{
  "title": "a10_session_closed",
  "description": "A10: admin session closed normally. Built from real captured A10 syslog output.",
  "source": "rule \"a10_session_closed\"\nwhen\n  contains(to_string($message.message), \"Session ID\") && contains(to_string($message.message), \"is now closed\")\nthen\n  set_field(\"vendor\", \"a10\");\n  set_field(\"event_type\", \"session_closed\");\n  let m = regex(\"Session ID (\\\\d+) is now closed\", to_string($message.message), [\"session_id\"]);\n  set_field(\"a10_session_id\", m[\"session_id\"]);\nend"
}