5 lines
653 B
JSON
5 lines
653 B
JSON
{
|
|
"title": "olt_ip_arp_moved",
|
|
"description": "BDCOM/OLT-style: IP ARP moved between MACs (possible duplicate IP / flapping)",
|
|
"source": "rule \"olt_ip_arp_moved\"\nwhen\n contains(to_string($message.message), \"IP ARP:\") && contains(to_string($message.message), \"moved from\")\nthen\n set_field(\"vendor\", \"bdcom_olt\");\n set_field(\"event_type\", \"arp_moved\");\n let m = regex(\"IP ARP: (\\\\S+) moved from (\\\\S+) to (\\\\S+)\", to_string($message.message), [\"ip\",\"from_mac\",\"to_mac\"]);\n set_field(\"arp_ip\", m[\"ip\"]);\n set_field(\"arp_from_mac\", m[\"from_mac\"]);\n set_field(\"arp_to_mac\", m[\"to_mac\"]);\nend"
|
|
}
|