Unavailable. Nobody can download this version any more, with elm or with the Lamdera compiler: github.com/vanhecke/celmex is gone (deleted or private); Software Heritage not asked yet (this run's --swh-calls were used up); no fork with the same repo name found; no cached copy. Use another version.
Cortex correlation rules — XQL queries that produce alerts on a schedule or in real time.
A SearchArgs with no filters, sort, pagination, or
timeframe.
A single correlation rule.
Top-level envelope returned by get. Not wrapped in the
standard reply.
POST /public_api/v1/correlations/get
Response is top-level {objects_count, objects, objects_type} — NOT wrapped
in the usual reply envelope.
Arguments to insert. items is the raw request_data array
of correlation-rule objects. The live API requires a much larger field set
than the published OpenAPI spec marks as optional (every scheduling /
suppression / MITRE field plus a few undocumented ones), so the SDK does
not type the item shape — callers supply the JSON they want sent. Pass an
existing rule_id on an item to upsert that rule instead of inserting a
new one.
Outcome of an insert call. addedObjects lists the newly
created rule IDs and the server's status string for each; updatedObjects
lists upserts; errors collects per-item failures the server flagged
without aborting the batch.
One row in the InsertResult addedObjects /
updatedObjects arrays — the rule ID the server assigned and the matching
human-readable status it returned.
One row in the InsertResult errors array — the
zero-based index of the offending item in the request and the server's
human-readable rejection reason.
POST /public_api/v1/correlations/insert — insert or upsert a batch of correlation rules. The response carries the rule IDs of every rule the server touched, which a test can use to delete what it inserted.
Arguments to delete. filters is AND-ed server-side; pass
multiple entries to narrow the match further. Build entries via
deleteFilter so the wire shape stays an SDK detail.
One {field, operator, value} predicate accepted by
correlations/delete. The delete endpoint accepts the operator set
(EQ, IN, GTE, LTE) over a closed field set including name,
severity, xql_query, is_enabled, and the alert / scheduling /
suppression keys; the SDK does not validate either — the server will
reject invalid combinations.
Build a DeleteFilter from the raw triple. The
operator should already be one of the API's uppercase keywords (EQ,
IN, GTE, LTE); the encoder writes it through verbatim.
Outcome of a delete call. objectsCount is the number of
rules the server removed; objects is the list of rule IDs it removed.
Arguments to
get. All fields are optional; passdefaultSearchArgsfor an unfiltered request.extrais merged last intorequest_dataand overrides any SDK-generated key on collision.