{
  "title": "a10_session_opened",
  "description": "A10: admin session opened (covers both 'aXAPI session' and 'cli session' wording - same event, different access method). Built from real captured A10 syslog output.",
  "source": "rule \"a10_session_opened\"\nwhen\n  contains(to_string($message.message), \"session for user\") && contains(to_string($message.message), \"has been opened\")\nthen\n  set_field(\"vendor\", \"a10\");\n  set_field(\"event_type\", \"session_opened\");\n  let m = regex(\"session for user \\\\\"(\\\\S+)\\\\\" from (\\\\S+) has been opened\\\\. Session ID assigned is (\\\\d+)\", to_string($message.message), [\"user\",\"src_ip\",\"session_id\"]);\n  set_field(\"a10_user\", m[\"user\"]);\n  set_field(\"src_ip\", m[\"src_ip\"]);\n  set_field(\"a10_session_id\", m[\"session_id\"]);\nend"
}