{
  "title": "zte_cli_login",
  "description": "ZTE: admin/managing-system login via CLI or inband interface - zte.csv row 8. Shares the 'cli_login' event_type with bdcom_olt_cli_login and dlink_telnet_login for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"zte_cli_login\"\nwhen\n  contains(to_string($message.message), \"User login\") || contains(to_string($message.message), \"inband Interface login\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"event_type\", \"cli_login\");\nend"
}