{
  "title": "a10_auth_success",
  "description": "A10: local authentication succeeded (fires alongside a10_session_opened for the same login - kept separate since it's a distinct audit line). Built from real captured A10 syslog output.",
  "source": "rule \"a10_auth_success\"\nwhen\n  contains(to_string($message.message), \"Local authentication successful\")\nthen\n  set_field(\"vendor\", \"a10\");\n  set_field(\"event_type\", \"auth_success\");\n  let m = regex(\"Local authentication successful \\\\(user: (\\\\S+)\\\\)\", to_string($message.message), [\"user\"]);\n  set_field(\"a10_user\", m[\"user\"]);\nend"
}