5 lines
560 B
JSON
5 lines
560 B
JSON
{
|
|
"title": "olt_privilege_mode",
|
|
"description": "BDCOM/OLT-style CLI: user entered privilege mode",
|
|
"source": "rule \"olt_privilege_mode\"\nwhen\n contains(to_string($message.message), \"enter privilege mode\")\nthen\n set_field(\"vendor\", \"bdcom_olt\");\n set_field(\"event_type\", \"cli_privilege_mode\");\n let m = regex(\"User (\\\\S+) enter privilege mode from vty (\\\\d+), level = (\\\\d+)\", to_string($message.message), [\"user\",\"vty\",\"level\"]);\n set_field(\"cli_user\", m[\"user\"]);\n set_field(\"cli_vty\", m[\"vty\"]);\nend"
|
|
}
|