ceprule_get
Retrieve complex event processing (CEP) rules to match problem events by name, tags, severity, host, or time, collect them in windows, and run operations like close, discard, or set severity.
Instructions
Retrieve CEP rules (Zabbix 8.0+ complex event processing): the rules that match incoming problem events by name, tags, severity, host, host group or time period, collect them in a time or count window (window_type 0 none, 1 simple window, 2 cause / symptom, 3 simple window once, 4 pattern match) and run operations on them (close, discard, set or change severity, suppress, add / set / rename / remove tags, clone, set cause, close the window). Use selectFilter, selectWindow and selectOperations in extra_params for the full rule; 'error' carries the server's last processing error. Not documented in the API reference yet.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of records to return. | |
| filter | No | Return only results whose properties exactly match the given values (a single value or a list of values per key). Example: {"status": 0} or {"status": [0, 1]}. Only these keys are accepted: cep_ruleid, name, window_type, stop, sortorder, status. Text properties cannot be filtered; use 'search' for them. | |
| output | No | Properties of the ceprule object to return. Pass 'extend' for all, 'count' for the number of matches only, or a comma-separated list of property names. Default when omitted: cep_ruleid, name, status, window_type, stop, sortorder. Properties: cep_ruleid, description, error, name, sortorder, status, stop, window_type. | |
| search | No | Return results whose string properties contain the given pattern (case-insensitive; '*' is a wildcard when searchWildcardsEnabled is true). Example: {"name": "web"}. Only these keys are accepted: name, description, error. | |
| server | No | Target Zabbix server. Available: default. Defaults to 'default' if omitted. | |
| raw_json | No | Strips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true. | |
| sortfield | No | Sort by one or more of: cep_ruleid, name, stop, sortorder, status (comma-separated for several; pair with 'sortorder'). No other property is sortable. | |
| sortorder | No | Sort order: 'ASC' or 'DESC'. | |
| cep_ruleids | No | Return only CEP rules with the given IDs. | |
| countOutput | No | Return the count of matching rules instead of the records. | |
| extra_params | No | Other native ceprule.get parameters, merged into the request as-is. Sub-object selects (value 'extend', 'count' or a list of property names): selectFilter, selectOperations, selectWindow. Any other key is refused here, because Zabbix would silently ignore it. For a parameter you are sure exists on your release but is not listed, use zabbix_raw_api_call. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |