"BAS: all BACnet" bacnet || bacapp
"BAS: BACnet + BBMD" bvlc || bacnet || bacapp
"BAS: BACnet/IP port" udp.port == 47808
"BAS: BACnet errors only" bacapp.type > 4
"BAS: BACnet WriteProperty" bacapp.confirmed_service == 15
"BAS: BACnet ReadProperty" bacapp.confirmed_service == 12
"BAS: BACnet discovery only" udp.port == 47808 and not bacapp.confirmed_service
"BAS: BACnet Analog Inputs" bacapp.objectType == 0
"BAS: all Modbus/TCP" mbtcp
"BAS: Modbus standard port" tcp.port == 502
"BAS: Modbus exceptions" modbus.exception_code
"BAS: TCP retransmissions" tcp.analysis.retransmission
"BAS: OPC UA" opcua
"BAS: ARP (find IP conflicts)" arp
