POST correlation/parseSubrule
{"rulelg":"filter(((e.Severity = 1)) AND ((e.EventName = \"Test\")) AND not(isnull(e.SubResource)))"}
{"isAnd":"true","isTrigger":"false","duration":"0","count":"0","expressions":[{"tag":"e.Severity","operator":"=","value":"1"},{"tag":"e.EventName","operator":"=","value":"\"Test\""},{"tag":"e.SubResource","operator":"not isnull"}]}
POST correlation/parseSubrule
{"rulelg":"filter(((e.XDASClass = 0) AND (e.XDASIdentifier = 0) AND ((e.XDASOutcome = 1) OR (e.XDASOutcome = 2))))"}
{"isAnd":"false","isTrigger":"false","duration":"0","count":"0","expressions":[{"xdasclass":"0","xdasidentifier":"0","xdasoutcomes":["1","2"]}]}
POST correlation/parseSubrule
{"rulelg":"filter(e.sev = 1 or (not e.sev > 1))"}
{"nonStructuredRuleLG":"filter(((e.Severity = 1) or ( not (e.Severity > 1))))","isAnd":"false","isTrigger":"false","duration":"0","count":"0"}