{
  "title": "bdcom_gpon_onu_disabled",
  "description": "BDCOM GPON: ONU disabled by OLT - gpon_bdcom.csv row 4. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"bdcom_gpon_onu_disabled\"\nwhen\n  contains(to_string($message.message), \"GPON-ONUDISABLE\") && contains(to_string($message.message), \"is disabled\")\nthen\n  set_field(\"vendor\", \"bdcom_gpon\");\n  set_field(\"event_type\", \"onu_disabled\");\n  set_field(\"severity_tag\", \"warning\");\n  let m = regex(\"ONU (\\\\S+) is disabled\", to_string($message.message), [\"onu\"]);\n  set_field(\"onu_id\", m[\"onu\"]);\nend"
}