{
  "title": "a10_session_timeout",
  "description": "A10: admin session timed out from inactivity (the detailed line naming session id/user/src_ip - the generic preceding 'Session timed out' line is a duplicate summary of the same event and is deliberately left unclassified). Built from real captured A10 syslog output.",
  "source": "rule \"a10_session_timeout\"\nwhen\n  contains(to_string($message.message), \"has timed out\")\nthen\n  set_field(\"vendor\", \"a10\");\n  set_field(\"event_type\", \"session_timeout\");\n  let m = regex(\"Session ID (\\\\d+) for user \\\"(\\\\S+)\\\" from (\\\\S+) has timed out\", to_string($message.message), [\"session_id\",\"user\",\"src_ip\"]);\n  set_field(\"a10_session_id\", m[\"session_id\"]);\n  set_field(\"a10_user\", m[\"user\"]);\n  set_field(\"src_ip\", m[\"src_ip\"]);\nend"
}