{
  "title": "WARNING: repeated network equipment warning from one device",
  "description": "Same 'single occurrence can be transient, repetition means a real problem' philosophy as alert7_accelppp_repeated_error_warn, applied to the new Network Equipment rules (rule27-84): repeated ONU signal-loss/offline, optical low power, BGP session resets, LACP timeouts, link flapping, DDoS violations, SNMP auth violations, etc. from the same device. Threshold matches alert7 (>5 in 5 minutes). Built from the user's log-signature report; not yet confirmed against real device output.",
  "priority": 2,
  "alert": true,
  "config": {
    "type": "aggregation-v1",
    "query": "severity_tag:warning",
    "streams": ["__NETWORK_STREAM_ID__"],
    "group_by": ["gl2_remote_ip", "event_type"],
    "series": [{"type": "count", "id": "count-", "field": null}],
    "conditions": {"expression": {"expr": ">", "left": {"expr": "number-ref", "ref": "count-"}, "right": {"expr": "number", "value": 5.0}}},
    "search_within_ms": 300000,
    "execute_every_ms": 300000,
    "event_limit": 50
  },
  "field_spec": {},
  "key_spec": [],
  "notification_settings": {"grace_period_ms": 900000, "backlog_size": 5},
  "notifications": [{"notification_id": "__DISCORD_NOTIFICATION_ID__"}]
}