{
  "title": "accelppp_unclassified_warn",
  "description": "accel-ppp: fallback for any 'warn:' line that no specific rule already classified - see accelppp_unclassified_error for why a text-based fallback is needed instead of the numeric-severity one.",
  "source": "rule \"accelppp_unclassified_warn\"\nwhen\n  !has_field(\"event_type\") && contains(to_string($message.message), \"warn:\")\nthen\n  set_field(\"vendor\", \"accel-ppp\");\n  set_field(\"event_type\", \"accelppp_unclassified_warn\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}