{
  "title": "a10_lsn_session_quota_exceeded",
  "description": "A10 ACOS LSN: a subscriber hit their per-user total session quota (all protocols) - real service impact. Built from real captured A10 syslog output. Same first-entry-only extraction caveat as a10_lsn_tcp_quota_exceeded for multi-user lines.",
  "source": "rule \"a10_lsn_session_quota_exceeded\"\nwhen\n  contains(to_string($message.message), \"LSN: Session user-quota exceeded\")\nthen\n  set_field(\"vendor\", \"a10\");\n  set_field(\"event_type\", \"lsn_session_quota_exceeded\");\n  set_field(\"severity_tag\", \"critical\");\n  let m = regex(\"User\\\\(Count\\\\) (\\\\S+)\\\\((\\\\d+)\\\\)\", to_string($message.message), [\"ip\",\"count\"]);\n  set_field(\"lsn_user_ip\", m[\"ip\"]);\n  set_field(\"lsn_user_count\", to_long(m[\"count\"]));\nend"
}