From 900f4f9f2eda616397ed555c11dc32d09fc2dc31 Mon Sep 17 00:00:00 2001
From: "peter.bednar@gamo.sk" <peter.bednar@gamo.sk>
Date: Fri, 24 Oct 2025 11:31:34 +0200
Subject: [PATCH] adding mikrotik rule

---
 local_mikrotik_rules.xml | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 local_mikrotik_rules.xml

diff --git a/local_mikrotik_rules.xml b/local_mikrotik_rules.xml
new file mode 100644
index 0000000..256a55a
--- /dev/null
+++ b/local_mikrotik_rules.xml
@@ -0,0 +1,30 @@
+<group name="Mikrotik,">
+  <rule id="110000" level="0">
+    <decoded_as>mikrotik</decoded_as>
+    <description>Mikrotik-Event</description>
+  </rule>
+
+  <rule id="110001" level="5">
+    <if_sid>110000</if_sid>
+    <match>dhcp-client on ether</match>
+    <description>MikroTik dhcp-client received an IP address $(ip_address)</description>
+  </rule>
+
+  <rule id="110002" level="5">
+    <if_sid>110000</if_sid>
+    <match>rebooted</match>
+    <description>MikroTik router rebooted</description>
+  </rule>
+
+  <rule id="110003" level="5">
+    <if_sid>110000</if_sid>
+    <match>logged out from</match>
+    <description>MikroTik user logged out via $(protocol)</description>
+  </rule>
+
+  <rule id="110004" level="5">
+    <if_sid>110000</if_sid>
+    <match>logged in from</match>
+    <description>MikroTik user logged in from $(ip_address) via $(protocol)</description>
+  </rule>
+</group>