{
  "title": "juniper_chassis_alarm",
  "description": "Juniper chassisd SNMP trap (hardware health: over temperature, fan, power supply, etc.) - CHASSISD_SNMP_TRAP6",
  "source": "rule \"juniper_chassis_alarm\"\nwhen\n  contains(to_string($message.message), \"CHASSISD_SNMP_TRAP\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"chassis_alarm\");\n  set_field(\"severity_tag\", \"critical\");\n  let m = regex(\"SNMP trap generated: ([^(]+?)\\\\s*\\\\(\", to_string($message.message), [\"alarm\"]);\n  set_field(\"chassis_alarm_type\", m[\"alarm\"]);\n  let d = regex(\"jnxContentsDescr ([^,]+)\", to_string($message.message), [\"descr\"]);\n  set_field(\"chassis_component\", d[\"descr\"]);\nend"
}