{
  "title": "zte_epon_onu_offline",
  "description": "ZTE EPON: ONU went offline - zte.csv row 3. Shares the 'onu_offline' event_type with bdcom_gpon_onu_offline for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"zte_epon_onu_offline\"\nwhen\n  contains(to_string($message.message), \"EPON\") && contains(to_string($message.message), \"Onu offline\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"pon_type\", \"epon\");\n  set_field(\"event_type\", \"onu_offline\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}