{
  "title": "accelppp_radius_access_request",
  "description": "accel-ppp: RADIUS Access-Request (subscriber authentication attempt - the session-start event, before Accounting-Request Start) - extracts the same session-correlation fields as accelppp_radius_accounting so a session can be traced from initial auth through to termination",
  "source": "rule \"accelppp_radius_access_request\"\nwhen\n  contains(to_string($message.message), \"Access-Request\")\nthen\n  set_field(\"vendor\", \"accel-ppp\");\n  set_field(\"event_type\", \"radius_access_request\");\n  let m = regex(\"(\\\\S+): send \\\\[RADIUS\\\\(\\\\d+\\\\) Access-Request.*?<User-Name \\\"(\\\\S+)\\\">.*?<NAS-Identifier \\\"(\\\\S+)\\\">.*?<Calling-Station-Id \\\"(\\\\S+)\\\">\", to_string($message.message), [\"interface\",\"radius_username\",\"nas_identifier\",\"calling_station_id\"]);\n  set_field(\"accelppp_interface\", m[\"interface\"]);\n  set_field(\"radius_username\", m[\"radius_username\"]);\n  set_field(\"nas_identifier\", m[\"nas_identifier\"]);\n  set_field(\"calling_station_id\", m[\"calling_station_id\"]);\nend"
}