{
  "title": "olt_privilege_mode",
  "description": "BDCOM/OLT-style CLI: user entered privilege mode",
  "source": "rule \"olt_privilege_mode\"\nwhen\n  contains(to_string($message.message), \"enter privilege mode\")\nthen\n  set_field(\"vendor\", \"bdcom_olt\");\n  set_field(\"event_type\", \"cli_privilege_mode\");\n  let m = regex(\"User (\\\\S+) enter privilege mode from vty (\\\\d+), level = (\\\\d+)\", to_string($message.message), [\"user\",\"vty\",\"level\"]);\n  set_field(\"cli_user\", m[\"user\"]);\n  set_field(\"cli_vty\", m[\"vty\"]);\nend"
}