[
    {
        "rulename": "overwrite type",
        "if": {
            "classification.type": "infected-system"
        },
        "then": {
            "classification.type": "vulnerable service"
        }
    }
]
