{
  "title": "olt_ip_arp_moved",
  "description": "BDCOM/OLT-style: IP ARP moved between MACs (possible duplicate IP / flapping)",
  "source": "rule \"olt_ip_arp_moved\"\nwhen\n  contains(to_string($message.message), \"IP ARP:\") && contains(to_string($message.message), \"moved from\")\nthen\n  set_field(\"vendor\", \"bdcom_olt\");\n  set_field(\"event_type\", \"arp_moved\");\n  let m = regex(\"IP ARP: (\\\\S+) moved from (\\\\S+) to (\\\\S+)\", to_string($message.message), [\"ip\",\"from_mac\",\"to_mac\"]);\n  set_field(\"arp_ip\", m[\"ip\"]);\n  set_field(\"arp_from_mac\", m[\"from_mac\"]);\n  set_field(\"arp_to_mac\", m[\"to_mac\"]);\nend"
}