Instructions to use JoeiBanana/ai-network-llms with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries
PEFT
How to use JoeiBanana/ai-network-llms with PEFT:
```
Task type is invalid.
```
Notebooks
Google Colab
Kaggle
Local Apps Settings

How to use JoeiBanana/ai-network-llms with llama.cpp:

Install (macOS, Linux)

curl -LsSf https://llama.app/install.sh | sh
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
llama cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
llama cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
./llama-cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
./build/bin/llama-cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Use Docker

docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M

LM Studio
Jan

vLLM

How to use JoeiBanana/ai-network-llms with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "JoeiBanana/ai-network-llms"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "JoeiBanana/ai-network-llms",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M

Ollama
How to use JoeiBanana/ai-network-llms with Ollama:
```
ollama run hf.co/JoeiBanana/ai-network-llms:Q4_K_M
```
Unsloth Desktop

How to use JoeiBanana/ai-network-llms with Pi:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure the model in Pi

# Install Pi:
npm install -g @earendil-works/pi-coding-agent
# Add to ~/.pi/agent/models.json:
{
  "providers": {
    "llama-cpp": {
      "baseUrl": "http://localhost:8080/v1",
      "api": "openai-completions",
      "apiKey": "none",
      "models": [
        {
          "id": "JoeiBanana/ai-network-llms:Q4_K_M"
        }
      ]
    }
  }
}

Run Pi

# Start Pi in your project directory:
pi

Docker Model Runner
How to use JoeiBanana/ai-network-llms with Docker Model Runner:
```
docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M
```

Lemonade

How to use JoeiBanana/ai-network-llms with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull JoeiBanana/ai-network-llms:Q4_K_M

Run and chat with the model

lemonade run user.ai-network-llms-Q4_K_M

List all available models

lemonade list

Hermes Agent

How to use JoeiBanana/ai-network-llms with Hermes Agent:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure Hermes

# Install Hermes:
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
hermes setup
# Point Hermes at the local server:
hermes config set model.provider custom
hermes config set model.base_url http://127.0.0.1:8080/v1
hermes config set model.default JoeiBanana/ai-network-llms:Q4_K_M

Run Hermes

hermes

Atomic Chat

OpenClaw

How to use JoeiBanana/ai-network-llms with OpenClaw:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure OpenClaw

# Install OpenClaw:
npm install -g openclaw@latest
# Register the local server and set it as the default model:
openclaw onboard --non-interactive --mode local \
  --auth-choice custom-api-key \
  --custom-base-url http://127.0.0.1:8080/v1 \
  --custom-model-id "JoeiBanana/ai-network-llms:Q4_K_M" \
  --custom-provider-id llama-cpp \
  --custom-compatibility openai \
  --custom-text-input \
  --accept-risk \
  --skip-health

Run OpenClaw

openclaw agent --local --agent main --message "Hello from Hugging Face"

ai-network-llms / datasets /llm_s_dataset_v2.jsonl

JoeiBanana

Upload batch 5/8

8f9d821 verified 5 months ago

Raw

History Blame

33.2 kB

	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.219.112", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.156.8", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.31.136", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.138.83", "event": "port scan", "severity": "high"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.6.221", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.7.130", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.227.147", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.134.59", "event": "acl block", "severity": "critical"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'bgp session flap' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.238.78", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.57.143", "event": "acl block", "severity": "medium"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.37.36", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.30.252", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'arp spoofing' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.176.204", "event": "arp spoofing", "severity": "low"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.136.78", "event": "dns exfiltration", "severity": "high"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.19.238", "event": "dhcp starvation", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.244.173", "event": "acl block", "severity": "high"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'arp spoofing' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.124.44", "event": "arp spoofing", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
	{"instruction": "Wazuh detected event 'bgp session flap' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.34.157", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
	{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.138.206", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
	{"instruction": "Wazuh detected event 'high cpu' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.232.238", "event": "high cpu", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.203.2", "event": "dns exfiltration", "severity": "medium"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.110.16", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.242.25", "event": "dns exfiltration", "severity": "medium"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.100.229", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.102.91", "event": "acl block", "severity": "high"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.28.8", "event": "port scan", "severity": "high"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.253.45", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.123.127", "event": "dhcp starvation", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'bgp session flap' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.85.117", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
	{"instruction": "Wazuh detected event 'arp spoofing' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.63.3", "event": "arp spoofing", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.82.69", "event": "acl block", "severity": "medium"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'arp spoofing' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.6.148", "event": "arp spoofing", "severity": "critical"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.212.253", "event": "port scan", "severity": "medium"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'bgp session flap' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.165.189", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.143.73", "event": "dns exfiltration", "severity": "critical"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'high cpu' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.68.221", "event": "high cpu", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
	{"instruction": "Wazuh detected event 'bgp session flap' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.160.70", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.129.230", "event": "dns exfiltration", "severity": "high"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'arp spoofing' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.252.159", "event": "arp spoofing", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
	{"instruction": "Wazuh detected event 'high cpu' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.149.233", "event": "high cpu", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.218.252", "event": "dhcp starvation", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'bgp session flap' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.57.87", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
	{"instruction": "Wazuh detected event 'arp spoofing' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.201.46", "event": "arp spoofing", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.254.14", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'high cpu' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.10.8", "event": "high cpu", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.28.185", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.157.241", "event": "port scan", "severity": "medium"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'arp spoofing' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.228.171", "event": "arp spoofing", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.61.212", "event": "dhcp starvation", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.156.109", "event": "port scan", "severity": "low"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.66.115", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.12.143", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.81.26", "event": "dhcp starvation", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.63.209", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.206.66", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.18.21", "event": "dns exfiltration", "severity": "medium"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.8.166", "event": "dhcp starvation", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.244.81", "event": "acl block", "severity": "low"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'arp spoofing' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.11.214", "event": "arp spoofing", "severity": "critical"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.241.157", "event": "dns exfiltration", "severity": "low"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.78.99", "event": "acl block", "severity": "low"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'high cpu' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.174.143", "event": "high cpu", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.15.153", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.71.111", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.139.119", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'high cpu' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.253.117", "event": "high cpu", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.47.14", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.54.20", "event": "acl block", "severity": "medium"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'bgp session flap' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.127.78", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.217.49", "event": "dhcp starvation", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.78.208", "event": "acl block", "severity": "critical"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.231.59", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.115.69", "event": "dns exfiltration", "severity": "critical"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.147.13", "event": "port scan", "severity": "high"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'high cpu' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.51.3", "event": "high cpu", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.20.45", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.224.94", "event": "dhcp starvation", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.43.118", "event": "dns exfiltration", "severity": "high"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'high cpu' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.152.113", "event": "high cpu", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.145.22", "event": "port scan", "severity": "medium"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.244.73", "event": "port scan", "severity": "medium"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.188.251", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.113.143", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.192.66", "event": "port scan", "severity": "high"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.30.224", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'bgp session flap' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.8.96", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.43.251", "event": "dns exfiltration", "severity": "medium"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.164.34", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.96.66", "event": "dhcp starvation", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'dhcp starvation' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.42.163", "event": "dhcp starvation", "severity": "low"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
	{"instruction": "Wazuh detected event 'bgp session flap' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.113.241", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.184.26", "event": "acl block", "severity": "low"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.171.212", "event": "dns exfiltration", "severity": "critical"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'high cpu' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.15.186", "event": "high cpu", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.220.231", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'dns exfiltration' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.221.105", "event": "dns exfiltration", "severity": "critical"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
	{"instruction": "Wazuh detected event 'acl block' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.178.89", "event": "acl block", "severity": "critical"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
	{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.36.182", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging \| include SSH", "show ip interface brief", "show access-lists", "show arp"]}
	{"instruction": "Wazuh detected event 'port scan' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.129.187", "event": "port scan", "severity": "critical"}, "requested_show": ["show logging \| include DENY", "show ip traffic", "show access-lists", "show firewall"]}
	{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.97.66", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}