{
  "title": "juniper_snmp_auth_violation",
  "description": "Juniper snmpd: SNMP poll from a disallowed address or with a wrong community string - juniper.csv row 8. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"juniper_snmp_auth_violation\"\nwhen\n  contains(to_string($message.message), \"SNMPD_AUTH_RESTRICTED_ADDRESS\") || contains(to_string($message.message), \"SNMPD_AUTH_FAILURE\")\nthen\n  set_field(\"vendor\", \"juniper\");\n  set_field(\"event_type\", \"snmp_auth_violation\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}