{
  "title": "dlink_optical_alarm",
  "description": "D-Link: optic module exceeded a low alarm/warning threshold (Rx/Tx power, bias current, or supply voltage) - d'link.csv row 3. Shares the 'optical_low_power' event_type with juniper_optical_low_power and zte_optical_low_power for a cross-vendor view, though D-Link's alarm covers more metrics than just Rx power. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"dlink_optical_alarm\"\nwhen\n  contains(to_string($message.message), \"optic module\") && (contains(to_string($message.message), \"exceeded the low alarm threshold\") || contains(to_string($message.message), \"exceeded the low warning threshold\"))\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"optical_low_power\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}