{
  "title": "zte_cli_logout",
  "description": "ZTE: admin/managing-system logout via CLI or inband interface - zte.csv row 8. Shares the 'cli_logout' event_type with other vendors' logout rules for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"zte_cli_logout\"\nwhen\n  contains(to_string($message.message), \"User logout\") || contains(to_string($message.message), \"inband Interface logout\")\nthen\n  set_field(\"vendor\", \"zte\");\n  set_field(\"event_type\", \"cli_logout\");\nend"
}