Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report

Closes the parsing gap the README explicitly called out (no D-Link
parsing, no ZTE ONU alarms) plus adds BDCOM GPON and expands Juniper
coverage (DDoS, PSU/memory/ASIC hardware faults, LACP/BGP/SNMP, config
commit). 58 new rules across 5 vendors, wired into Network Equipment
Parsing's stage 0 ahead of the generic_critical_severity fallback.

Where the same real-world event is reported by multiple vendors
(dying_gasp, onu_offline, optical_low_power, cli_login/cli_logout,
config_saved, interface_link_state, lag_state_change), rules share one
event_type value so dashboards can aggregate across vendors, same
normalization approach as accelppp_interface.

Built directly from the user's CSV signature report, not from real
device log samples - each rule's description says so explicitly. `when`
conditions use plain substring/contains matching on the report's own
pattern text to keep classification robust; regex field extraction is
only added where the source format is unambiguous. Passed offline
checks (JSON validity, every pipeline-referenced rule resolves to a
file, all regex patterns compile). Live compilation against a running
Graylog instance - which caught 2 real bugs during the dashboard/stream
fixes earlier this session - could NOT be completed: the test container
went unreachable mid-session. Re-run install-graylog.sh once it's back
up to confirm these compile before relying on them.

pipelines/pipeline1_network.json

@@ -1,5 +1,5 @@
 {
   "title": "Network Equipment Parsing",
-  "description": "Parses Juniper and BDCOM/OLT-style syslog, plus universal critical-severity fallback",
-  "source": "pipeline \"Network Equipment Parsing\"\nstage 0 match either\n    rule \"juniper_ntp_unreachable\";\n    rule \"juniper_ssh_login_success\";\n    rule \"juniper_ssh_login_failed_tagged\";\n    rule \"juniper_ssh_failed_password\";\n    rule \"juniper_ui_configuration_error\";\n    rule \"juniper_chassis_alarm\";\n    rule \"olt_privilege_mode\";\n    rule \"olt_cli_logout\";\n    rule \"olt_ip_arp_moved\";\n    rule \"olt_config_write\";\n    rule \"generic_critical_severity\";\nend"
+  "description": "Parses Juniper, BDCOM EPON/GPON OLT, ZTE OLT, and D-Link syslog, plus a universal critical-severity fallback",
+  "source": "pipeline \"Network Equipment Parsing\"\nstage 0 match either\n    rule \"juniper_ntp_unreachable\";\n    rule \"juniper_ssh_login_success\";\n    rule \"juniper_ssh_login_failed_tagged\";\n    rule \"juniper_ssh_failed_password\";\n    rule \"juniper_ui_configuration_error\";\n    rule \"juniper_chassis_alarm\";\n    rule \"olt_privilege_mode\";\n    rule \"olt_cli_logout\";\n    rule \"olt_ip_arp_moved\";\n    rule \"olt_config_write\";\n    rule \"bdcom_epon_dying_gasp\";\n    rule \"bdcom_epon_onu_config_error\";\n    rule \"bdcom_epon_hal_driver_error\";\n    rule \"bdcom_epon_onu_info_failed\";\n    rule \"bdcom_epon_onu_authenticated\";\n    rule \"bdcom_epon_onu_registered\";\n    rule \"bdcom_epon_onu_deregistered\";\n    rule \"bdcom_epon_oam_status\";\n    rule \"bdcom_olt_cli_login\";\n    rule \"bdcom_epon_config_saved\";\n    rule \"bdcom_epon_interface_link_state\";\n    rule \"bdcom_gpon_config_saved\";\n    rule \"bdcom_gpon_dying_gasp\";\n    rule \"bdcom_gpon_onu_offline\";\n    rule \"bdcom_gpon_onu_activate_failed\";\n    rule \"bdcom_gpon_onu_disabled\";\n    rule \"bdcom_gpon_onu_discovered\";\n    rule \"bdcom_gpon_onu_activated\";\n    rule \"bdcom_gpon_onu_deactivated\";\n    rule \"zte_gpon_dying_gasp\";\n    rule \"zte_gpon_onu_signal_degraded\";\n    rule \"zte_gpon_onu_lan_los\";\n    rule \"zte_epon_dying_gasp\";\n    rule \"zte_epon_onu_offline\";\n    rule \"zte_gpon_olt_pon_los\";\n    rule \"zte_optical_low_power\";\n    rule \"zte_power_over_voltage\";\n    rule \"zte_alarm_cleared\";\n    rule \"zte_cli_login\";\n    rule \"zte_cli_logout\";\n    rule \"juniper_ddos_violation_set\";\n    rule \"juniper_ddos_violation_clear\";\n    rule \"juniper_psu_failure\";\n    rule \"juniper_memory_parity_error\";\n    rule \"juniper_optical_low_power\";\n    rule \"juniper_qsfp_eeprom_failed\";\n    rule \"juniper_lacp_timeout\";\n    rule \"juniper_link_down\";\n    rule \"juniper_lag_state_change\";\n    rule \"juniper_snmp_auth_violation\";\n    rule \"juniper_asic_error\";\n    rule \"juniper_bgp_session_reset\";\n    rule \"juniper_bgp_addr_not_found\";\n    rule \"juniper_ntpd_resource_error\";\n    rule \"juniper_ssh_too_many_failures\";\n    rule \"juniper_config_commit\";\n    rule \"juniper_mgmt_login\";\n    rule \"dlink_system_reboot\";\n    rule \"dlink_optical_alarm\";\n    rule \"dlink_optical_recovered\";\n    rule \"dlink_interface_link_state\";\n    rule \"dlink_lag_state_change\";\n    rule \"dlink_gbic_detected\";\n    rule \"dlink_ntp_sync\";\n    rule \"dlink_management_ip_changed\";\n    rule \"dlink_telnet_login\";\n    rule \"dlink_telnet_logout\";\n    rule \"dlink_config_saved\";\n    rule \"generic_critical_severity\";\nend"
 }

rules/rule27_bdcom_epon_dying_gasp.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_dying_gasp",
+  "description": "BDCOM EPON: ONU power loss (Dying Gasp) - bdcom.csv row 2. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_dying_gasp\"\nwhen\n  contains(to_string($message.message), \"DYING_GASP\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"dying_gasp\");\n  set_field(\"severity_tag\", \"critical\");\n  let m = regex(\"DYING_GASP from ONU (\\\\S+) port (\\\\S+)\", to_string($message.message), [\"onu\",\"port\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\n  set_field(\"onu_port\", m[\"port\"]);\nend"
+}

rules/rule28_bdcom_epon_onu_config_error.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_onu_config_error",
+  "description": "BDCOM EPON: ONU config apply failure leading to auto-deregistration, or encryption-set failure - bdcom.csv row 3. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_onu_config_error\"\nwhen\n  (contains(to_string($message.message), \"Config ONU on interface\") && contains(to_string($message.message), \"failed, must deregister\")) || contains(to_string($message.message), \"onu_llidport_encryp_set Failed\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"onu_config_error\");\n  set_field(\"severity_tag\", \"critical\");\nend"
+}

rules/rule29_bdcom_epon_hal_driver_error.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_hal_driver_error",
+  "description": "BDCOM EPON: Cortina/HAL driver errors setting VLAN, loopback detect, or OAM params - bdcom.csv row 4. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_hal_driver_error\"\nwhen\n  contains(to_string($message.message), \"set ctc onu port loopback detect failed\") || contains(to_string($message.message), \"CTC OAM VLAN Set error\") || contains(to_string($message.message), \"cortina_ctc_onu_vlan_set invalid llid\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"hal_driver_error\");\n  set_field(\"severity_tag\", \"critical\");\nend"
+}

rules/rule30_bdcom_epon_onu_info_failed.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_onu_info_failed",
+  "description": "BDCOM EPON: failed to read basic ONU information - bdcom.csv row 5. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_onu_info_failed\"\nwhen\n  contains(to_string($message.message), \"Get ONU basic information failed\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"onu_info_failed\");\n  set_field(\"severity_tag\", \"critical\");\nend"
+}

rules/rule31_bdcom_epon_onu_authenticated.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_onu_authenticated",
+  "description": "BDCOM EPON: ONU authenticated on PON port - bdcom.csv row 6. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_onu_authenticated\"\nwhen\n  contains(to_string($message.message), \"EPON-ONUAUTHEN\") && contains(to_string($message.message), \"is authenticated\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"onu_authenticated\");\n  let m = regex(\"ONU (\\\\S+) is authenticated\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
+}

rules/rule32_bdcom_epon_onu_registered.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_onu_registered",
+  "description": "BDCOM EPON: ONU registered on PON port - bdcom.csv row 6. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_onu_registered\"\nwhen\n  contains(to_string($message.message), \"EPON-ONUREG\") && contains(to_string($message.message), \"is registered\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"onu_registered\");\n  let m = regex(\"ONU (\\\\S+) is registered\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
+}

rules/rule33_bdcom_epon_onu_deregistered.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_onu_deregistered",
+  "description": "BDCOM EPON: ONU deregistered from PON port - bdcom.csv row 6. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_onu_deregistered\"\nwhen\n  contains(to_string($message.message), \"EPON-ONUDEREG\") && contains(to_string($message.message), \"is deregistered\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"onu_deregistered\");\n  let m = regex(\"ONU (\\\\S+) is deregistered\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
+}

rules/rule34_bdcom_epon_oam_status.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_oam_status",
+  "description": "BDCOM EPON: OAM session became Operational or negotiated the CTC extension - bdcom.csv row 7. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_oam_status\"\nwhen\n  contains(to_string($message.message), \"OAM Operational Status: Operational\") || contains(to_string($message.message), \"CTC OAM extension negotiated successfully\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"oam_status_ok\");\nend"
+}

rules/rule35_bdcom_olt_cli_login.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_olt_cli_login",
+  "description": "BDCOM OLT-style CLI: user logged in (paired with existing olt_privilege_mode/olt_cli_logout rules, which cover the privilege-escalation and logout steps but not the base login) - bdcom.csv row 8. Shared 'cli_login' event_type is reused by other vendors' CLI login rules for cross-vendor dashboards. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_olt_cli_login\"\nwhen\n  contains(to_string($message.message), \"logged in from\") && contains(to_string($message.message), \"on vty\")\nthen\n  set_field(\"vendor\", \"bdcom_olt\");\n  set_field(\"event_type\", \"cli_login\");\n  let m = regex(\"User (\\\\S+) logged in from (\\\\S+) on vty (\\\\d+)\", to_string($message.message), [\"user\",\"src_ip\",\"vty\"]);\n  set_field(\"cli_user\", m[\"user\"]);\n  set_field(\"src_ip\", m[\"src_ip\"]);\n  set_field(\"cli_vty\", m[\"vty\"]);\nend"
+}

rules/rule36_bdcom_epon_config_saved.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_config_saved",
+  "description": "BDCOM EPON: startup-config/vos.conf/ifindex-config written to flash - bdcom.csv row 9. Distinct wording from the existing olt_config_write rule (which matches a different '... is wrote, TID:' format). Shared 'config_saved' event_type is reused by other vendors. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_config_saved\"\nwhen\n  contains(to_string($message.message), \"startup-config is wrote\") || contains(to_string($message.message), \"vos.conf is wrote\") || contains(to_string($message.message), \"ifindex-config is wrote\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"config_saved\");\nend"
+}

rules/rule37_bdcom_gpon_config_saved.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_gpon_config_saved",
+  "description": "BDCOM GPON: config file written to flash - gpon_bdcom.csv row 8. Distinct wording from bdcom_epon_config_saved and the existing olt_config_write rule. Shared 'config_saved' event_type is reused by other vendors. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_gpon_config_saved\"\nwhen\n  contains(to_string($message.message), \"successfully wrote\") || (contains(to_string($message.message), \"TID:\") && contains(to_string($message.message), \"writing file\"))\nthen\n  set_field(\"vendor\", \"bdcom_gpon\");\n  set_field(\"event_type\", \"config_saved\");\nend"
+}

rules/rule38_bdcom_epon_interface_link_state.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_epon_interface_link_state",
+  "description": "BDCOM EPON: uplink/GigaEthernet interface changed state up/down - bdcom.csv row 10. Shared 'interface_link_state' event_type is reused by other vendors. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_epon_interface_link_state\"\nwhen\n  contains(to_string($message.message), \"LINEPROTO-5-UPDOWN\") || contains(to_string($message.message), \"LINE-5-UPDOWN\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"interface_link_state\");\n  let m = regex(\"Interface (\\\\S+), changed state to (up|down)\", to_string($message.message), [\"iface\",\"state\"]);\n  set_field(\"link_interface\", m[\"iface\"]);\n  set_field(\"link_state\", m[\"state\"]);\nend"
+}

rules/rule39_bdcom_gpon_dying_gasp.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_gpon_dying_gasp",
+  "description": "BDCOM GPON: ONU power loss (Dying Gasp) - gpon_bdcom.csv row 2. Shares the 'dying_gasp' event_type with bdcom_epon_dying_gasp and the ZTE dying-gasp rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_gpon_dying_gasp\"\nwhen\n  contains(to_string($message.message), \"GPON-ONUDGI\") && contains(to_string($message.message), \"Dying Gasp\")\nthen\n  set_field(\"vendor\", \"bdcom_gpon\");\n  set_field(\"event_type\", \"dying_gasp\");\n  set_field(\"severity_tag\", \"critical\");\n  let m = regex(\"ONU (\\\\S+) Dying Gasp on GPON(\\\\S*)\", to_string($message.message), [\"onu\",\"iface\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\n  set_field(\"gpon_interface\", m[\"iface\"]);\nend"
+}

rules/rule40_bdcom_gpon_onu_offline.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_gpon_onu_offline",
+  "description": "BDCOM GPON: ONU offline (Loss of Signal) - gpon_bdcom.csv row 3. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_gpon_onu_offline\"\nwhen\n  contains(to_string($message.message), \"GPON-ONULOS\") && contains(to_string($message.message), \"is offline\")\nthen\n  set_field(\"vendor\", \"bdcom_gpon\");\n  set_field(\"event_type\", \"onu_offline\");\n  set_field(\"severity_tag\", \"warning\");\n  let m = regex(\"ONU (\\\\S+) is offline\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
+}

rules/rule41_bdcom_gpon_onu_activate_failed.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_gpon_onu_activate_failed",
+  "description": "BDCOM GPON: ONU activation failed - gpon_bdcom.csv row 4. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_gpon_onu_activate_failed\"\nwhen\n  contains(to_string($message.message), \"GPON-ONUACTIVATE\") && contains(to_string($message.message), \"activate failed\")\nthen\n  set_field(\"vendor\", \"bdcom_gpon\");\n  set_field(\"event_type\", \"onu_activate_failed\");\n  set_field(\"severity_tag\", \"warning\");\n  let m = regex(\"ONU (\\\\S+) activate failed\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
+}

rules/rule42_bdcom_gpon_onu_disabled.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_gpon_onu_disabled",
+  "description": "BDCOM GPON: ONU disabled by OLT - gpon_bdcom.csv row 4. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_gpon_onu_disabled\"\nwhen\n  contains(to_string($message.message), \"GPON-ONUDISABLE\") && contains(to_string($message.message), \"is disabled\")\nthen\n  set_field(\"vendor\", \"bdcom_gpon\");\n  set_field(\"event_type\", \"onu_disabled\");\n  set_field(\"severity_tag\", \"warning\");\n  let m = regex(\"ONU (\\\\S+) is disabled\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
+}

rules/rule43_bdcom_gpon_onu_discovered.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_gpon_onu_discovered",
+  "description": "BDCOM GPON: new ONU auto-discovered - gpon_bdcom.csv row 5. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_gpon_onu_discovered\"\nwhen\n  contains(to_string($message.message), \"GPON-ONUDISCOVER\") && contains(to_string($message.message), \"is discovered\")\nthen\n  set_field(\"vendor\", \"bdcom_gpon\");\n  set_field(\"event_type\", \"onu_discovered\");\n  let m = regex(\"ONU (\\\\S+) is discovered\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
+}

rules/rule44_bdcom_gpon_onu_activated.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_gpon_onu_activated",
+  "description": "BDCOM GPON: ONU successfully activated - gpon_bdcom.csv row 6. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_gpon_onu_activated\"\nwhen\n  contains(to_string($message.message), \"GPON-ONUACTIVATE\") && contains(to_string($message.message), \"is activated\")\nthen\n  set_field(\"vendor\", \"bdcom_gpon\");\n  set_field(\"event_type\", \"onu_activated\");\n  let m = regex(\"ONU (\\\\S+) is activated\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
+}

rules/rule45_bdcom_gpon_onu_deactivated.json

@@ -0,0 +1,5 @@
+{
+  "title": "bdcom_gpon_onu_deactivated",
+  "description": "BDCOM GPON: ONU deactivated - gpon_bdcom.csv row 6. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"bdcom_gpon_onu_deactivated\"\nwhen\n  contains(to_string($message.message), \"GPON-ONUDEACTIVATE\") && contains(to_string($message.message), \"is deactivated\")\nthen\n  set_field(\"vendor\", \"bdcom_gpon\");\n  set_field(\"event_type\", \"onu_deactivated\");\n  let m = regex(\"ONU (\\\\S+) is deactivated\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
+}

rules/rule46_zte_gpon_dying_gasp.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_gpon_dying_gasp",
+  "description": "ZTE GPON: ONU power loss (Dying Gasp) - zte.csv row 2. Shares the 'dying_gasp' event_type with the BDCOM dying-gasp rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_gpon_dying_gasp\"\nwhen\n  contains(to_string($message.message), \"GPON\") && contains(to_string($message.message), \"link olt dgi\") && !contains(to_string($message.message), \"cleared\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"pon_type\", \"gpon\");\n  set_field(\"event_type\", \"dying_gasp\");\n  set_field(\"severity_tag\", \"critical\");\nend"
+}

rules/rule47_zte_gpon_onu_signal_degraded.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_gpon_onu_signal_degraded",
+  "description": "ZTE GPON: ONU ANI signal degraded alarm - zte.csv row 2. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_gpon_onu_signal_degraded\"\nwhen\n  contains(to_string($message.message), \"ONU ANI SD\") && contains(to_string($message.message), \"alarm\") && !contains(to_string($message.message), \"restore\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"pon_type\", \"gpon\");\n  set_field(\"event_type\", \"onu_signal_degraded\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule48_zte_gpon_onu_lan_los.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_gpon_onu_lan_los",
+  "description": "ZTE GPON: ONU Uni LAN port loss-of-signal alarm - zte.csv row 2. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_gpon_onu_lan_los\"\nwhen\n  contains(to_string($message.message), \"ONU Uni lan los\") && contains(to_string($message.message), \"alarm\") && !contains(to_string($message.message), \"restore\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"pon_type\", \"gpon\");\n  set_field(\"event_type\", \"onu_lan_los\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule49_zte_epon_dying_gasp.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_epon_dying_gasp",
+  "description": "ZTE EPON: ONU power loss - zte.csv row 3. Shares the 'dying_gasp' event_type with the BDCOM and ZTE GPON dying-gasp rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_epon_dying_gasp\"\nwhen\n  contains(to_string($message.message), \"EPON\") && contains(to_string($message.message), \"onu Power Off\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"pon_type\", \"epon\");\n  set_field(\"event_type\", \"dying_gasp\");\n  set_field(\"severity_tag\", \"critical\");\nend"
+}

rules/rule50_zte_epon_onu_offline.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_epon_onu_offline",
+  "description": "ZTE EPON: ONU went offline - zte.csv row 3. Shares the 'onu_offline' event_type with bdcom_gpon_onu_offline for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_epon_onu_offline\"\nwhen\n  contains(to_string($message.message), \"EPON\") && contains(to_string($message.message), \"Onu offline\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"pon_type\", \"epon\");\n  set_field(\"event_type\", \"onu_offline\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule51_zte_gpon_olt_pon_los.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_gpon_olt_pon_los",
+  "description": "ZTE GPON: OLT-side loss of signal on the PON port itself (not a single ONU) - zte.csv row 4. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_gpon_olt_pon_los\"\nwhen\n  contains(to_string($message.message), \"GPON\") && contains(to_string($message.message), \"link olt losi\") && !contains(to_string($message.message), \"cleared\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"pon_type\", \"gpon\");\n  set_field(\"event_type\", \"olt_pon_los\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule52_zte_optical_low_power.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_optical_low_power",
+  "description": "ZTE: low optical Rx power on the OLT - zte.csv row 5. Shares the 'optical_low_power' event_type with the Juniper and D-Link optical rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_optical_low_power\"\nwhen\n  contains(to_string($message.message), \"XPON alarm\") && contains(to_string($message.message), \"Rx Power Low\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"event_type\", \"optical_low_power\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule53_zte_power_over_voltage.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_power_over_voltage",
+  "description": "ZTE: PSU over-voltage in a chassis shelf - zte.csv row 6. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_power_over_voltage\"\nwhen\n  contains(to_string($message.message), \"Power\") && contains(to_string($message.message), \"over voltage in shelf\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"event_type\", \"power_over_voltage\");\n  set_field(\"severity_tag\", \"warning\");\n  let m = regex(\"over voltage in shelf (\\\\S+)\", to_string($message.message), [\"shelf\"]);\n  set_field(\"shelf\", m[\"shelf\"]);\nend"
+}

rules/rule54_zte_alarm_cleared.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_alarm_cleared",
+  "description": "ZTE: any of the GPON/EPON alarms above (dying gasp, PON LOS, ONU signal-degraded, ONU LAN LOS) clearing/restoring - zte.csv row 7. Merged into one rule since these are all the same 'condition resolved' event, just for different alarm types. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_alarm_cleared\"\nwhen\n  contains(to_string($message.message), \"GPON\") && (contains(to_string($message.message), \"link olt dgi\") || contains(to_string($message.message), \"link olt losi\")) && contains(to_string($message.message), \"cleared\")\n  || (contains(to_string($message.message), \"ONU ANI SD\") && contains(to_string($message.message), \"restore\"))\n  || (contains(to_string($message.message), \"ONU Uni lan los\") && contains(to_string($message.message), \"restore\"))\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"pon_type\", \"gpon\");\n  set_field(\"event_type\", \"alarm_cleared\");\nend"
+}

rules/rule55_zte_cli_login.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_cli_login",
+  "description": "ZTE: admin/managing-system login via CLI or inband interface - zte.csv row 8. Shares the 'cli_login' event_type with bdcom_olt_cli_login and dlink_telnet_login for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_cli_login\"\nwhen\n  contains(to_string($message.message), \"User login\") || contains(to_string($message.message), \"inband Interface login\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"event_type\", \"cli_login\");\nend"
+}

rules/rule56_zte_cli_logout.json

@@ -0,0 +1,5 @@
+{
+  "title": "zte_cli_logout",
+  "description": "ZTE: admin/managing-system logout via CLI or inband interface - zte.csv row 8. Shares the 'cli_logout' event_type with other vendors' logout rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"zte_cli_logout\"\nwhen\n  contains(to_string($message.message), \"User logout\") || contains(to_string($message.message), \"inband Interface logout\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"event_type\", \"cli_logout\");\nend"
+}

rules/rule57_juniper_ddos_violation_set.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_ddos_violation_set",
+  "description": "Juniper jddosd: control-plane DDoS protection policer violation started - juniper.csv row 2. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_ddos_violation_set\"\nwhen\n  contains(to_string($message.message), \"DDOS_PROTOCOL_VIOLATION_SET\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"ddos_violation_set\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule58_juniper_ddos_violation_clear.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_ddos_violation_clear",
+  "description": "Juniper jddosd: control-plane DDoS protection policer violation cleared - juniper.csv row 2. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_ddos_violation_clear\"\nwhen\n  contains(to_string($message.message), \"DDOS_PROTOCOL_VIOLATION_CLEAR\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"ddos_violation_clear\");\nend"
+}

rules/rule59_juniper_psu_failure.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_psu_failure",
+  "description": "Juniper chassisd/alarmd/craftd: power supply or PEM failed/unpowered - juniper.csv row 3. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_psu_failure\"\nwhen\n  contains(to_string($message.message), \"Power Supply failed\") || (contains(to_string($message.message), \"PEM\") && contains(to_string($message.message), \"is not powered\"))\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"psu_failure\");\n  set_field(\"severity_tag\", \"critical\");\nend"
+}

rules/rule60_juniper_memory_parity_error.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_memory_parity_error",
+  "description": "Juniper FPC: memory parity errors generated (hardware fault) - juniper.csv row 4. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_memory_parity_error\"\nwhen\n  contains(to_string($message.message), \"Parity errors generated\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"memory_parity_error\");\n  set_field(\"severity_tag\", \"critical\");\nend"
+}

rules/rule61_juniper_optical_low_power.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_optical_low_power",
+  "description": "Juniper: SFP receive power low alarm - juniper.csv row 6. Shares the 'optical_low_power' event_type with zte_optical_low_power and the D-Link optical rule for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_optical_low_power\"\nwhen\n  contains(to_string($message.message), \"SFP receive power low alarm\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"optical_low_power\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule62_juniper_qsfp_eeprom_failed.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_qsfp_eeprom_failed",
+  "description": "Juniper: failed to read the QSFP module's ID EEPROM - juniper.csv row 6. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_qsfp_eeprom_failed\"\nwhen\n  contains(to_string($message.message), \"FAILED to read the QSFP\") && contains(to_string($message.message), \"EEPROM\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"qsfp_eeprom_failed\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule63_juniper_lacp_timeout.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_lacp_timeout",
+  "description": "Juniper lacpd: LACP timeout on a link aggregation member - juniper.csv row 7. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_lacp_timeout\"\nwhen\n  contains(to_string($message.message), \"LACPD_TIMEOUT\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"lacp_timeout\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule64_juniper_link_down.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_link_down",
+  "description": "Juniper mib2d/kernel: SNMP link-down trap - juniper.csv row 7. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_link_down\"\nwhen\n  contains(to_string($message.message), \"SNMP_TRAP_LINK_DOWN\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"link_down\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule65_juniper_lag_state_change.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_lag_state_change",
+  "description": "Juniper: LAG bundle interface-device state changed (e.g. min-links no longer satisfied) - juniper.csv row 7. Shares the 'lag_state_change' event_type with dlink_lag_state_change for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_lag_state_change\"\nwhen\n  contains(to_string($message.message), \"lag_bundlestate_ifd_change\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"lag_state_change\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule66_juniper_snmp_auth_violation.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_snmp_auth_violation",
+  "description": "Juniper snmpd: SNMP poll from a disallowed address or with a wrong community string - juniper.csv row 8. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_snmp_auth_violation\"\nwhen\n  contains(to_string($message.message), \"SNMPD_AUTH_RESTRICTED_ADDRESS\") || contains(to_string($message.message), \"SNMPD_AUTH_FAILURE\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"snmp_auth_violation\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule67_juniper_asic_error.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_asic_error",
+  "description": "Juniper Broadcom SDK (PFE/ASIC): L3/IRB creation, nexthop/ARP, or VXLAN hardware install failure - juniper.csv row 10. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_asic_error\"\nwhen\n  contains(to_string($message.message), \"L3 INTF creation failed\") || contains(to_string($message.message), \"brcm_nh_resolve_get_nexthop\") || contains(to_string($message.message), \"brcm_vxlan\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"asic_error\");\n  set_field(\"severity_tag\", \"critical\");\nend"
+}

rules/rule68_juniper_bgp_session_reset.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_bgp_session_reset",
+  "description": "Juniper rpd: BGP session closed/reset - I/O error, NOTIFICATION received, or recv failure - juniper.csv row 11. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_bgp_session_reset\"\nwhen\n  contains(to_string($message.message), \"BGP_IO_ERROR_CLOSE_SESSION\") || contains(to_string($message.message), \"bgp_handle_notify\") || contains(to_string($message.message), \"bgp_recv\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"bgp_session_reset\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule69_juniper_bgp_addr_not_found.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_bgp_addr_not_found",
+  "description": "Juniper rpd: local address for a configured BGP peer not found (config/interface issue, not a session-level reset) - juniper.csv row 11. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_bgp_addr_not_found\"\nwhen\n  contains(to_string($message.message), \"BGP_ADDR_NOT_FOUND\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"bgp_addr_not_found\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule70_juniper_ntpd_resource_error.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_ntpd_resource_error",
+  "description": "Juniper xntpd: mlockall() resource temporarily unavailable (memory pressure) - juniper.csv row 12. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_ntpd_resource_error\"\nwhen\n  contains(to_string($message.message), \"mlockall()\") && contains(to_string($message.message), \"Resource temporarily unavailable\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"ntpd_resource_error\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule71_juniper_ssh_too_many_failures.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_ssh_too_many_failures",
+  "description": "Juniper sshd: too many password failures for one connection attempt (possible brute-force) - juniper.csv row 13. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_ssh_too_many_failures\"\nwhen\n  contains(to_string($message.message), \"Too many password failures\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"ssh_too_many_failures\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule72_juniper_config_commit.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_config_commit",
+  "description": "Juniper mgd: configuration commit started/completed - juniper.csv row 14. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_config_commit\"\nwhen\n  contains(to_string($message.message), \"UI_COMMIT\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"config_commit\");\nend"
+}

rules/rule73_juniper_mgmt_login.json

@@ -0,0 +1,5 @@
+{
+  "title": "juniper_mgmt_login",
+  "description": "Juniper mgd: management database login event (config-session audit trail) - juniper.csv row 14. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"juniper_mgmt_login\"\nwhen\n  contains(to_string($message.message), \"UI_DBASE_LOGIN_EVENT\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"mgmt_login\");\nend"
+}

rules/rule74_dlink_system_reboot.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_system_reboot",
+  "description": "D-Link: switch cold start / system started up - d'link.csv row 2. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_system_reboot\"\nwhen\n  contains(to_string($message.message), \"System cold start\") || contains(to_string($message.message), \"System started up\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"system_reboot\");\n  set_field(\"severity_tag\", \"critical\");\nend"
+}

rules/rule75_dlink_optical_alarm.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_optical_alarm",
+  "description": "D-Link: optic module exceeded a low alarm/warning threshold (Rx/Tx power, bias current, or supply voltage) - d'link.csv row 3. Shares the 'optical_low_power' event_type with juniper_optical_low_power and zte_optical_low_power for a cross-vendor view, though D-Link's alarm covers more metrics than just Rx power. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_optical_alarm\"\nwhen\n  contains(to_string($message.message), \"optic module\") && (contains(to_string($message.message), \"exceeded the low alarm threshold\") || contains(to_string($message.message), \"exceeded the low warning threshold\"))\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"optical_low_power\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule76_dlink_optical_recovered.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_optical_recovered",
+  "description": "D-Link: optic module recovered from a threshold alarm - d'link.csv row 3. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_optical_recovered\"\nwhen\n  contains(to_string($message.message), \"optic module\") && contains(to_string($message.message), \"recover from\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"optical_recovered\");\nend"
+}

rules/rule77_dlink_interface_link_state.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_interface_link_state",
+  "description": "D-Link: port link up/down - d'link.csv row 4. Shares the 'interface_link_state' event_type with bdcom_epon_interface_link_state for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_interface_link_state\"\nwhen\n  contains(to_string($message.message), \"Port\") && (contains(to_string($message.message), \"link down\") || contains(to_string($message.message), \"link up\"))\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"interface_link_state\");\n  let m = regex(\"Port (\\\\S+) link (up|down)\", to_string($message.message), [\"port\",\"state\"]);\n  set_field(\"link_interface\", m[\"port\"]);\n  set_field(\"link_state\", m[\"state\"]);\nend"
+}

rules/rule78_dlink_lag_state_change.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_lag_state_change",
+  "description": "D-Link: Link Aggregation Group state changed up/down - d'link.csv row 4. Shares the 'lag_state_change' event_type with juniper_lag_state_change for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_lag_state_change\"\nwhen\n  contains(to_string($message.message), \"Link Aggregation Group\") && (contains(to_string($message.message), \"link up\") || contains(to_string($message.message), \"link down\"))\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"lag_state_change\");\n  set_field(\"severity_tag\", \"warning\");\nend"
+}

rules/rule79_dlink_gbic_detected.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_gbic_detected",
+  "description": "D-Link: SFP/GBIC module physically detected in a port - d'link.csv row 5. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_gbic_detected\"\nwhen\n  contains(to_string($message.message), \"GBIC module detected\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"gbic_detected\");\nend"
+}

rules/rule80_dlink_ntp_sync.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_ntp_sync",
+  "description": "D-Link: system clock synced with an SNTP server - d'link.csv row 6. Distinct concept from juniper_ntp_unreachable (that's an error, this is a routine sync notice). Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_ntp_sync\"\nwhen\n  contains(to_string($message.message), \"SNTP-6: New Time\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"ntp_sync\");\n  let m = regex(\"ServerIpAddress:\\\\s*(\\\\S+)\", to_string($message.message), [\"ntp_server\"]);\n  set_field(\"ntp_server\", m[\"ntp_server\"]);\nend"
+}

rules/rule81_dlink_management_ip_changed.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_management_ip_changed",
+  "description": "D-Link: switch's management IP address was changed - d'link.csv row 7. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_management_ip_changed\"\nwhen\n  contains(to_string($message.message), \"Management IP address was changed\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"management_ip_changed\");\n  set_field(\"severity_tag\", \"warning\");\n  let m = regex(\"New IP:\\\\s*(\\\\S+)\", to_string($message.message), [\"new_ip\"]);\n  set_field(\"new_mgmt_ip\", m[\"new_ip\"]);\nend"
+}

rules/rule82_dlink_telnet_login.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_telnet_login",
+  "description": "D-Link: successful admin login via Telnet/CLI - d'link.csv row 8. Shares the 'cli_login' event_type with bdcom_olt_cli_login and zte_cli_login for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_telnet_login\"\nwhen\n  contains(to_string($message.message), \"Successful login through Telnet\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"cli_login\");\n  let m = regex(\"User: (\\\\S+), IP: (\\\\S+)\", to_string($message.message), [\"user\",\"src_ip\"]);\n  set_field(\"cli_user\", m[\"user\"]);\n  set_field(\"src_ip\", m[\"src_ip\"]);\nend"
+}

rules/rule83_dlink_telnet_logout.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_telnet_logout",
+  "description": "D-Link: admin logout via Telnet/CLI - d'link.csv row 8. Shares the 'cli_logout' event_type with zte_cli_logout for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_telnet_logout\"\nwhen\n  contains(to_string($message.message), \"Logout through Telnet\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"cli_logout\");\n  let m = regex(\"IP: (\\\\S+)\", to_string($message.message), [\"src_ip\"]);\n  set_field(\"src_ip\", m[\"src_ip\"]);\nend"
+}

rules/rule84_dlink_config_saved.json

@@ -0,0 +1,5 @@
+{
+  "title": "dlink_config_saved",
+  "description": "D-Link: running config saved to flash - d'link.csv row 9. Shares the 'config_saved' event_type with the BDCOM config-save rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
+  "source": "rule \"dlink_config_saved\"\nwhen\n  contains(to_string($message.message), \"Configuration saved to flash\") || contains(to_string($message.message), \"Configuration and log saved to flash\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"config_saved\");\nend"
+}