newly added in the 2024-11-27 iteration) |
7. Notification Target Field upgradeTargets Description
<br/>
When alertType is status, the targets position is alertOpt.alertTarget.targets.upgradeTargets.
When alertType is member, the targets position is alertOpt.alertTarget.alertInfo.targets.upgradeTargets.
7.1 upgradeTargets is a list, with each internal element being a dict. The internal field descriptions are as follows:
| key | Type | Required | Description |
|---|---|---|---|
| to | Array[String] | Required | Notification targets/members/teams. Example: [group_xxxx, acnt_xxxx, notify_xxxx]. (When alertType is member, only members and teams can be selected. (Newly added in the 2024-11-06 iteration) |
| duration | integer | Duration. The event of this level continuously triggers an upgrade notification after the duration. | |
| toWay | Array[String] | Used when alertType is member. Only notification targets and fixed fields email, sms (SaaS version supports SMS) can be selected. Example: [email, notify_xxxx]. (Newly added in the 2024-11-06 iteration) |
8. Operational Permission Configuration Parameter Description
| Parameter Name | type | Description |
|---|---|---|
| openPermissionSet | boolean | Whether to enable custom permission configuration. Default is false. |
| permissionSet | array | Operational permission configuration |
8.1 permissionSet, openPermissionSet Field Description (Newly added fields in the 2024-06-26 iteration):
When openPermissionSet is enabled, only the workspace owner and the roles, teams, and members configured in the permissionSet can edit/enable/disable/delete.
When openPermissionSet is disabled (default), the delete/enable/disable/edit permissions follow the original interface edit/enable/disable/delete permissions.
The permissionSet field can be configured with role UUIDs (wsAdmin, general, readOnly, role_xxxxx), team UUIDs (group_yyyy), and member UUIDs (acnt_xxx).
Example of the permissionSet field:
9. alertOpt[#].silentTimeoutByStatus Parameter Description
| Parameter Name | type | Description |
|---|---|---|
| silentTimeoutByStatus[#] | dict | Element of the silentTimeoutByStatus list |
| silentTimeoutByStatus[#].status | boolean | For non-security check types, the status values are: fatal, critical, error, warning, nodata, info. For security check types, the status values are: security_critical, security_high, security_medium, security_low, security_info. |
| silentTimeoutByStatus[#].silentTimeout | integer | Minimum alert interval. How long the same alert will not be sent again (i.e., alert silence duration). Unit: seconds. 0/null means send only once (i.e., infinite interval). |
Example of the silentTimeoutByStatus field:
[
{
"status": "fatal",
"silentTimeout": 600
},
{
"status": "critical,error",
"silentTimeout": 900
},
{
"status": "security_high",
"silentTimeout": 600
},
]
Request Example¶
curl 'https://openapi.guance.com/api/v1/alert_policy/add' \
-H 'DF-API-KEY: <DF-API-KEY>' \
-H 'Content-Type: application/json;charset=UTF-8' \
--data-raw '{"name":"jj_test","ruleTimezone":"Asia/Shanghai","alertOpt":{"alertTarget":[{"name":"Notification Configuration1","targets":[{"status":"critical","tags":{"pod_name":["coredns-7769b554cf-w95fk"]},"to":["acnt_xxxx32"]}],"crontabDuration":600,"crontab":"0 9 * * 0,1,2,3,4"},{"name":"Notification Configuration2","targets":[{"status":"error","to":["group_xxxx32"]}],"customDateUUIDs":["ndate_xxxx32"],"customStartTime":"09:30:10","customDuration":600},{"targets":[{"status":"warning","to":["notify_xxxx32"]}]}],"silentTimeout":21600,"aggInterval":120,"aggFields":["df_monitor_checker_id"]}}' \
--compressed
Response¶
{
"code": 200,
"content": {
"alertOpt": {
"aggFields": [
"df_monitor_checker_id"
],
"aggInterval": 120,
"alertTarget": [
{
"crontab": "0 9 * * 0,1,2,3,4",
"crontabDuration": 600,
"name": "Notification Configuration1",
"targets": [
{
"status": "critical",
"tags": {
"pod_name": [
"coredns-7769b554cf-w95fk"
]
},
"to": [
"acnt_xxxx32"
]
}
]
},
{
"customDateUUIDs": [
"ndate_xxxx32"
],
"customDuration": 600,
"customStartTime": "09:30:10",
"name": "Notification Configuration2",
"targets": [
{
"status": "error",
"to": [
"group_xxxx32"
]
}
]
},
{
"targets": [
{
"status": "warning",
"to": [
"notify_xxxx32"
]
}
]
}
],
"silentTimeout": 21600
},
"createAt": 1719373984,
"creator": "wsak_xxxx32",
"declaration": {
"asd": "aa,bb,cc,1,True",
"asdasd": "dawdawd",
"business": "aaa",
"fawf": "afawf",
"organization": "64fe7b4062f74d0007b46676"
},
"deleteAt": -1,
"id": null,
"name": "jj_test",
"ruleTimezone": "Asia/Shanghai",
"score": 0,
"status": 0,
"updateAt": 1719373984,
"updator": "wsak_xxxx32",
"uuid": "altpl_xxxx32",
"workspaceUUID": "wksp_xxxx32"
},
"errorCode": "",
"message": "",
"success": true,
"traceId": "TRACE-148B6846-6180-4594-BD26-8A2077F0E911"
}