{
  "title": "dlink_optical_recovered",
  "description": "D-Link: optic module recovered from a threshold alarm - d'link.csv row 3. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"dlink_optical_recovered\"\nwhen\n  contains(to_string($message.message), \"optic module\") && contains(to_string($message.message), \"recover from\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"optical_recovered\");\nend"
}