{
  "title": "dlink_telnet_login",
  "description": "D-Link: successful admin login via Telnet/CLI - d'link.csv row 8. Shares the 'cli_login' event_type with bdcom_olt_cli_login and zte_cli_login for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"dlink_telnet_login\"\nwhen\n  contains(to_string($message.message), \"Successful login through Telnet\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"cli_login\");\n  let m = regex(\"User: (\\\\S+), IP: (\\\\S+)\", to_string($message.message), [\"user\",\"src_ip\"]);\n  set_field(\"cli_user\", m[\"user\"]);\n  set_field(\"src_ip\", m[\"src_ip\"]);\nend"
}