5 lines
646 B
JSON
5 lines
646 B
JSON
{
|
|
"title": "juniper_ui_configuration_error",
|
|
"description": "Juniper UI_CONFIGURATION_ERROR process/path/statement",
|
|
"source": "rule \"juniper_ui_configuration_error\"\nwhen\n contains(to_string($message.message), \"UI_CONFIGURATION_ERROR\")\nthen\n set_field(\"vendor\", \"juniper\");\n set_field(\"event_type\", \"config_error\");\n let m = regex(\"Process: (\\\\S+), path: \\\\[(.*?)\\\\], statement: (.*)\", to_string($message.message), [\"process\",\"path\",\"statement\"]);\n set_field(\"config_process\", m[\"process\"]);\n set_field(\"config_path\", m[\"path\"]);\n set_field(\"config_statement\", m[\"statement\"]);\nend"
|
|
}
|