{
  "title": "accelppp_mac_change_detected",
  "description": "accel-ppp: a subscriber's MAC address changed mid-session - found live in a real 1GB accel-ppp log sample (2026-07-23), format: 'warn: <interface>: mac change detected'. accelppp_interface is filled in by the accelppp_interface_tag fallback rule, not here.",
  "source": "rule \"accelppp_mac_change_detected\"\nwhen\n  contains(to_string($message.message), \"mac change detected\")\nthen\n  set_field(\"vendor\", \"accel-ppp\");\n  set_field(\"event_type\", \"mac_change_detected\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}