{
  "title": "accelppp_radius_coa_session_not_found",
  "description": "accel-ppp: RADIUS CoA/Disconnect-Message arrived for a session that no longer exists - found live in a real 1GB accel-ppp log sample (2026-07-23), format: 'warn: radius:dm_coa: session not found'",
  "source": "rule \"accelppp_radius_coa_session_not_found\"\nwhen\n  contains(to_string($message.message), \"radius:dm_coa: session not found\")\nthen\n  set_field(\"vendor\", \"accel-ppp\");\n  set_field(\"event_type\", \"radius_coa_session_not_found\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}