5 lines
518 B
JSON
5 lines
518 B
JSON
{
|
|
"title": "olt_cli_logout",
|
|
"description": "BDCOM/OLT-style CLI: user logged out from vty",
|
|
"source": "rule \"olt_cli_logout\"\nwhen\n contains(to_string($message.message), \"logouted from\")\nthen\n set_field(\"vendor\", \"bdcom_olt\");\n set_field(\"event_type\", \"cli_logout\");\n let m = regex(\"User (\\\\S+) logouted from (\\\\S+) on vty (\\\\d+)\", to_string($message.message), [\"user\",\"from_ip\",\"vty\"]);\n set_field(\"cli_user\", m[\"user\"]);\n set_field(\"cli_vty\", m[\"vty\"]);\nend"
|
|
}
|