Instructions to use JoeiBanana/ai-network-llms with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries
PEFT
How to use JoeiBanana/ai-network-llms with PEFT:
```
Task type is invalid.
```
Notebooks
Google Colab
Kaggle
Local Apps Settings

How to use JoeiBanana/ai-network-llms with llama.cpp:

Install (macOS, Linux)

curl -LsSf https://llama.app/install.sh | sh
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
llama cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
llama cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
./llama-cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
./build/bin/llama-cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Use Docker

docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M

LM Studio
Jan

vLLM

How to use JoeiBanana/ai-network-llms with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "JoeiBanana/ai-network-llms"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "JoeiBanana/ai-network-llms",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M

Ollama
How to use JoeiBanana/ai-network-llms with Ollama:
```
ollama run hf.co/JoeiBanana/ai-network-llms:Q4_K_M
```
Unsloth Desktop

How to use JoeiBanana/ai-network-llms with Pi:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure the model in Pi

# Install Pi:
npm install -g @earendil-works/pi-coding-agent
# Add to ~/.pi/agent/models.json:
{
  "providers": {
    "llama-cpp": {
      "baseUrl": "http://localhost:8080/v1",
      "api": "openai-completions",
      "apiKey": "none",
      "models": [
        {
          "id": "JoeiBanana/ai-network-llms:Q4_K_M"
        }
      ]
    }
  }
}

Run Pi

# Start Pi in your project directory:
pi

Docker Model Runner
How to use JoeiBanana/ai-network-llms with Docker Model Runner:
```
docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M
```

Lemonade

How to use JoeiBanana/ai-network-llms with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull JoeiBanana/ai-network-llms:Q4_K_M

Run and chat with the model

lemonade run user.ai-network-llms-Q4_K_M

List all available models

lemonade list

Hermes Agent

How to use JoeiBanana/ai-network-llms with Hermes Agent:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure Hermes

# Install Hermes:
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
hermes setup
# Point Hermes at the local server:
hermes config set model.provider custom
hermes config set model.base_url http://127.0.0.1:8080/v1
hermes config set model.default JoeiBanana/ai-network-llms:Q4_K_M

Run Hermes

hermes

Atomic Chat

OpenClaw

How to use JoeiBanana/ai-network-llms with OpenClaw:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure OpenClaw

# Install OpenClaw:
npm install -g openclaw@latest
# Register the local server and set it as the default model:
openclaw onboard --non-interactive --mode local \
  --auth-choice custom-api-key \
  --custom-base-url http://127.0.0.1:8080/v1 \
  --custom-model-id "JoeiBanana/ai-network-llms:Q4_K_M" \
  --custom-provider-id llama-cpp \
  --custom-compatibility openai \
  --custom-text-input \
  --accept-risk \
  --skip-health

Run OpenClaw

openclaw agent --local --agent main --message "Hello from Hugging Face"

ai-network-llms / datasets /switch2_dataset_900.jsonl

JoeiBanana

Upload batch 6/8

b6cb568 verified 5 months ago

Raw

History Blame

424 kB

	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 99, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 20, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 20, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 20, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 50, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 20, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 99, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 20, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 20, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 50, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 20, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 20, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 20, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 50, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 10"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 99, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 30"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 99"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 50, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 20"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 40"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 40"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 10"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 30"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 50"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 99"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 20, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 40"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 20"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 10"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 30"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 50"]}
	{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 50"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
	{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 99"]}
	{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}