Describe the detection logic as clearly as possible.
Provide one mapping per line in the format: pseudocode_field_name -> siem_field_name. This helps the AI use your specific field names.
pseudocode_field_name -> siem_field_name