{
  "title": "dlink_ntp_sync",
  "description": "D-Link: system clock synced with an SNTP server - d'link.csv row 6. Distinct concept from juniper_ntp_unreachable (that's an error, this is a routine sync notice). Built from the provided report, not yet verified against real device output.",
  "source": "rule \"dlink_ntp_sync\"\nwhen\n  contains(to_string($message.message), \"SNTP-6: New Time\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"ntp_sync\");\n  let m = regex(\"ServerIpAddress:\\\\s*(\\\\S+)\", to_string($message.message), [\"ntp_server\"]);\n  set_field(\"ntp_server\", m[\"ntp_server\"]);\nend"
}