CEP windows can react when a PROBLEM event occurs, enters a window, is evicted, or when the window closes. However, they cannot directly react when an existing event changes from OPEN to CLOSED.

This limits topology-based suppression. For example:

1. An edge switch problem opens a CEP window.
2. AP problems sharing the same topology tag enter that window and are suppressed.
3. The edge switch recovers several hours later, while one or more APs remain down. (for example power recovers in building for switch, but not APs)
4. The remaining AP problems should now be unsuppressed.

The edge recovery changes the existing CEP event to CLOSED, but does not provide an execution point that can close the window. A separate CEP rule cannot handle the recovery, and it could not remove suppression owned by the original rule anyway.

Requested functionality

Add a CEP execution point such as When event closed or When event resolved.

When an event contained in one or more CEP windows changes to CLOSED, the relevant rule should be able to:

• evaluate operation conditions against the closed event;
• execute operations such as Close window;
• subsequently execute Window closed operations for the remaining events.

For the topology example, an operation conditioned on role=edge could close the window when the edge event recovers. A Window closed operation from the same rule could then unsuppress every still-open AP problem.

The recovery should not need to be represented by a new synthetic PROBLEM event.

Expected result

CEP can keep downstream problems suppressed for as long as the upstream problem remains open, regardless of elapsed time. When that specific upstream event closes, the rule can immediately close the corresponding window and act on the remaining downstream problems.