From 98359c7ca3897a8ca9da4fd7a5432a860a37bad0 Mon Sep 17 00:00:00 2001 From: byrsapty Date: Wed, 29 Jul 2026 16:32:18 +0300 Subject: [PATCH] Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report Closes the parsing gap the README explicitly called out (no D-Link parsing, no ZTE ONU alarms) plus adds BDCOM GPON and expands Juniper coverage (DDoS, PSU/memory/ASIC hardware faults, LACP/BGP/SNMP, config commit). 58 new rules across 5 vendors, wired into Network Equipment Parsing's stage 0 ahead of the generic_critical_severity fallback. Where the same real-world event is reported by multiple vendors (dying_gasp, onu_offline, optical_low_power, cli_login/cli_logout, config_saved, interface_link_state, lag_state_change), rules share one event_type value so dashboards can aggregate across vendors, same normalization approach as accelppp_interface. Built directly from the user's CSV signature report, not from real device log samples - each rule's description says so explicitly. `when` conditions use plain substring/contains matching on the report's own pattern text to keep classification robust; regex field extraction is only added where the source format is unambiguous. Passed offline checks (JSON validity, every pipeline-referenced rule resolves to a file, all regex patterns compile). Live compilation against a running Graylog instance - which caught 2 real bugs during the dashboard/stream fixes earlier this session - could NOT be completed: the test container went unreachable mid-session. Re-run install-graylog.sh once it's back up to confirm these compile before relying on them. --- pipelines/pipeline1_network.json | 4 ++-- rules/rule27_bdcom_epon_dying_gasp.json | 5 +++++ rules/rule28_bdcom_epon_onu_config_error.json | 5 +++++ rules/rule29_bdcom_epon_hal_driver_error.json | 5 +++++ rules/rule30_bdcom_epon_onu_info_failed.json | 5 +++++ rules/rule31_bdcom_epon_onu_authenticated.json | 5 +++++ rules/rule32_bdcom_epon_onu_registered.json | 5 +++++ rules/rule33_bdcom_epon_onu_deregistered.json | 5 +++++ rules/rule34_bdcom_epon_oam_status.json | 5 +++++ rules/rule35_bdcom_olt_cli_login.json | 5 +++++ rules/rule36_bdcom_epon_config_saved.json | 5 +++++ rules/rule37_bdcom_gpon_config_saved.json | 5 +++++ rules/rule38_bdcom_epon_interface_link_state.json | 5 +++++ rules/rule39_bdcom_gpon_dying_gasp.json | 5 +++++ rules/rule40_bdcom_gpon_onu_offline.json | 5 +++++ rules/rule41_bdcom_gpon_onu_activate_failed.json | 5 +++++ rules/rule42_bdcom_gpon_onu_disabled.json | 5 +++++ rules/rule43_bdcom_gpon_onu_discovered.json | 5 +++++ rules/rule44_bdcom_gpon_onu_activated.json | 5 +++++ rules/rule45_bdcom_gpon_onu_deactivated.json | 5 +++++ rules/rule46_zte_gpon_dying_gasp.json | 5 +++++ rules/rule47_zte_gpon_onu_signal_degraded.json | 5 +++++ rules/rule48_zte_gpon_onu_lan_los.json | 5 +++++ rules/rule49_zte_epon_dying_gasp.json | 5 +++++ rules/rule50_zte_epon_onu_offline.json | 5 +++++ rules/rule51_zte_gpon_olt_pon_los.json | 5 +++++ rules/rule52_zte_optical_low_power.json | 5 +++++ rules/rule53_zte_power_over_voltage.json | 5 +++++ rules/rule54_zte_alarm_cleared.json | 5 +++++ rules/rule55_zte_cli_login.json | 5 +++++ rules/rule56_zte_cli_logout.json | 5 +++++ rules/rule57_juniper_ddos_violation_set.json | 5 +++++ rules/rule58_juniper_ddos_violation_clear.json | 5 +++++ rules/rule59_juniper_psu_failure.json | 5 +++++ rules/rule60_juniper_memory_parity_error.json | 5 +++++ rules/rule61_juniper_optical_low_power.json | 5 +++++ rules/rule62_juniper_qsfp_eeprom_failed.json | 5 +++++ rules/rule63_juniper_lacp_timeout.json | 5 +++++ rules/rule64_juniper_link_down.json | 5 +++++ rules/rule65_juniper_lag_state_change.json | 5 +++++ rules/rule66_juniper_snmp_auth_violation.json | 5 +++++ rules/rule67_juniper_asic_error.json | 5 +++++ rules/rule68_juniper_bgp_session_reset.json | 5 +++++ rules/rule69_juniper_bgp_addr_not_found.json | 5 +++++ rules/rule70_juniper_ntpd_resource_error.json | 5 +++++ rules/rule71_juniper_ssh_too_many_failures.json | 5 +++++ rules/rule72_juniper_config_commit.json | 5 +++++ rules/rule73_juniper_mgmt_login.json | 5 +++++ rules/rule74_dlink_system_reboot.json | 5 +++++ rules/rule75_dlink_optical_alarm.json | 5 +++++ rules/rule76_dlink_optical_recovered.json | 5 +++++ rules/rule77_dlink_interface_link_state.json | 5 +++++ rules/rule78_dlink_lag_state_change.json | 5 +++++ rules/rule79_dlink_gbic_detected.json | 5 +++++ rules/rule80_dlink_ntp_sync.json | 5 +++++ rules/rule81_dlink_management_ip_changed.json | 5 +++++ rules/rule82_dlink_telnet_login.json | 5 +++++ rules/rule83_dlink_telnet_logout.json | 5 +++++ rules/rule84_dlink_config_saved.json | 5 +++++ 59 files changed, 292 insertions(+), 2 deletions(-) create mode 100644 rules/rule27_bdcom_epon_dying_gasp.json create mode 100644 rules/rule28_bdcom_epon_onu_config_error.json create mode 100644 rules/rule29_bdcom_epon_hal_driver_error.json create mode 100644 rules/rule30_bdcom_epon_onu_info_failed.json create mode 100644 rules/rule31_bdcom_epon_onu_authenticated.json create mode 100644 rules/rule32_bdcom_epon_onu_registered.json create mode 100644 rules/rule33_bdcom_epon_onu_deregistered.json create mode 100644 rules/rule34_bdcom_epon_oam_status.json create mode 100644 rules/rule35_bdcom_olt_cli_login.json create mode 100644 rules/rule36_bdcom_epon_config_saved.json create mode 100644 rules/rule37_bdcom_gpon_config_saved.json create mode 100644 rules/rule38_bdcom_epon_interface_link_state.json create mode 100644 rules/rule39_bdcom_gpon_dying_gasp.json create mode 100644 rules/rule40_bdcom_gpon_onu_offline.json create mode 100644 rules/rule41_bdcom_gpon_onu_activate_failed.json create mode 100644 rules/rule42_bdcom_gpon_onu_disabled.json create mode 100644 rules/rule43_bdcom_gpon_onu_discovered.json create mode 100644 rules/rule44_bdcom_gpon_onu_activated.json create mode 100644 rules/rule45_bdcom_gpon_onu_deactivated.json create mode 100644 rules/rule46_zte_gpon_dying_gasp.json create mode 100644 rules/rule47_zte_gpon_onu_signal_degraded.json create mode 100644 rules/rule48_zte_gpon_onu_lan_los.json create mode 100644 rules/rule49_zte_epon_dying_gasp.json create mode 100644 rules/rule50_zte_epon_onu_offline.json create mode 100644 rules/rule51_zte_gpon_olt_pon_los.json create mode 100644 rules/rule52_zte_optical_low_power.json create mode 100644 rules/rule53_zte_power_over_voltage.json create mode 100644 rules/rule54_zte_alarm_cleared.json create mode 100644 rules/rule55_zte_cli_login.json create mode 100644 rules/rule56_zte_cli_logout.json create mode 100644 rules/rule57_juniper_ddos_violation_set.json create mode 100644 rules/rule58_juniper_ddos_violation_clear.json create mode 100644 rules/rule59_juniper_psu_failure.json create mode 100644 rules/rule60_juniper_memory_parity_error.json create mode 100644 rules/rule61_juniper_optical_low_power.json create mode 100644 rules/rule62_juniper_qsfp_eeprom_failed.json create mode 100644 rules/rule63_juniper_lacp_timeout.json create mode 100644 rules/rule64_juniper_link_down.json create mode 100644 rules/rule65_juniper_lag_state_change.json create mode 100644 rules/rule66_juniper_snmp_auth_violation.json create mode 100644 rules/rule67_juniper_asic_error.json create mode 100644 rules/rule68_juniper_bgp_session_reset.json create mode 100644 rules/rule69_juniper_bgp_addr_not_found.json create mode 100644 rules/rule70_juniper_ntpd_resource_error.json create mode 100644 rules/rule71_juniper_ssh_too_many_failures.json create mode 100644 rules/rule72_juniper_config_commit.json create mode 100644 rules/rule73_juniper_mgmt_login.json create mode 100644 rules/rule74_dlink_system_reboot.json create mode 100644 rules/rule75_dlink_optical_alarm.json create mode 100644 rules/rule76_dlink_optical_recovered.json create mode 100644 rules/rule77_dlink_interface_link_state.json create mode 100644 rules/rule78_dlink_lag_state_change.json create mode 100644 rules/rule79_dlink_gbic_detected.json create mode 100644 rules/rule80_dlink_ntp_sync.json create mode 100644 rules/rule81_dlink_management_ip_changed.json create mode 100644 rules/rule82_dlink_telnet_login.json create mode 100644 rules/rule83_dlink_telnet_logout.json create mode 100644 rules/rule84_dlink_config_saved.json diff --git a/pipelines/pipeline1_network.json b/pipelines/pipeline1_network.json index fb48f7e..63e592d 100644 --- a/pipelines/pipeline1_network.json +++ b/pipelines/pipeline1_network.json @@ -1,5 +1,5 @@ { "title": "Network Equipment Parsing", - "description": "Parses Juniper and BDCOM/OLT-style syslog, plus universal critical-severity fallback", - "source": "pipeline \"Network Equipment Parsing\"\nstage 0 match either\n rule \"juniper_ntp_unreachable\";\n rule \"juniper_ssh_login_success\";\n rule \"juniper_ssh_login_failed_tagged\";\n rule \"juniper_ssh_failed_password\";\n rule \"juniper_ui_configuration_error\";\n rule \"juniper_chassis_alarm\";\n rule \"olt_privilege_mode\";\n rule \"olt_cli_logout\";\n rule \"olt_ip_arp_moved\";\n rule \"olt_config_write\";\n rule \"generic_critical_severity\";\nend" + "description": "Parses Juniper, BDCOM EPON/GPON OLT, ZTE OLT, and D-Link syslog, plus a universal critical-severity fallback", + "source": "pipeline \"Network Equipment Parsing\"\nstage 0 match either\n rule \"juniper_ntp_unreachable\";\n rule \"juniper_ssh_login_success\";\n rule \"juniper_ssh_login_failed_tagged\";\n rule \"juniper_ssh_failed_password\";\n rule \"juniper_ui_configuration_error\";\n rule \"juniper_chassis_alarm\";\n rule \"olt_privilege_mode\";\n rule \"olt_cli_logout\";\n rule \"olt_ip_arp_moved\";\n rule \"olt_config_write\";\n rule \"bdcom_epon_dying_gasp\";\n rule \"bdcom_epon_onu_config_error\";\n rule \"bdcom_epon_hal_driver_error\";\n rule \"bdcom_epon_onu_info_failed\";\n rule \"bdcom_epon_onu_authenticated\";\n rule \"bdcom_epon_onu_registered\";\n rule \"bdcom_epon_onu_deregistered\";\n rule \"bdcom_epon_oam_status\";\n rule \"bdcom_olt_cli_login\";\n rule \"bdcom_epon_config_saved\";\n rule \"bdcom_epon_interface_link_state\";\n rule \"bdcom_gpon_config_saved\";\n rule \"bdcom_gpon_dying_gasp\";\n rule \"bdcom_gpon_onu_offline\";\n rule \"bdcom_gpon_onu_activate_failed\";\n rule \"bdcom_gpon_onu_disabled\";\n rule \"bdcom_gpon_onu_discovered\";\n rule \"bdcom_gpon_onu_activated\";\n rule \"bdcom_gpon_onu_deactivated\";\n rule \"zte_gpon_dying_gasp\";\n rule \"zte_gpon_onu_signal_degraded\";\n rule \"zte_gpon_onu_lan_los\";\n rule \"zte_epon_dying_gasp\";\n rule \"zte_epon_onu_offline\";\n rule \"zte_gpon_olt_pon_los\";\n rule \"zte_optical_low_power\";\n rule \"zte_power_over_voltage\";\n rule \"zte_alarm_cleared\";\n rule \"zte_cli_login\";\n rule \"zte_cli_logout\";\n rule \"juniper_ddos_violation_set\";\n rule \"juniper_ddos_violation_clear\";\n rule \"juniper_psu_failure\";\n rule \"juniper_memory_parity_error\";\n rule \"juniper_optical_low_power\";\n rule \"juniper_qsfp_eeprom_failed\";\n rule \"juniper_lacp_timeout\";\n rule \"juniper_link_down\";\n rule \"juniper_lag_state_change\";\n rule \"juniper_snmp_auth_violation\";\n rule \"juniper_asic_error\";\n rule \"juniper_bgp_session_reset\";\n rule \"juniper_bgp_addr_not_found\";\n rule \"juniper_ntpd_resource_error\";\n rule \"juniper_ssh_too_many_failures\";\n rule \"juniper_config_commit\";\n rule \"juniper_mgmt_login\";\n rule \"dlink_system_reboot\";\n rule \"dlink_optical_alarm\";\n rule \"dlink_optical_recovered\";\n rule \"dlink_interface_link_state\";\n rule \"dlink_lag_state_change\";\n rule \"dlink_gbic_detected\";\n rule \"dlink_ntp_sync\";\n rule \"dlink_management_ip_changed\";\n rule \"dlink_telnet_login\";\n rule \"dlink_telnet_logout\";\n rule \"dlink_config_saved\";\n rule \"generic_critical_severity\";\nend" } diff --git a/rules/rule27_bdcom_epon_dying_gasp.json b/rules/rule27_bdcom_epon_dying_gasp.json new file mode 100644 index 0000000..d5f8cbf --- /dev/null +++ b/rules/rule27_bdcom_epon_dying_gasp.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_dying_gasp", + "description": "BDCOM EPON: ONU power loss (Dying Gasp) - bdcom.csv row 2. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_dying_gasp\"\nwhen\n contains(to_string($message.message), \"DYING_GASP\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"dying_gasp\");\n set_field(\"severity_tag\", \"critical\");\n let m = regex(\"DYING_GASP from ONU (\\\\S+) port (\\\\S+)\", to_string($message.message), [\"onu\",\"port\"]);\n set_field(\"onu_id\", m[\"onu\"]);\n set_field(\"onu_port\", m[\"port\"]);\nend" +} diff --git a/rules/rule28_bdcom_epon_onu_config_error.json b/rules/rule28_bdcom_epon_onu_config_error.json new file mode 100644 index 0000000..f2012e0 --- /dev/null +++ b/rules/rule28_bdcom_epon_onu_config_error.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_onu_config_error", + "description": "BDCOM EPON: ONU config apply failure leading to auto-deregistration, or encryption-set failure - bdcom.csv row 3. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_onu_config_error\"\nwhen\n (contains(to_string($message.message), \"Config ONU on interface\") && contains(to_string($message.message), \"failed, must deregister\")) || contains(to_string($message.message), \"onu_llidport_encryp_set Failed\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"onu_config_error\");\n set_field(\"severity_tag\", \"critical\");\nend" +} diff --git a/rules/rule29_bdcom_epon_hal_driver_error.json b/rules/rule29_bdcom_epon_hal_driver_error.json new file mode 100644 index 0000000..3775ff4 --- /dev/null +++ b/rules/rule29_bdcom_epon_hal_driver_error.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_hal_driver_error", + "description": "BDCOM EPON: Cortina/HAL driver errors setting VLAN, loopback detect, or OAM params - bdcom.csv row 4. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_hal_driver_error\"\nwhen\n contains(to_string($message.message), \"set ctc onu port loopback detect failed\") || contains(to_string($message.message), \"CTC OAM VLAN Set error\") || contains(to_string($message.message), \"cortina_ctc_onu_vlan_set invalid llid\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"hal_driver_error\");\n set_field(\"severity_tag\", \"critical\");\nend" +} diff --git a/rules/rule30_bdcom_epon_onu_info_failed.json b/rules/rule30_bdcom_epon_onu_info_failed.json new file mode 100644 index 0000000..16f0cea --- /dev/null +++ b/rules/rule30_bdcom_epon_onu_info_failed.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_onu_info_failed", + "description": "BDCOM EPON: failed to read basic ONU information - bdcom.csv row 5. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_onu_info_failed\"\nwhen\n contains(to_string($message.message), \"Get ONU basic information failed\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"onu_info_failed\");\n set_field(\"severity_tag\", \"critical\");\nend" +} diff --git a/rules/rule31_bdcom_epon_onu_authenticated.json b/rules/rule31_bdcom_epon_onu_authenticated.json new file mode 100644 index 0000000..1d69f7a --- /dev/null +++ b/rules/rule31_bdcom_epon_onu_authenticated.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_onu_authenticated", + "description": "BDCOM EPON: ONU authenticated on PON port - bdcom.csv row 6. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_onu_authenticated\"\nwhen\n contains(to_string($message.message), \"EPON-ONUAUTHEN\") && contains(to_string($message.message), \"is authenticated\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"onu_authenticated\");\n let m = regex(\"ONU (\\\\S+) is authenticated\", to_string($message.message), [\"onu\"]);\n set_field(\"onu_id\", m[\"onu\"]);\nend" +} diff --git a/rules/rule32_bdcom_epon_onu_registered.json b/rules/rule32_bdcom_epon_onu_registered.json new file mode 100644 index 0000000..bda5183 --- /dev/null +++ b/rules/rule32_bdcom_epon_onu_registered.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_onu_registered", + "description": "BDCOM EPON: ONU registered on PON port - bdcom.csv row 6. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_onu_registered\"\nwhen\n contains(to_string($message.message), \"EPON-ONUREG\") && contains(to_string($message.message), \"is registered\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"onu_registered\");\n let m = regex(\"ONU (\\\\S+) is registered\", to_string($message.message), [\"onu\"]);\n set_field(\"onu_id\", m[\"onu\"]);\nend" +} diff --git a/rules/rule33_bdcom_epon_onu_deregistered.json b/rules/rule33_bdcom_epon_onu_deregistered.json new file mode 100644 index 0000000..5413564 --- /dev/null +++ b/rules/rule33_bdcom_epon_onu_deregistered.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_onu_deregistered", + "description": "BDCOM EPON: ONU deregistered from PON port - bdcom.csv row 6. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_onu_deregistered\"\nwhen\n contains(to_string($message.message), \"EPON-ONUDEREG\") && contains(to_string($message.message), \"is deregistered\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"onu_deregistered\");\n let m = regex(\"ONU (\\\\S+) is deregistered\", to_string($message.message), [\"onu\"]);\n set_field(\"onu_id\", m[\"onu\"]);\nend" +} diff --git a/rules/rule34_bdcom_epon_oam_status.json b/rules/rule34_bdcom_epon_oam_status.json new file mode 100644 index 0000000..2423ed6 --- /dev/null +++ b/rules/rule34_bdcom_epon_oam_status.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_oam_status", + "description": "BDCOM EPON: OAM session became Operational or negotiated the CTC extension - bdcom.csv row 7. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_oam_status\"\nwhen\n contains(to_string($message.message), \"OAM Operational Status: Operational\") || contains(to_string($message.message), \"CTC OAM extension negotiated successfully\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"oam_status_ok\");\nend" +} diff --git a/rules/rule35_bdcom_olt_cli_login.json b/rules/rule35_bdcom_olt_cli_login.json new file mode 100644 index 0000000..fafba4b --- /dev/null +++ b/rules/rule35_bdcom_olt_cli_login.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_olt_cli_login", + "description": "BDCOM OLT-style CLI: user logged in (paired with existing olt_privilege_mode/olt_cli_logout rules, which cover the privilege-escalation and logout steps but not the base login) - bdcom.csv row 8. Shared 'cli_login' event_type is reused by other vendors' CLI login rules for cross-vendor dashboards. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_olt_cli_login\"\nwhen\n contains(to_string($message.message), \"logged in from\") && contains(to_string($message.message), \"on vty\")\nthen\n set_field(\"vendor\", \"bdcom_olt\");\n set_field(\"event_type\", \"cli_login\");\n let m = regex(\"User (\\\\S+) logged in from (\\\\S+) on vty (\\\\d+)\", to_string($message.message), [\"user\",\"src_ip\",\"vty\"]);\n set_field(\"cli_user\", m[\"user\"]);\n set_field(\"src_ip\", m[\"src_ip\"]);\n set_field(\"cli_vty\", m[\"vty\"]);\nend" +} diff --git a/rules/rule36_bdcom_epon_config_saved.json b/rules/rule36_bdcom_epon_config_saved.json new file mode 100644 index 0000000..8105f65 --- /dev/null +++ b/rules/rule36_bdcom_epon_config_saved.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_config_saved", + "description": "BDCOM EPON: startup-config/vos.conf/ifindex-config written to flash - bdcom.csv row 9. Distinct wording from the existing olt_config_write rule (which matches a different '... is wrote, TID:' format). Shared 'config_saved' event_type is reused by other vendors. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_config_saved\"\nwhen\n contains(to_string($message.message), \"startup-config is wrote\") || contains(to_string($message.message), \"vos.conf is wrote\") || contains(to_string($message.message), \"ifindex-config is wrote\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"config_saved\");\nend" +} diff --git a/rules/rule37_bdcom_gpon_config_saved.json b/rules/rule37_bdcom_gpon_config_saved.json new file mode 100644 index 0000000..e5aa902 --- /dev/null +++ b/rules/rule37_bdcom_gpon_config_saved.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_gpon_config_saved", + "description": "BDCOM GPON: config file written to flash - gpon_bdcom.csv row 8. Distinct wording from bdcom_epon_config_saved and the existing olt_config_write rule. Shared 'config_saved' event_type is reused by other vendors. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_gpon_config_saved\"\nwhen\n contains(to_string($message.message), \"successfully wrote\") || (contains(to_string($message.message), \"TID:\") && contains(to_string($message.message), \"writing file\"))\nthen\n set_field(\"vendor\", \"bdcom_gpon\");\n set_field(\"event_type\", \"config_saved\");\nend" +} diff --git a/rules/rule38_bdcom_epon_interface_link_state.json b/rules/rule38_bdcom_epon_interface_link_state.json new file mode 100644 index 0000000..df46512 --- /dev/null +++ b/rules/rule38_bdcom_epon_interface_link_state.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_epon_interface_link_state", + "description": "BDCOM EPON: uplink/GigaEthernet interface changed state up/down - bdcom.csv row 10. Shared 'interface_link_state' event_type is reused by other vendors. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_epon_interface_link_state\"\nwhen\n contains(to_string($message.message), \"LINEPROTO-5-UPDOWN\") || contains(to_string($message.message), \"LINE-5-UPDOWN\")\nthen\n set_field(\"vendor\", \"bdcom_epon\");\n set_field(\"event_type\", \"interface_link_state\");\n let m = regex(\"Interface (\\\\S+), changed state to (up|down)\", to_string($message.message), [\"iface\",\"state\"]);\n set_field(\"link_interface\", m[\"iface\"]);\n set_field(\"link_state\", m[\"state\"]);\nend" +} diff --git a/rules/rule39_bdcom_gpon_dying_gasp.json b/rules/rule39_bdcom_gpon_dying_gasp.json new file mode 100644 index 0000000..5d5f207 --- /dev/null +++ b/rules/rule39_bdcom_gpon_dying_gasp.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_gpon_dying_gasp", + "description": "BDCOM GPON: ONU power loss (Dying Gasp) - gpon_bdcom.csv row 2. Shares the 'dying_gasp' event_type with bdcom_epon_dying_gasp and the ZTE dying-gasp rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_gpon_dying_gasp\"\nwhen\n contains(to_string($message.message), \"GPON-ONUDGI\") && contains(to_string($message.message), \"Dying Gasp\")\nthen\n set_field(\"vendor\", \"bdcom_gpon\");\n set_field(\"event_type\", \"dying_gasp\");\n set_field(\"severity_tag\", \"critical\");\n let m = regex(\"ONU (\\\\S+) Dying Gasp on GPON(\\\\S*)\", to_string($message.message), [\"onu\",\"iface\"]);\n set_field(\"onu_id\", m[\"onu\"]);\n set_field(\"gpon_interface\", m[\"iface\"]);\nend" +} diff --git a/rules/rule40_bdcom_gpon_onu_offline.json b/rules/rule40_bdcom_gpon_onu_offline.json new file mode 100644 index 0000000..078e335 --- /dev/null +++ b/rules/rule40_bdcom_gpon_onu_offline.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_gpon_onu_offline", + "description": "BDCOM GPON: ONU offline (Loss of Signal) - gpon_bdcom.csv row 3. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_gpon_onu_offline\"\nwhen\n contains(to_string($message.message), \"GPON-ONULOS\") && contains(to_string($message.message), \"is offline\")\nthen\n set_field(\"vendor\", \"bdcom_gpon\");\n set_field(\"event_type\", \"onu_offline\");\n set_field(\"severity_tag\", \"warning\");\n let m = regex(\"ONU (\\\\S+) is offline\", to_string($message.message), [\"onu\"]);\n set_field(\"onu_id\", m[\"onu\"]);\nend" +} diff --git a/rules/rule41_bdcom_gpon_onu_activate_failed.json b/rules/rule41_bdcom_gpon_onu_activate_failed.json new file mode 100644 index 0000000..98e9801 --- /dev/null +++ b/rules/rule41_bdcom_gpon_onu_activate_failed.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_gpon_onu_activate_failed", + "description": "BDCOM GPON: ONU activation failed - gpon_bdcom.csv row 4. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_gpon_onu_activate_failed\"\nwhen\n contains(to_string($message.message), \"GPON-ONUACTIVATE\") && contains(to_string($message.message), \"activate failed\")\nthen\n set_field(\"vendor\", \"bdcom_gpon\");\n set_field(\"event_type\", \"onu_activate_failed\");\n set_field(\"severity_tag\", \"warning\");\n let m = regex(\"ONU (\\\\S+) activate failed\", to_string($message.message), [\"onu\"]);\n set_field(\"onu_id\", m[\"onu\"]);\nend" +} diff --git a/rules/rule42_bdcom_gpon_onu_disabled.json b/rules/rule42_bdcom_gpon_onu_disabled.json new file mode 100644 index 0000000..07af94d --- /dev/null +++ b/rules/rule42_bdcom_gpon_onu_disabled.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_gpon_onu_disabled", + "description": "BDCOM GPON: ONU disabled by OLT - gpon_bdcom.csv row 4. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_gpon_onu_disabled\"\nwhen\n contains(to_string($message.message), \"GPON-ONUDISABLE\") && contains(to_string($message.message), \"is disabled\")\nthen\n set_field(\"vendor\", \"bdcom_gpon\");\n set_field(\"event_type\", \"onu_disabled\");\n set_field(\"severity_tag\", \"warning\");\n let m = regex(\"ONU (\\\\S+) is disabled\", to_string($message.message), [\"onu\"]);\n set_field(\"onu_id\", m[\"onu\"]);\nend" +} diff --git a/rules/rule43_bdcom_gpon_onu_discovered.json b/rules/rule43_bdcom_gpon_onu_discovered.json new file mode 100644 index 0000000..4fa74ad --- /dev/null +++ b/rules/rule43_bdcom_gpon_onu_discovered.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_gpon_onu_discovered", + "description": "BDCOM GPON: new ONU auto-discovered - gpon_bdcom.csv row 5. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_gpon_onu_discovered\"\nwhen\n contains(to_string($message.message), \"GPON-ONUDISCOVER\") && contains(to_string($message.message), \"is discovered\")\nthen\n set_field(\"vendor\", \"bdcom_gpon\");\n set_field(\"event_type\", \"onu_discovered\");\n let m = regex(\"ONU (\\\\S+) is discovered\", to_string($message.message), [\"onu\"]);\n set_field(\"onu_id\", m[\"onu\"]);\nend" +} diff --git a/rules/rule44_bdcom_gpon_onu_activated.json b/rules/rule44_bdcom_gpon_onu_activated.json new file mode 100644 index 0000000..1488afc --- /dev/null +++ b/rules/rule44_bdcom_gpon_onu_activated.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_gpon_onu_activated", + "description": "BDCOM GPON: ONU successfully activated - gpon_bdcom.csv row 6. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_gpon_onu_activated\"\nwhen\n contains(to_string($message.message), \"GPON-ONUACTIVATE\") && contains(to_string($message.message), \"is activated\")\nthen\n set_field(\"vendor\", \"bdcom_gpon\");\n set_field(\"event_type\", \"onu_activated\");\n let m = regex(\"ONU (\\\\S+) is activated\", to_string($message.message), [\"onu\"]);\n set_field(\"onu_id\", m[\"onu\"]);\nend" +} diff --git a/rules/rule45_bdcom_gpon_onu_deactivated.json b/rules/rule45_bdcom_gpon_onu_deactivated.json new file mode 100644 index 0000000..053f173 --- /dev/null +++ b/rules/rule45_bdcom_gpon_onu_deactivated.json @@ -0,0 +1,5 @@ +{ + "title": "bdcom_gpon_onu_deactivated", + "description": "BDCOM GPON: ONU deactivated - gpon_bdcom.csv row 6. Built from the provided report, not yet verified against real device output.", + "source": "rule \"bdcom_gpon_onu_deactivated\"\nwhen\n contains(to_string($message.message), \"GPON-ONUDEACTIVATE\") && contains(to_string($message.message), \"is deactivated\")\nthen\n set_field(\"vendor\", \"bdcom_gpon\");\n set_field(\"event_type\", \"onu_deactivated\");\n let m = regex(\"ONU (\\\\S+) is deactivated\", to_string($message.message), [\"onu\"]);\n set_field(\"onu_id\", m[\"onu\"]);\nend" +} diff --git a/rules/rule46_zte_gpon_dying_gasp.json b/rules/rule46_zte_gpon_dying_gasp.json new file mode 100644 index 0000000..1c503cc --- /dev/null +++ b/rules/rule46_zte_gpon_dying_gasp.json @@ -0,0 +1,5 @@ +{ + "title": "zte_gpon_dying_gasp", + "description": "ZTE GPON: ONU power loss (Dying Gasp) - zte.csv row 2. Shares the 'dying_gasp' event_type with the BDCOM dying-gasp rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_gpon_dying_gasp\"\nwhen\n contains(to_string($message.message), \"GPON\") && contains(to_string($message.message), \"link olt dgi\") && !contains(to_string($message.message), \"cleared\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"pon_type\", \"gpon\");\n set_field(\"event_type\", \"dying_gasp\");\n set_field(\"severity_tag\", \"critical\");\nend" +} diff --git a/rules/rule47_zte_gpon_onu_signal_degraded.json b/rules/rule47_zte_gpon_onu_signal_degraded.json new file mode 100644 index 0000000..c7a927c --- /dev/null +++ b/rules/rule47_zte_gpon_onu_signal_degraded.json @@ -0,0 +1,5 @@ +{ + "title": "zte_gpon_onu_signal_degraded", + "description": "ZTE GPON: ONU ANI signal degraded alarm - zte.csv row 2. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_gpon_onu_signal_degraded\"\nwhen\n contains(to_string($message.message), \"ONU ANI SD\") && contains(to_string($message.message), \"alarm\") && !contains(to_string($message.message), \"restore\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"pon_type\", \"gpon\");\n set_field(\"event_type\", \"onu_signal_degraded\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule48_zte_gpon_onu_lan_los.json b/rules/rule48_zte_gpon_onu_lan_los.json new file mode 100644 index 0000000..b4b7dab --- /dev/null +++ b/rules/rule48_zte_gpon_onu_lan_los.json @@ -0,0 +1,5 @@ +{ + "title": "zte_gpon_onu_lan_los", + "description": "ZTE GPON: ONU Uni LAN port loss-of-signal alarm - zte.csv row 2. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_gpon_onu_lan_los\"\nwhen\n contains(to_string($message.message), \"ONU Uni lan los\") && contains(to_string($message.message), \"alarm\") && !contains(to_string($message.message), \"restore\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"pon_type\", \"gpon\");\n set_field(\"event_type\", \"onu_lan_los\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule49_zte_epon_dying_gasp.json b/rules/rule49_zte_epon_dying_gasp.json new file mode 100644 index 0000000..ea6a44c --- /dev/null +++ b/rules/rule49_zte_epon_dying_gasp.json @@ -0,0 +1,5 @@ +{ + "title": "zte_epon_dying_gasp", + "description": "ZTE EPON: ONU power loss - zte.csv row 3. Shares the 'dying_gasp' event_type with the BDCOM and ZTE GPON dying-gasp rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_epon_dying_gasp\"\nwhen\n contains(to_string($message.message), \"EPON\") && contains(to_string($message.message), \"onu Power Off\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"pon_type\", \"epon\");\n set_field(\"event_type\", \"dying_gasp\");\n set_field(\"severity_tag\", \"critical\");\nend" +} diff --git a/rules/rule50_zte_epon_onu_offline.json b/rules/rule50_zte_epon_onu_offline.json new file mode 100644 index 0000000..e7bb9a8 --- /dev/null +++ b/rules/rule50_zte_epon_onu_offline.json @@ -0,0 +1,5 @@ +{ + "title": "zte_epon_onu_offline", + "description": "ZTE EPON: ONU went offline - zte.csv row 3. Shares the 'onu_offline' event_type with bdcom_gpon_onu_offline for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_epon_onu_offline\"\nwhen\n contains(to_string($message.message), \"EPON\") && contains(to_string($message.message), \"Onu offline\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"pon_type\", \"epon\");\n set_field(\"event_type\", \"onu_offline\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule51_zte_gpon_olt_pon_los.json b/rules/rule51_zte_gpon_olt_pon_los.json new file mode 100644 index 0000000..1c6f341 --- /dev/null +++ b/rules/rule51_zte_gpon_olt_pon_los.json @@ -0,0 +1,5 @@ +{ + "title": "zte_gpon_olt_pon_los", + "description": "ZTE GPON: OLT-side loss of signal on the PON port itself (not a single ONU) - zte.csv row 4. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_gpon_olt_pon_los\"\nwhen\n contains(to_string($message.message), \"GPON\") && contains(to_string($message.message), \"link olt losi\") && !contains(to_string($message.message), \"cleared\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"pon_type\", \"gpon\");\n set_field(\"event_type\", \"olt_pon_los\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule52_zte_optical_low_power.json b/rules/rule52_zte_optical_low_power.json new file mode 100644 index 0000000..d757fa2 --- /dev/null +++ b/rules/rule52_zte_optical_low_power.json @@ -0,0 +1,5 @@ +{ + "title": "zte_optical_low_power", + "description": "ZTE: low optical Rx power on the OLT - zte.csv row 5. Shares the 'optical_low_power' event_type with the Juniper and D-Link optical rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_optical_low_power\"\nwhen\n contains(to_string($message.message), \"XPON alarm\") && contains(to_string($message.message), \"Rx Power Low\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"event_type\", \"optical_low_power\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule53_zte_power_over_voltage.json b/rules/rule53_zte_power_over_voltage.json new file mode 100644 index 0000000..662dac5 --- /dev/null +++ b/rules/rule53_zte_power_over_voltage.json @@ -0,0 +1,5 @@ +{ + "title": "zte_power_over_voltage", + "description": "ZTE: PSU over-voltage in a chassis shelf - zte.csv row 6. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_power_over_voltage\"\nwhen\n contains(to_string($message.message), \"Power\") && contains(to_string($message.message), \"over voltage in shelf\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"event_type\", \"power_over_voltage\");\n set_field(\"severity_tag\", \"warning\");\n let m = regex(\"over voltage in shelf (\\\\S+)\", to_string($message.message), [\"shelf\"]);\n set_field(\"shelf\", m[\"shelf\"]);\nend" +} diff --git a/rules/rule54_zte_alarm_cleared.json b/rules/rule54_zte_alarm_cleared.json new file mode 100644 index 0000000..33f1b8b --- /dev/null +++ b/rules/rule54_zte_alarm_cleared.json @@ -0,0 +1,5 @@ +{ + "title": "zte_alarm_cleared", + "description": "ZTE: any of the GPON/EPON alarms above (dying gasp, PON LOS, ONU signal-degraded, ONU LAN LOS) clearing/restoring - zte.csv row 7. Merged into one rule since these are all the same 'condition resolved' event, just for different alarm types. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_alarm_cleared\"\nwhen\n contains(to_string($message.message), \"GPON\") && (contains(to_string($message.message), \"link olt dgi\") || contains(to_string($message.message), \"link olt losi\")) && contains(to_string($message.message), \"cleared\")\n || (contains(to_string($message.message), \"ONU ANI SD\") && contains(to_string($message.message), \"restore\"))\n || (contains(to_string($message.message), \"ONU Uni lan los\") && contains(to_string($message.message), \"restore\"))\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"pon_type\", \"gpon\");\n set_field(\"event_type\", \"alarm_cleared\");\nend" +} diff --git a/rules/rule55_zte_cli_login.json b/rules/rule55_zte_cli_login.json new file mode 100644 index 0000000..798144b --- /dev/null +++ b/rules/rule55_zte_cli_login.json @@ -0,0 +1,5 @@ +{ + "title": "zte_cli_login", + "description": "ZTE: admin/managing-system login via CLI or inband interface - zte.csv row 8. Shares the 'cli_login' event_type with bdcom_olt_cli_login and dlink_telnet_login for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_cli_login\"\nwhen\n contains(to_string($message.message), \"User login\") || contains(to_string($message.message), \"inband Interface login\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"event_type\", \"cli_login\");\nend" +} diff --git a/rules/rule56_zte_cli_logout.json b/rules/rule56_zte_cli_logout.json new file mode 100644 index 0000000..76f6e46 --- /dev/null +++ b/rules/rule56_zte_cli_logout.json @@ -0,0 +1,5 @@ +{ + "title": "zte_cli_logout", + "description": "ZTE: admin/managing-system logout via CLI or inband interface - zte.csv row 8. Shares the 'cli_logout' event_type with other vendors' logout rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"zte_cli_logout\"\nwhen\n contains(to_string($message.message), \"User logout\") || contains(to_string($message.message), \"inband Interface logout\")\nthen\n set_field(\"vendor\", \"zte\");\n set_field(\"event_type\", \"cli_logout\");\nend" +} diff --git a/rules/rule57_juniper_ddos_violation_set.json b/rules/rule57_juniper_ddos_violation_set.json new file mode 100644 index 0000000..31e6b02 --- /dev/null +++ b/rules/rule57_juniper_ddos_violation_set.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_ddos_violation_set", + "description": "Juniper jddosd: control-plane DDoS protection policer violation started - juniper.csv row 2. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_ddos_violation_set\"\nwhen\n contains(to_string($message.message), \"DDOS_PROTOCOL_VIOLATION_SET\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"ddos_violation_set\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule58_juniper_ddos_violation_clear.json b/rules/rule58_juniper_ddos_violation_clear.json new file mode 100644 index 0000000..a1a89af --- /dev/null +++ b/rules/rule58_juniper_ddos_violation_clear.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_ddos_violation_clear", + "description": "Juniper jddosd: control-plane DDoS protection policer violation cleared - juniper.csv row 2. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_ddos_violation_clear\"\nwhen\n contains(to_string($message.message), \"DDOS_PROTOCOL_VIOLATION_CLEAR\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"ddos_violation_clear\");\nend" +} diff --git a/rules/rule59_juniper_psu_failure.json b/rules/rule59_juniper_psu_failure.json new file mode 100644 index 0000000..85921b4 --- /dev/null +++ b/rules/rule59_juniper_psu_failure.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_psu_failure", + "description": "Juniper chassisd/alarmd/craftd: power supply or PEM failed/unpowered - juniper.csv row 3. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_psu_failure\"\nwhen\n contains(to_string($message.message), \"Power Supply failed\") || (contains(to_string($message.message), \"PEM\") && contains(to_string($message.message), \"is not powered\"))\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"psu_failure\");\n set_field(\"severity_tag\", \"critical\");\nend" +} diff --git a/rules/rule60_juniper_memory_parity_error.json b/rules/rule60_juniper_memory_parity_error.json new file mode 100644 index 0000000..96e7827 --- /dev/null +++ b/rules/rule60_juniper_memory_parity_error.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_memory_parity_error", + "description": "Juniper FPC: memory parity errors generated (hardware fault) - juniper.csv row 4. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_memory_parity_error\"\nwhen\n contains(to_string($message.message), \"Parity errors generated\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"memory_parity_error\");\n set_field(\"severity_tag\", \"critical\");\nend" +} diff --git a/rules/rule61_juniper_optical_low_power.json b/rules/rule61_juniper_optical_low_power.json new file mode 100644 index 0000000..081f006 --- /dev/null +++ b/rules/rule61_juniper_optical_low_power.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_optical_low_power", + "description": "Juniper: SFP receive power low alarm - juniper.csv row 6. Shares the 'optical_low_power' event_type with zte_optical_low_power and the D-Link optical rule for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_optical_low_power\"\nwhen\n contains(to_string($message.message), \"SFP receive power low alarm\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"optical_low_power\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule62_juniper_qsfp_eeprom_failed.json b/rules/rule62_juniper_qsfp_eeprom_failed.json new file mode 100644 index 0000000..7e74ee5 --- /dev/null +++ b/rules/rule62_juniper_qsfp_eeprom_failed.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_qsfp_eeprom_failed", + "description": "Juniper: failed to read the QSFP module's ID EEPROM - juniper.csv row 6. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_qsfp_eeprom_failed\"\nwhen\n contains(to_string($message.message), \"FAILED to read the QSFP\") && contains(to_string($message.message), \"EEPROM\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"qsfp_eeprom_failed\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule63_juniper_lacp_timeout.json b/rules/rule63_juniper_lacp_timeout.json new file mode 100644 index 0000000..a57ac0b --- /dev/null +++ b/rules/rule63_juniper_lacp_timeout.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_lacp_timeout", + "description": "Juniper lacpd: LACP timeout on a link aggregation member - juniper.csv row 7. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_lacp_timeout\"\nwhen\n contains(to_string($message.message), \"LACPD_TIMEOUT\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"lacp_timeout\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule64_juniper_link_down.json b/rules/rule64_juniper_link_down.json new file mode 100644 index 0000000..d86d543 --- /dev/null +++ b/rules/rule64_juniper_link_down.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_link_down", + "description": "Juniper mib2d/kernel: SNMP link-down trap - juniper.csv row 7. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_link_down\"\nwhen\n contains(to_string($message.message), \"SNMP_TRAP_LINK_DOWN\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"link_down\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule65_juniper_lag_state_change.json b/rules/rule65_juniper_lag_state_change.json new file mode 100644 index 0000000..6e8a0ef --- /dev/null +++ b/rules/rule65_juniper_lag_state_change.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_lag_state_change", + "description": "Juniper: LAG bundle interface-device state changed (e.g. min-links no longer satisfied) - juniper.csv row 7. Shares the 'lag_state_change' event_type with dlink_lag_state_change for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_lag_state_change\"\nwhen\n contains(to_string($message.message), \"lag_bundlestate_ifd_change\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"lag_state_change\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule66_juniper_snmp_auth_violation.json b/rules/rule66_juniper_snmp_auth_violation.json new file mode 100644 index 0000000..e6e2950 --- /dev/null +++ b/rules/rule66_juniper_snmp_auth_violation.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_snmp_auth_violation", + "description": "Juniper snmpd: SNMP poll from a disallowed address or with a wrong community string - juniper.csv row 8. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_snmp_auth_violation\"\nwhen\n contains(to_string($message.message), \"SNMPD_AUTH_RESTRICTED_ADDRESS\") || contains(to_string($message.message), \"SNMPD_AUTH_FAILURE\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"snmp_auth_violation\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule67_juniper_asic_error.json b/rules/rule67_juniper_asic_error.json new file mode 100644 index 0000000..1f60b3d --- /dev/null +++ b/rules/rule67_juniper_asic_error.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_asic_error", + "description": "Juniper Broadcom SDK (PFE/ASIC): L3/IRB creation, nexthop/ARP, or VXLAN hardware install failure - juniper.csv row 10. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_asic_error\"\nwhen\n contains(to_string($message.message), \"L3 INTF creation failed\") || contains(to_string($message.message), \"brcm_nh_resolve_get_nexthop\") || contains(to_string($message.message), \"brcm_vxlan\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"asic_error\");\n set_field(\"severity_tag\", \"critical\");\nend" +} diff --git a/rules/rule68_juniper_bgp_session_reset.json b/rules/rule68_juniper_bgp_session_reset.json new file mode 100644 index 0000000..ca6ac56 --- /dev/null +++ b/rules/rule68_juniper_bgp_session_reset.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_bgp_session_reset", + "description": "Juniper rpd: BGP session closed/reset - I/O error, NOTIFICATION received, or recv failure - juniper.csv row 11. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_bgp_session_reset\"\nwhen\n contains(to_string($message.message), \"BGP_IO_ERROR_CLOSE_SESSION\") || contains(to_string($message.message), \"bgp_handle_notify\") || contains(to_string($message.message), \"bgp_recv\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"bgp_session_reset\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule69_juniper_bgp_addr_not_found.json b/rules/rule69_juniper_bgp_addr_not_found.json new file mode 100644 index 0000000..cdf0ebe --- /dev/null +++ b/rules/rule69_juniper_bgp_addr_not_found.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_bgp_addr_not_found", + "description": "Juniper rpd: local address for a configured BGP peer not found (config/interface issue, not a session-level reset) - juniper.csv row 11. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_bgp_addr_not_found\"\nwhen\n contains(to_string($message.message), \"BGP_ADDR_NOT_FOUND\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"bgp_addr_not_found\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule70_juniper_ntpd_resource_error.json b/rules/rule70_juniper_ntpd_resource_error.json new file mode 100644 index 0000000..738342d --- /dev/null +++ b/rules/rule70_juniper_ntpd_resource_error.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_ntpd_resource_error", + "description": "Juniper xntpd: mlockall() resource temporarily unavailable (memory pressure) - juniper.csv row 12. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_ntpd_resource_error\"\nwhen\n contains(to_string($message.message), \"mlockall()\") && contains(to_string($message.message), \"Resource temporarily unavailable\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"ntpd_resource_error\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule71_juniper_ssh_too_many_failures.json b/rules/rule71_juniper_ssh_too_many_failures.json new file mode 100644 index 0000000..7571e82 --- /dev/null +++ b/rules/rule71_juniper_ssh_too_many_failures.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_ssh_too_many_failures", + "description": "Juniper sshd: too many password failures for one connection attempt (possible brute-force) - juniper.csv row 13. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_ssh_too_many_failures\"\nwhen\n contains(to_string($message.message), \"Too many password failures\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"ssh_too_many_failures\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule72_juniper_config_commit.json b/rules/rule72_juniper_config_commit.json new file mode 100644 index 0000000..0276607 --- /dev/null +++ b/rules/rule72_juniper_config_commit.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_config_commit", + "description": "Juniper mgd: configuration commit started/completed - juniper.csv row 14. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_config_commit\"\nwhen\n contains(to_string($message.message), \"UI_COMMIT\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"config_commit\");\nend" +} diff --git a/rules/rule73_juniper_mgmt_login.json b/rules/rule73_juniper_mgmt_login.json new file mode 100644 index 0000000..fd80bfb --- /dev/null +++ b/rules/rule73_juniper_mgmt_login.json @@ -0,0 +1,5 @@ +{ + "title": "juniper_mgmt_login", + "description": "Juniper mgd: management database login event (config-session audit trail) - juniper.csv row 14. Built from the provided report, not yet verified against real device output.", + "source": "rule \"juniper_mgmt_login\"\nwhen\n contains(to_string($message.message), \"UI_DBASE_LOGIN_EVENT\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"mgmt_login\");\nend" +} diff --git a/rules/rule74_dlink_system_reboot.json b/rules/rule74_dlink_system_reboot.json new file mode 100644 index 0000000..f5419cd --- /dev/null +++ b/rules/rule74_dlink_system_reboot.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_system_reboot", + "description": "D-Link: switch cold start / system started up - d'link.csv row 2. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_system_reboot\"\nwhen\n contains(to_string($message.message), \"System cold start\") || contains(to_string($message.message), \"System started up\")\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"system_reboot\");\n set_field(\"severity_tag\", \"critical\");\nend" +} diff --git a/rules/rule75_dlink_optical_alarm.json b/rules/rule75_dlink_optical_alarm.json new file mode 100644 index 0000000..fe713c7 --- /dev/null +++ b/rules/rule75_dlink_optical_alarm.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_optical_alarm", + "description": "D-Link: optic module exceeded a low alarm/warning threshold (Rx/Tx power, bias current, or supply voltage) - d'link.csv row 3. Shares the 'optical_low_power' event_type with juniper_optical_low_power and zte_optical_low_power for a cross-vendor view, though D-Link's alarm covers more metrics than just Rx power. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_optical_alarm\"\nwhen\n contains(to_string($message.message), \"optic module\") && (contains(to_string($message.message), \"exceeded the low alarm threshold\") || contains(to_string($message.message), \"exceeded the low warning threshold\"))\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"optical_low_power\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule76_dlink_optical_recovered.json b/rules/rule76_dlink_optical_recovered.json new file mode 100644 index 0000000..ef15590 --- /dev/null +++ b/rules/rule76_dlink_optical_recovered.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_optical_recovered", + "description": "D-Link: optic module recovered from a threshold alarm - d'link.csv row 3. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_optical_recovered\"\nwhen\n contains(to_string($message.message), \"optic module\") && contains(to_string($message.message), \"recover from\")\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"optical_recovered\");\nend" +} diff --git a/rules/rule77_dlink_interface_link_state.json b/rules/rule77_dlink_interface_link_state.json new file mode 100644 index 0000000..cfcb7ae --- /dev/null +++ b/rules/rule77_dlink_interface_link_state.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_interface_link_state", + "description": "D-Link: port link up/down - d'link.csv row 4. Shares the 'interface_link_state' event_type with bdcom_epon_interface_link_state for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_interface_link_state\"\nwhen\n contains(to_string($message.message), \"Port\") && (contains(to_string($message.message), \"link down\") || contains(to_string($message.message), \"link up\"))\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"interface_link_state\");\n let m = regex(\"Port (\\\\S+) link (up|down)\", to_string($message.message), [\"port\",\"state\"]);\n set_field(\"link_interface\", m[\"port\"]);\n set_field(\"link_state\", m[\"state\"]);\nend" +} diff --git a/rules/rule78_dlink_lag_state_change.json b/rules/rule78_dlink_lag_state_change.json new file mode 100644 index 0000000..dfc4a47 --- /dev/null +++ b/rules/rule78_dlink_lag_state_change.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_lag_state_change", + "description": "D-Link: Link Aggregation Group state changed up/down - d'link.csv row 4. Shares the 'lag_state_change' event_type with juniper_lag_state_change for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_lag_state_change\"\nwhen\n contains(to_string($message.message), \"Link Aggregation Group\") && (contains(to_string($message.message), \"link up\") || contains(to_string($message.message), \"link down\"))\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"lag_state_change\");\n set_field(\"severity_tag\", \"warning\");\nend" +} diff --git a/rules/rule79_dlink_gbic_detected.json b/rules/rule79_dlink_gbic_detected.json new file mode 100644 index 0000000..c7b5268 --- /dev/null +++ b/rules/rule79_dlink_gbic_detected.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_gbic_detected", + "description": "D-Link: SFP/GBIC module physically detected in a port - d'link.csv row 5. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_gbic_detected\"\nwhen\n contains(to_string($message.message), \"GBIC module detected\")\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"gbic_detected\");\nend" +} diff --git a/rules/rule80_dlink_ntp_sync.json b/rules/rule80_dlink_ntp_sync.json new file mode 100644 index 0000000..97531ac --- /dev/null +++ b/rules/rule80_dlink_ntp_sync.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_ntp_sync", + "description": "D-Link: system clock synced with an SNTP server - d'link.csv row 6. Distinct concept from juniper_ntp_unreachable (that's an error, this is a routine sync notice). Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_ntp_sync\"\nwhen\n contains(to_string($message.message), \"SNTP-6: New Time\")\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"ntp_sync\");\n let m = regex(\"ServerIpAddress:\\\\s*(\\\\S+)\", to_string($message.message), [\"ntp_server\"]);\n set_field(\"ntp_server\", m[\"ntp_server\"]);\nend" +} diff --git a/rules/rule81_dlink_management_ip_changed.json b/rules/rule81_dlink_management_ip_changed.json new file mode 100644 index 0000000..1ab52ae --- /dev/null +++ b/rules/rule81_dlink_management_ip_changed.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_management_ip_changed", + "description": "D-Link: switch's management IP address was changed - d'link.csv row 7. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_management_ip_changed\"\nwhen\n contains(to_string($message.message), \"Management IP address was changed\")\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"management_ip_changed\");\n set_field(\"severity_tag\", \"warning\");\n let m = regex(\"New IP:\\\\s*(\\\\S+)\", to_string($message.message), [\"new_ip\"]);\n set_field(\"new_mgmt_ip\", m[\"new_ip\"]);\nend" +} diff --git a/rules/rule82_dlink_telnet_login.json b/rules/rule82_dlink_telnet_login.json new file mode 100644 index 0000000..4fea65b --- /dev/null +++ b/rules/rule82_dlink_telnet_login.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_telnet_login", + "description": "D-Link: successful admin login via Telnet/CLI - d'link.csv row 8. Shares the 'cli_login' event_type with bdcom_olt_cli_login and zte_cli_login for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_telnet_login\"\nwhen\n contains(to_string($message.message), \"Successful login through Telnet\")\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"cli_login\");\n let m = regex(\"User: (\\\\S+), IP: (\\\\S+)\", to_string($message.message), [\"user\",\"src_ip\"]);\n set_field(\"cli_user\", m[\"user\"]);\n set_field(\"src_ip\", m[\"src_ip\"]);\nend" +} diff --git a/rules/rule83_dlink_telnet_logout.json b/rules/rule83_dlink_telnet_logout.json new file mode 100644 index 0000000..20f81d6 --- /dev/null +++ b/rules/rule83_dlink_telnet_logout.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_telnet_logout", + "description": "D-Link: admin logout via Telnet/CLI - d'link.csv row 8. Shares the 'cli_logout' event_type with zte_cli_logout for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_telnet_logout\"\nwhen\n contains(to_string($message.message), \"Logout through Telnet\")\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"cli_logout\");\n let m = regex(\"IP: (\\\\S+)\", to_string($message.message), [\"src_ip\"]);\n set_field(\"src_ip\", m[\"src_ip\"]);\nend" +} diff --git a/rules/rule84_dlink_config_saved.json b/rules/rule84_dlink_config_saved.json new file mode 100644 index 0000000..8c39916 --- /dev/null +++ b/rules/rule84_dlink_config_saved.json @@ -0,0 +1,5 @@ +{ + "title": "dlink_config_saved", + "description": "D-Link: running config saved to flash - d'link.csv row 9. Shares the 'config_saved' event_type with the BDCOM config-save rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.", + "source": "rule \"dlink_config_saved\"\nwhen\n contains(to_string($message.message), \"Configuration saved to flash\") || contains(to_string($message.message), \"Configuration and log saved to flash\")\nthen\n set_field(\"vendor\", \"dlink\");\n set_field(\"event_type\", \"config_saved\");\nend" +}