{
  "title": "bdcom_epon_dying_gasp",
  "description": "BDCOM EPON: ONU power loss (Dying Gasp) - bdcom.csv row 2. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"bdcom_epon_dying_gasp\"\nwhen\n  contains(to_string($message.message), \"DYING_GASP\")\nthen\n  set_field(\"vendor\", \"bdcom_epon\");\n  set_field(\"event_type\", \"dying_gasp\");\n  set_field(\"severity_tag\", \"critical\");\n  let m = regex(\"DYING_GASP from ONU (\\\\S+) port (\\\\S+)\", to_string($message.message), [\"onu\",\"port\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\n  set_field(\"onu_port\", m[\"port\"]);\nend"
}