{
  "title": "dlink_system_reboot",
  "description": "D-Link: switch cold start / system started up - d'link.csv row 2. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"dlink_system_reboot\"\nwhen\n  contains(to_string($message.message), \"System cold start\") || contains(to_string($message.message), \"System started up\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"system_reboot\");\n  set_field(\"severity_tag\", \"critical\");\nend"
}