{
  "title": "dlink_telnet_logout",
  "description": "D-Link: admin logout via Telnet/CLI - d'link.csv row 8. Shares the 'cli_logout' event_type with zte_cli_logout for a cross-vendor view. Built from the provided report, not yet verified against real device output.",
  "source": "rule \"dlink_telnet_logout\"\nwhen\n  contains(to_string($message.message), \"Logout through Telnet\")\nthen\n  set_field(\"vendor\", \"dlink\");\n  set_field(\"event_type\", \"cli_logout\");\n  let m = regex(\"IP: (\\\\S+)\", to_string($message.message), [\"src_ip\"]);\n  set_field(\"src_ip\", m[\"src_ip\"]);\nend"
}