{
  "title": "generic_critical_severity",
  "description": "Universal fallback: any syslog message (any vendor) with RFC5424/3164 severity Emergency/Alert/Critical (0-2) that was not already classified by a more specific rule. Excludes level<0 (unparseable/unknown severity - e.g. raw text sent without a syslog PRI header, such as Vector socket sink output), which is NOT the same as an actually critical message.",
  "source": "rule \"generic_critical_severity\"\nwhen\n  !has_field(\"event_type\") && has_field(\"level\") && to_long($message.level) >= 0 && to_long($message.level) <= 2\nthen\n  set_field(\"event_type\", \"generic_critical_syslog\");\n  set_field(\"severity_tag\", \"critical\");\nend"
}