{
  "title": "juniper_psu_failure",
  "description": "Juniper chassisd/alarmd/craftd: power supply or PEM failed/unpowered - juniper.csv row 3. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"juniper_psu_failure\"\nwhen\n  contains(to_string($message.message), \"Power Supply failed\") || (contains(to_string($message.message), \"PEM\") && contains(to_string($message.message), \"is not powered\"))\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"psu_failure\");\n  set_field(\"severity_tag\", \"critical\");\nend"
}