zotac/graylog-deploy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
graylog-deploy/rules
History
byrsapty 98359c7ca3 Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 
Closes the parsing gap the README explicitly called out (no D-Link
parsing, no ZTE ONU alarms) plus adds BDCOM GPON and expands Juniper
coverage (DDoS, PSU/memory/ASIC hardware faults, LACP/BGP/SNMP, config
commit). 58 new rules across 5 vendors, wired into Network Equipment
Parsing's stage 0 ahead of the generic_critical_severity fallback.

Where the same real-world event is reported by multiple vendors
(dying_gasp, onu_offline, optical_low_power, cli_login/cli_logout,
config_saved, interface_link_state, lag_state_change), rules share one
event_type value so dashboards can aggregate across vendors, same
normalization approach as accelppp_interface.

Built directly from the user's CSV signature report, not from real
device log samples - each rule's description says so explicitly. `when`
conditions use plain substring/contains matching on the report's own
pattern text to keep classification robust; regex field extraction is
only added where the source format is unambiguous. Passed offline
checks (JSON validity, every pipeline-referenced rule resolves to a
file, all regex patterns compile). Live compilation against a running
Graylog instance - which caught 2 real bugs during the dashboard/stream
fixes earlier this session - could NOT be completed: the test container
went unreachable mid-session. Re-run install-graylog.sh once it's back
up to confirm these compile before relying on them.
2026-07-29 16:32:18 +03:00
..
rule1_juniper_ntp.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule2_juniper_ssh_ok.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule3_juniper_ssh_failed_tagged.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule4_juniper_ssh_failed_password.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule5_juniper_ui_config_error.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule6_olt_privilege_mode.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule7_olt_logout.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule8_olt_arp_move.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule9_olt_config_write.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule10_accelppp_router_addr_error.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule11_accelppp_radius_accounting.json Add flood alerts, session correlation, focused dashboards, and CI deploy workflow 2026-07-22 21:31:08 +03:00
rule12_accelppp_radius_server_down.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule13_accelppp_no_radius_servers.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule14_accelppp_auth_failed.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule15_conntrack_table_full.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule16_freeradius_login_ok.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule17_freeradius_login_incorrect.json feat: add automated deployment scripts and monitoring configuration for Graylog infrastructure 2026-07-22 04:52:27 +03:00
rule18_generic_critical_severity.json feat: add generic critical severity classification rule and update deployment documentation 2026-07-22 15:19:10 +03:00
rule19_juniper_chassis_alarm.json feat: add Juniper chassis alarm alerting, Discord notifications, and global timezone configuration for accurate syslog timestamp parsing 2026-07-22 18:48:26 +03:00
rule20_accelppp_radius_access_request.json Add flood alerts, session correlation, focused dashboards, and CI deploy workflow 2026-07-22 21:31:08 +03:00
rule21_accelppp_interface_tag.json Add flood alerts, session correlation, focused dashboards, and CI deploy workflow 2026-07-22 21:31:08 +03:00
rule22_accelppp_radius_coa_session_not_found.json Add error/warn-only Vector filter + 5 new pipeline rules + repetition alert 2026-07-23 16:20:13 +03:00
rule23_accelppp_mac_change_detected.json Add error/warn-only Vector filter + 5 new pipeline rules + repetition alert 2026-07-23 16:20:13 +03:00
rule24_accelppp_dhcpv4_short_packet.json Add error/warn-only Vector filter + 5 new pipeline rules + repetition alert 2026-07-23 16:20:13 +03:00
rule25_accelppp_unclassified_error.json Add error/warn-only Vector filter + 5 new pipeline rules + repetition alert 2026-07-23 16:20:13 +03:00
rule26_accelppp_unclassified_warn.json Add error/warn-only Vector filter + 5 new pipeline rules + repetition alert 2026-07-23 16:20:13 +03:00
rule27_bdcom_epon_dying_gasp.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule28_bdcom_epon_onu_config_error.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule29_bdcom_epon_hal_driver_error.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule30_bdcom_epon_onu_info_failed.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule31_bdcom_epon_onu_authenticated.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule32_bdcom_epon_onu_registered.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule33_bdcom_epon_onu_deregistered.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule34_bdcom_epon_oam_status.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule35_bdcom_olt_cli_login.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule36_bdcom_epon_config_saved.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule37_bdcom_gpon_config_saved.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule38_bdcom_epon_interface_link_state.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule39_bdcom_gpon_dying_gasp.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule40_bdcom_gpon_onu_offline.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule41_bdcom_gpon_onu_activate_failed.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule42_bdcom_gpon_onu_disabled.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule43_bdcom_gpon_onu_discovered.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule44_bdcom_gpon_onu_activated.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule45_bdcom_gpon_onu_deactivated.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule46_zte_gpon_dying_gasp.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule47_zte_gpon_onu_signal_degraded.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule48_zte_gpon_onu_lan_los.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule49_zte_epon_dying_gasp.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule50_zte_epon_onu_offline.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule51_zte_gpon_olt_pon_los.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule52_zte_optical_low_power.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule53_zte_power_over_voltage.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule54_zte_alarm_cleared.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule55_zte_cli_login.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule56_zte_cli_logout.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule57_juniper_ddos_violation_set.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule58_juniper_ddos_violation_clear.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule59_juniper_psu_failure.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule60_juniper_memory_parity_error.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule61_juniper_optical_low_power.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule62_juniper_qsfp_eeprom_failed.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule63_juniper_lacp_timeout.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule64_juniper_link_down.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule65_juniper_lag_state_change.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule66_juniper_snmp_auth_violation.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule67_juniper_asic_error.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule68_juniper_bgp_session_reset.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule69_juniper_bgp_addr_not_found.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule70_juniper_ntpd_resource_error.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule71_juniper_ssh_too_many_failures.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule72_juniper_config_commit.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule73_juniper_mgmt_login.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule74_dlink_system_reboot.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule75_dlink_optical_alarm.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule76_dlink_optical_recovered.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule77_dlink_interface_link_state.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule78_dlink_lag_state_change.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule79_dlink_gbic_detected.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule80_dlink_ntp_sync.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule81_dlink_management_ip_changed.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule82_dlink_telnet_login.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule83_dlink_telnet_logout.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00
rule84_dlink_config_saved.json Add pipeline rules for BDCOM EPON/GPON, ZTE, and D-Link from provided log-signature report 2026-07-29 16:32:18 +03:00