{
  "title": "dlink_lag_state_change",
  "description": "D-Link: Link Aggregation Group state changed up/down - d'link.csv row 4. Shares the 'lag_state_change' event_type with juniper_lag_state_change for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"dlink_lag_state_change\"\nwhen\n  contains(to_string($message.message), \"Link Aggregation Group\") && (contains(to_string($message.message), \"link up\") || contains(to_string($message.message), \"link down\"))\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"lag_state_change\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}