{
  "title": "dlink_management_ip_changed",
  "description": "D-Link: switch's management IP address was changed - d'link.csv row 7. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"dlink_management_ip_changed\"\nwhen\n  contains(to_string($message.message), \"Management IP address was changed\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"management_ip_changed\");\n  set_field(\"severity_tag\", \"warning\");\n  let m = regex(\"New IP:\\\\s*(\\\\S+)\", to_string($message.message), [\"new_ip\"]);\n  set_field(\"new_mgmt_ip\", m[\"new_ip\"]);\nend"
}