{
  "title": "juniper_lag_state_change",
  "description": "Juniper: LAG bundle interface-device state changed (e.g. min-links no longer satisfied) - juniper.csv row 7. Shares the 'lag_state_change' event_type with dlink_lag_state_change for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"juniper_lag_state_change\"\nwhen\n  contains(to_string($message.message), \"lag_bundlestate_ifd_change\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"lag_state_change\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}