ceprule_get
Retrieve Zabbix 8.0+ CEP rules that match problem events by name, tags, severity, host, or time window, and inspect their filters, windows, and operations.
Instructions
Retrieve CEP rules (Zabbix 8.0+ complex event processing): the rules that match incoming problem events by name, tags, severity, host, host group or time period, collect them in a time or count window (window_type 0 none, 1 simple window, 2 cause / symptom, 3 simple window once, 4 pattern match) and run operations on them (close, discard, set or change severity, suppress, add / set / rename / remove tags, copy as a new event, close the window). Use selectFilter, selectWindow and selectOperations in extra_params for the full rule; 'error' carries the server's last processing error. Zabbix 8.0 deprecates event correlation (correlation_*) in favour of these rules.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of records to return. | |
| filter | No | Return only results whose properties exactly match the given values (a single value or a list of values per key). Example: {"status": 0} or {"status": [0, 1]}. Only these keys are accepted: cep_ruleid, name, window_type, stop, sortorder, status. Text properties cannot be filtered; use 'search' for them. | |
| output | No | Properties of the ceprule object to return. Pass 'extend' for all, 'count' for the number of matches only, or a list of property names. Default when omitted: cep_ruleid, name, status, window_type, stop, sortorder. Properties: cep_ruleid, description, error, name, sortorder, status, stop, window_type. | |
| search | No | Return results whose string properties contain the given pattern (case-insensitive; '*' is a wildcard when searchWildcardsEnabled is true). Example: {"name": "web"}. Only these keys are accepted: name, description, error. | |
| server | No | Target Zabbix server. Available: default. Defaults to 'default' if omitted. | |
| raw_json | No | Strips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true. | |
| sortfield | No | Sort by one or more of: cep_ruleid, name, stop, sortorder, status (a list for several; pair with 'sortorder'). No other property is sortable. | |
| sortorder | No | Sort order: 'ASC' or 'DESC'. | |
| cep_ruleids | No | Return only CEP rules with the given IDs. | |
| countOutput | No | Return the count of matching rules instead of the records. | |
| extra_params | No | Other native ceprule.get parameters, merged into the request as-is. Sub-object selects (value 'extend', 'count' or a list of property names): selectFilter, selectOperations, selectWindow. Any other key is refused here, because Zabbix would silently ignore it. For a parameter you are sure exists on your release but is not listed, use zabbix_raw_api_call. |