{
  "title": "juniper_ntp_unreachable",
  "description": "Juniper xntpd NTP unreachable",
  "source": "rule \"juniper_ntp_unreachable\"\nwhen\n  contains(to_string($message.message), \"NTP Server\") && contains(to_string($message.message), \"is Unreachable\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"ntp_unreachable\");\n  let m = regex(\"NTP Server (\\\\S+) is Unreachable\", to_string($message.message), [\"ntp_server\"]);\n  set_field(\"ntp_server\", m[\"ntp_server\"]);\nend"
}