{
  "title": "juniper_ui_configuration_error",
  "description": "Juniper UI_CONFIGURATION_ERROR process/path/statement",
  "source": "rule \"juniper_ui_configuration_error\"\nwhen\n  contains(to_string($message.message), \"UI_CONFIGURATION_ERROR\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"config_error\");\n  let m = regex(\"Process: (\\\\S+), path: \\\\[(.*?)\\\\], statement: (.*)\", to_string($message.message), [\"process\",\"path\",\"statement\"]);\n  set_field(\"config_process\", m[\"process\"]);\n  set_field(\"config_path\", m[\"path\"]);\n  set_field(\"config_statement\", m[\"statement\"]);\nend"
}