Instructions to use JoeiBanana/ai-network-llms with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries
PEFT
How to use JoeiBanana/ai-network-llms with PEFT:
```
Task type is invalid.
```
Notebooks
Google Colab
Kaggle
Local Apps Settings

How to use JoeiBanana/ai-network-llms with llama.cpp:

Install (macOS, Linux)

curl -LsSf https://llama.app/install.sh | sh
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
llama cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
llama cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
./llama-cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
./build/bin/llama-cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Use Docker

docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M

LM Studio
Jan

vLLM

How to use JoeiBanana/ai-network-llms with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "JoeiBanana/ai-network-llms"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "JoeiBanana/ai-network-llms",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M

Ollama
How to use JoeiBanana/ai-network-llms with Ollama:
```
ollama run hf.co/JoeiBanana/ai-network-llms:Q4_K_M
```
Unsloth Desktop

How to use JoeiBanana/ai-network-llms with Pi:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure the model in Pi

# Install Pi:
npm install -g @earendil-works/pi-coding-agent
# Add to ~/.pi/agent/models.json:
{
  "providers": {
    "llama-cpp": {
      "baseUrl": "http://localhost:8080/v1",
      "api": "openai-completions",
      "apiKey": "none",
      "models": [
        {
          "id": "JoeiBanana/ai-network-llms:Q4_K_M"
        }
      ]
    }
  }
}

Run Pi

# Start Pi in your project directory:
pi

Docker Model Runner
How to use JoeiBanana/ai-network-llms with Docker Model Runner:
```
docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M
```

Lemonade

How to use JoeiBanana/ai-network-llms with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull JoeiBanana/ai-network-llms:Q4_K_M

Run and chat with the model

lemonade run user.ai-network-llms-Q4_K_M

List all available models

lemonade list

Hermes Agent

How to use JoeiBanana/ai-network-llms with Hermes Agent:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure Hermes

# Install Hermes:
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
hermes setup
# Point Hermes at the local server:
hermes config set model.provider custom
hermes config set model.base_url http://127.0.0.1:8080/v1
hermes config set model.default JoeiBanana/ai-network-llms:Q4_K_M

Run Hermes

hermes

Atomic Chat

OpenClaw

How to use JoeiBanana/ai-network-llms with OpenClaw:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure OpenClaw

# Install OpenClaw:
npm install -g openclaw@latest
# Register the local server and set it as the default model:
openclaw onboard --non-interactive --mode local \
  --auth-choice custom-api-key \
  --custom-base-url http://127.0.0.1:8080/v1 \
  --custom-model-id "JoeiBanana/ai-network-llms:Q4_K_M" \
  --custom-provider-id llama-cpp \
  --custom-compatibility openai \
  --custom-text-input \
  --accept-risk \
  --skip-health

Run OpenClaw

openclaw agent --local --agent main --message "Hello from Hugging Face"

ai-network-llms / datasets /bgp1_dataset_v2_900.jsonl

JoeiBanana

Upload batch 5/8

8f9d821 verified 5 months ago

Raw

History Blame Contribute Delete

485 kB

	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.130 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.115"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.115 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.166 timers 60 180", "clear ip bgp 192.0.2.166"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.173"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.173", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.173 timers 30 180", "clear ip bgp 192.0.2.173"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.79 timers 60 180", "clear ip bgp 192.0.2.79"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.200"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.200", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.200 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.204"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.204", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.204 timers 30 180", "clear ip bgp 192.0.2.204"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.183"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.183 timers 60 180", "clear ip bgp 192.0.2.183"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.40"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.40", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.40 timers 60 180", "clear ip bgp 192.0.2.40"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.230", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.230 timers 30 180", "clear ip bgp 192.0.2.230"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.193"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.193 timers 60 180", "clear ip bgp 192.0.2.193"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.37"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.37 timers 60 180", "clear ip bgp 192.0.2.37"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.105", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.105 timers 30 180", "clear ip bgp 192.0.2.105"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.91 timers 30 180", "clear ip bgp 192.0.2.91"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.188"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.188", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.188 timers 30 180", "clear ip bgp 192.0.2.188"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.122"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.122", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.122 timers 60 180", "clear ip bgp 192.0.2.122"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.136"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.136 timers 30 180", "clear ip bgp 192.0.2.136"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.102"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.102", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.102 timers 60 180", "clear ip bgp 192.0.2.102"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.237"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.237", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.237 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.243"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.243 timers 30 180", "clear ip bgp 192.0.2.243"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.139"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.139 timers 30 180", "clear ip bgp 192.0.2.139"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.212"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.212 timers 30 180", "clear ip bgp 192.0.2.212"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.87", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.87 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.108"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.108", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.108 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.154"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.154 timers 60 180", "clear ip bgp 192.0.2.154"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.10"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.10", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.10 timers 30 180", "clear ip bgp 192.0.2.10"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.35 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.2"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.2 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.128", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.128 timers 60 180", "clear ip bgp 192.0.2.128"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.48"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.48", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.48 timers 30 180", "clear ip bgp 192.0.2.48"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.160"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.160 timers 30 180", "clear ip bgp 192.0.2.160"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.76"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.76", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.76 timers 30 180", "clear ip bgp 192.0.2.76"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.77"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.77 timers 30 180", "clear ip bgp 192.0.2.77"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.223"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.223", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.223 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.53"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.53 timers 30 180", "clear ip bgp 192.0.2.53"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.210"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.210 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.14"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.14 timers 60 180", "clear ip bgp 192.0.2.14"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.215"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.215 timers 60 180", "clear ip bgp 192.0.2.215"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.23", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.23 timers 60 180", "clear ip bgp 192.0.2.23"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.225"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.225", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.225 timers 60 180", "clear ip bgp 192.0.2.225"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.7 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.184 timers 30 180", "clear ip bgp 192.0.2.184"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.104 timers 30 180", "clear ip bgp 192.0.2.104"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.1"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.1 timers 30 180", "clear ip bgp 192.0.2.1"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.168 timers 30 180", "clear ip bgp 192.0.2.168"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.155"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.155 timers 60 180", "clear ip bgp 192.0.2.155"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.31"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.31 timers 60 180", "clear ip bgp 192.0.2.31"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.49"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.49", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.49 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.191"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.191", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.191 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.13"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.13", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.13 timers 60 180", "clear ip bgp 192.0.2.13"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.79 timers 30 180", "clear ip bgp 192.0.2.79"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.116", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.116 timers 60 180", "clear ip bgp 192.0.2.116"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.181 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.204"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.204 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.237"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.237 timers 30 180", "clear ip bgp 192.0.2.237"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.65"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.65 timers 30 180", "clear ip bgp 192.0.2.65"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.21"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.21", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.21 timers 60 180", "clear ip bgp 192.0.2.21"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.22"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.22", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.22 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.185"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.185", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.185 timers 60 180", "clear ip bgp 192.0.2.185"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.147"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.147 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.86"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.86", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.86 timers 60 180", "clear ip bgp 192.0.2.86"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.31"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.31 timers 30 180", "clear ip bgp 192.0.2.31"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.11"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.11 timers 60 180", "clear ip bgp 192.0.2.11"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.101"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.101 timers 60 180", "clear ip bgp 192.0.2.101"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.146"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.146 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.75"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.75 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.184"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.184 timers 30 180", "clear ip bgp 192.0.2.184"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.199"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.199", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.199 timers 30 180", "clear ip bgp 192.0.2.199"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.7"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.7", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.7 timers 30 180", "clear ip bgp 192.0.2.7"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.29"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.29", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.29 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.142"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.142 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.157"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.157 timers 60 180", "clear ip bgp 192.0.2.157"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.246"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.246 timers 30 180", "clear ip bgp 192.0.2.246"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.200"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.200", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.200 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.128"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.128 timers 30 180", "clear ip bgp 192.0.2.128"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.83", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.83 timers 60 180", "clear ip bgp 192.0.2.83"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.214"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.214", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.214 timers 60 180", "clear ip bgp 192.0.2.214"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.1"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.1 timers 60 180", "clear ip bgp 192.0.2.1"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.206"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.206", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.206 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.55 timers 30 180", "clear ip bgp 192.0.2.55"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.109", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.109 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.109", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.109 timers 30 180", "clear ip bgp 192.0.2.109"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.176"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.176 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.32"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.32", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.32 timers 30 180", "clear ip bgp 192.0.2.32"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.166 timers 60 180", "clear ip bgp 192.0.2.166"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.163"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.163", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.163 timers 60 180", "clear ip bgp 192.0.2.163"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.193"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.193 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.216"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.216 timers 60 180", "clear ip bgp 192.0.2.216"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.93"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.93", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.93 timers 60 180", "clear ip bgp 192.0.2.93"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.134", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.134 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.219"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.219", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.219 timers 30 180", "clear ip bgp 192.0.2.219"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.108"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.108", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.108 timers 60 180", "clear ip bgp 192.0.2.108"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.117"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.117 timers 60 180", "clear ip bgp 192.0.2.117"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.78"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.78 timers 60 180", "clear ip bgp 192.0.2.78"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.85"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.85 timers 60 180", "clear ip bgp 192.0.2.85"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.220"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.220", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.220 timers 30 180", "clear ip bgp 192.0.2.220"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.3 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.52", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.52 timers 30 180", "clear ip bgp 192.0.2.52"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.241"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.241 timers 60 180", "clear ip bgp 192.0.2.241"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.210"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.210 timers 30 180", "clear ip bgp 192.0.2.210"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.116 timers 30 180", "clear ip bgp 192.0.2.116"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.83 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.101"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.101 timers 60 180", "clear ip bgp 192.0.2.101"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.234"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.234", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.234 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.189 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.162"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.162 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.212"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.212 timers 60 180", "clear ip bgp 192.0.2.212"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.1"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.1 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.35 timers 60 180", "clear ip bgp 192.0.2.35"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.187", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.187 timers 30 180", "clear ip bgp 192.0.2.187"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.171"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.171 timers 60 180", "clear ip bgp 192.0.2.171"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.238"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.238", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.238 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.187"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.187 timers 30 180", "clear ip bgp 192.0.2.187"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.216"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.216 timers 60 180", "clear ip bgp 192.0.2.216"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.60"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.60 timers 30 180", "clear ip bgp 192.0.2.60"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.80 timers 60 180", "clear ip bgp 192.0.2.80"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.84"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.84", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.84 timers 60 180", "clear ip bgp 192.0.2.84"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.252"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.252 timers 30 180", "clear ip bgp 192.0.2.252"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.227"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.227 timers 30 180", "clear ip bgp 192.0.2.227"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.113"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.113 timers 60 180", "clear ip bgp 192.0.2.113"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.241 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.7", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.7 timers 60 180", "clear ip bgp 192.0.2.7"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.55"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.55 timers 30 180", "clear ip bgp 192.0.2.55"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.181"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.181 timers 30 180", "clear ip bgp 192.0.2.181"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.26"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.26 timers 30 180", "clear ip bgp 192.0.2.26"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.78"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.78", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.78 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.34"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.34 timers 60 180", "clear ip bgp 192.0.2.34"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.52 timers 60 180", "clear ip bgp 192.0.2.52"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.43"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.43 timers 30 180", "clear ip bgp 192.0.2.43"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.83", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.83 timers 60 180", "clear ip bgp 192.0.2.83"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.119"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.119 timers 30 180", "clear ip bgp 192.0.2.119"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.55"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.55", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.55 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.129"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.129", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.129 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.211"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.211", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.211 timers 60 180", "clear ip bgp 192.0.2.211"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.187 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.122", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.122 timers 30 180", "clear ip bgp 192.0.2.122"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.89 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.95"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.95", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.95 timers 60 180", "clear ip bgp 192.0.2.95"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.114"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.114 timers 30 180", "clear ip bgp 192.0.2.114"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.126"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.126 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.253"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.253", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.253 timers 60 180", "clear ip bgp 192.0.2.253"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.240"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.240", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.240 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.45"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.45 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.202"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.202 timers 30 180", "clear ip bgp 192.0.2.202"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.228", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.228 timers 30 180", "clear ip bgp 192.0.2.228"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.88"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.88 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.217"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.217", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.217 timers 30 180", "clear ip bgp 192.0.2.217"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.228 timers 60 180", "clear ip bgp 192.0.2.228"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.53"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.53", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.53 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.74"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.74", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.74 timers 30 180", "clear ip bgp 192.0.2.74"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.227"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.227", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.227 timers 60 180", "clear ip bgp 192.0.2.227"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.150"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.150 timers 30 180", "clear ip bgp 192.0.2.150"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.134"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.134", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.134 timers 60 180", "clear ip bgp 192.0.2.134"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.173"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.173 timers 30 180", "clear ip bgp 192.0.2.173"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.220"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.220 timers 30 180", "clear ip bgp 192.0.2.220"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.106"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.106", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.106 timers 60 180", "clear ip bgp 192.0.2.106"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.163"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.163", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.163 timers 60 180", "clear ip bgp 192.0.2.163"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.200"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.200", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.200 timers 30 180", "clear ip bgp 192.0.2.200"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.241"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.241 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.138 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.231", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.231 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.138 timers 60 180", "clear ip bgp 192.0.2.138"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.68"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.68", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.68 timers 30 180", "clear ip bgp 192.0.2.68"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.188"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.188", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.188 timers 30 180", "clear ip bgp 192.0.2.188"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.163"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.163", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.163 timers 60 180", "clear ip bgp 192.0.2.163"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.145"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.145 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.78"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.78", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.78 timers 30 180", "clear ip bgp 192.0.2.78"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.109 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.116 timers 60 180", "clear ip bgp 192.0.2.116"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.19"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.19 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.56"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.56", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.56 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.93"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.93", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.93 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.134"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.134 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.73"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.73 timers 60 180", "clear ip bgp 192.0.2.73"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.198"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.198 timers 60 180", "clear ip bgp 192.0.2.198"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.253"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.253", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.253 timers 30 180", "clear ip bgp 192.0.2.253"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.248 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.9", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.9 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.43"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.43 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.210"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.210 timers 30 180", "clear ip bgp 192.0.2.210"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.24 timers 60 180", "clear ip bgp 192.0.2.24"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.210"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.210 timers 30 180", "clear ip bgp 192.0.2.210"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.228 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.80 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.87"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.87 timers 60 180", "clear ip bgp 192.0.2.87"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.161 timers 30 180", "clear ip bgp 192.0.2.161"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.168 timers 30 180", "clear ip bgp 192.0.2.168"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.88", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.88 timers 30 180", "clear ip bgp 192.0.2.88"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.37"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.37 timers 60 180", "clear ip bgp 192.0.2.37"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.1"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.1", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.1 timers 30 180", "clear ip bgp 192.0.2.1"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.118"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.118 timers 30 180", "clear ip bgp 192.0.2.118"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.250"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.250 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.200"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.200", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.200 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.165"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.165", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.165 timers 30 180", "clear ip bgp 192.0.2.165"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.220"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.220", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.220 timers 30 180", "clear ip bgp 192.0.2.220"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.13"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.13 timers 60 180", "clear ip bgp 192.0.2.13"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.197"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.197", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.197 timers 30 180", "clear ip bgp 192.0.2.197"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.186"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.186 timers 60 180", "clear ip bgp 192.0.2.186"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.3 timers 60 180", "clear ip bgp 192.0.2.3"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.197"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.197 timers 60 180", "clear ip bgp 192.0.2.197"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.178"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.178 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.48"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.48", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.48 timers 60 180", "clear ip bgp 192.0.2.48"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.203"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.203 timers 60 180", "clear ip bgp 192.0.2.203"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.145 timers 60 180", "clear ip bgp 192.0.2.145"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.77"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.77 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.65"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.65 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.103"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.103", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.103 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.233"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.233 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.227"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.227 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.207 timers 30 180", "clear ip bgp 192.0.2.207"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.151", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.151 timers 60 180", "clear ip bgp 192.0.2.151"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.145"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.145", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.145 timers 60 180", "clear ip bgp 192.0.2.145"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.216"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.216 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.21 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.187 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.206"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.206 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.42 timers 60 180", "clear ip bgp 192.0.2.42"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.254"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.254", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.254 timers 60 180", "clear ip bgp 192.0.2.254"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.82"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.82", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.82 timers 60 180", "clear ip bgp 192.0.2.82"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.127"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.127", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.127 timers 60 180", "clear ip bgp 192.0.2.127"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.89", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.89 timers 30 180", "clear ip bgp 192.0.2.89"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.61"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.61 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.37"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.37 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.205"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.205 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.90"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.90", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.90 timers 30 180", "clear ip bgp 192.0.2.90"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.248 timers 30 180", "clear ip bgp 192.0.2.248"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.2"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.2 timers 30 180", "clear ip bgp 192.0.2.2"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.99"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.99 timers 30 180", "clear ip bgp 192.0.2.99"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.149"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.149 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.75 timers 30 180", "clear ip bgp 192.0.2.75"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.205"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.205 timers 30 180", "clear ip bgp 192.0.2.205"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.14"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.14 timers 30 180", "clear ip bgp 192.0.2.14"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.95"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.95 timers 30 180", "clear ip bgp 192.0.2.95"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.2"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.2 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.130"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.130 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.124"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.124", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.124 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.147"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.147", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.147 timers 60 180", "clear ip bgp 192.0.2.147"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.225"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.225", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.225 timers 60 180", "clear ip bgp 192.0.2.225"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.178"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.178 timers 30 180", "clear ip bgp 192.0.2.178"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.46"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.46", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.46 timers 60 180", "clear ip bgp 192.0.2.46"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.71"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.71", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.71 timers 30 180", "clear ip bgp 192.0.2.71"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.24 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.136"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.136 timers 60 180", "clear ip bgp 192.0.2.136"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.156", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.156 timers 30 180", "clear ip bgp 192.0.2.156"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.53"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.53", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.53 timers 60 180", "clear ip bgp 192.0.2.53"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.70 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.12"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.12", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.12 timers 60 180", "clear ip bgp 192.0.2.12"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.125"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.125", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.125 timers 60 180", "clear ip bgp 192.0.2.125"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.197"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.197", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.197 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.149"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.149 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.18", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.18 timers 30 180", "clear ip bgp 192.0.2.18"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.229"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.229", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.229 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.34"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.34 timers 60 180", "clear ip bgp 192.0.2.34"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.148"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.148 timers 60 180", "clear ip bgp 192.0.2.148"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.92"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.92 timers 60 180", "clear ip bgp 192.0.2.92"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.63 timers 30 180", "clear ip bgp 192.0.2.63"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.211 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.94"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.94 timers 30 180", "clear ip bgp 192.0.2.94"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.37"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.37 timers 60 180", "clear ip bgp 192.0.2.37"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.112"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.112 timers 30 180", "clear ip bgp 192.0.2.112"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.206"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.206", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.206 timers 30 180", "clear ip bgp 192.0.2.206"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.84"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.84", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.84 timers 30 180", "clear ip bgp 192.0.2.84"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.130 timers 60 180", "clear ip bgp 192.0.2.130"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.204"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.204 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.149"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.149 timers 30 180", "clear ip bgp 192.0.2.149"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.97"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.97", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.97 timers 60 180", "clear ip bgp 192.0.2.97"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.243"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.243 timers 60 180", "clear ip bgp 192.0.2.243"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.198"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.198", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.198 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.7"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.7 timers 30 180", "clear ip bgp 192.0.2.7"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.177"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.177", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.177 timers 30 180", "clear ip bgp 192.0.2.177"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.225"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.225", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.225 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.213 timers 30 180", "clear ip bgp 192.0.2.213"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.122", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.122 timers 60 180", "clear ip bgp 192.0.2.122"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.77"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.77 timers 60 180", "clear ip bgp 192.0.2.77"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.15 timers 30 180", "clear ip bgp 192.0.2.15"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.200"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.200", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.200 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.252"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.252", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.252 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.181 timers 30 180", "clear ip bgp 192.0.2.181"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.47 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.6"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.6 timers 30 180", "clear ip bgp 192.0.2.6"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.201"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.201", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.201 timers 60 180", "clear ip bgp 192.0.2.201"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.105", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.105 timers 60 180", "clear ip bgp 192.0.2.105"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.121"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.121", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.121 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.142"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.142 timers 60 180", "clear ip bgp 192.0.2.142"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.193"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.193", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.193 timers 60 180", "clear ip bgp 192.0.2.193"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.74"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.74", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.74 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.224"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.224 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.204"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.204 timers 60 180", "clear ip bgp 192.0.2.204"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.149"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.149", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.149 timers 30 180", "clear ip bgp 192.0.2.149"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.59", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.59 timers 30 180", "clear ip bgp 192.0.2.59"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.20 timers 30 180", "clear ip bgp 192.0.2.20"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.214"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.214 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.218"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.218", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.218 timers 30 180", "clear ip bgp 192.0.2.218"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.222"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.222 timers 60 180", "clear ip bgp 192.0.2.222"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.117"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.117", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.117 timers 60 180", "clear ip bgp 192.0.2.117"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.98"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.98 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.253"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.253", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.253 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.167"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.167 timers 30 180", "clear ip bgp 192.0.2.167"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.36"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.36", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.36 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.51"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.51 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.50"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.50 timers 60 180", "clear ip bgp 192.0.2.50"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.109", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.109 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.62"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.62", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.62 timers 60 180", "clear ip bgp 192.0.2.62"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.152"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.152", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.152 timers 30 180", "clear ip bgp 192.0.2.152"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.147"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.147", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.147 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.155"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.155", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.155 timers 60 180", "clear ip bgp 192.0.2.155"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.74"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.74 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.18"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.18", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.18 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.184 timers 60 180", "clear ip bgp 192.0.2.184"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.224"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.224 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.27"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.27 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.33"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.33 timers 60 180", "clear ip bgp 192.0.2.33"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.92"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.92", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.92 timers 60 180", "clear ip bgp 192.0.2.92"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.138"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.138", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.138 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.18", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.18 timers 60 180", "clear ip bgp 192.0.2.18"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.239"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.239", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.239 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.178"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.178 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.67"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.67", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.67 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.108 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.96"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.96", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.96 timers 30 180", "clear ip bgp 192.0.2.96"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.124"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.124", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.124 timers 30 180", "clear ip bgp 192.0.2.124"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.136"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.136 timers 60 180", "clear ip bgp 192.0.2.136"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.250"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.250", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.250 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.231"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.231 timers 30 180", "clear ip bgp 192.0.2.231"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.114"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.114", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.114 timers 60 180", "clear ip bgp 192.0.2.114"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.179"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.179", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.179 timers 30 180", "clear ip bgp 192.0.2.179"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.119"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.119 timers 60 180", "clear ip bgp 192.0.2.119"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.72"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.72", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.72 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.22"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.22 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.9"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.9", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.9 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.53"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.53 timers 60 180", "clear ip bgp 192.0.2.53"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.248"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.248", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.248 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.63 timers 30 180", "clear ip bgp 192.0.2.63"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.198"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.198 timers 60 180", "clear ip bgp 192.0.2.198"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.142"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.142 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.175"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.175", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.175 timers 60 180", "clear ip bgp 192.0.2.175"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.144"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.144 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.173"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.173 timers 30 180", "clear ip bgp 192.0.2.173"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.70 timers 30 180", "clear ip bgp 192.0.2.70"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.211"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.211 timers 30 180", "clear ip bgp 192.0.2.211"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.243"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.243 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.7", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.7 timers 60 180", "clear ip bgp 192.0.2.7"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.31"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.31", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.31 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.10"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.10 timers 30 180", "clear ip bgp 192.0.2.10"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.228 timers 60 180", "clear ip bgp 192.0.2.228"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.230", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.230 timers 60 180", "clear ip bgp 192.0.2.230"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.208"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.208", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.208 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.85 timers 30 180", "clear ip bgp 192.0.2.85"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.91 timers 30 180", "clear ip bgp 192.0.2.91"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.161", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.161 timers 30 180", "clear ip bgp 192.0.2.161"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.235"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.235 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.240"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.240 timers 30 180", "clear ip bgp 192.0.2.240"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.118"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.118 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.149"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.149 timers 60 180", "clear ip bgp 192.0.2.149"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.167"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.167 timers 60 180", "clear ip bgp 192.0.2.167"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.247 timers 60 180", "clear ip bgp 192.0.2.247"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.197"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.197 timers 30 180", "clear ip bgp 192.0.2.197"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.71"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.71", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.71 timers 60 180", "clear ip bgp 192.0.2.71"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.48"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.48", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.48 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.251 timers 30 180", "clear ip bgp 192.0.2.251"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.174"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.174 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.226"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.226", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.226 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.234"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.234 timers 60 180", "clear ip bgp 192.0.2.234"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.214"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.214", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.214 timers 60 180", "clear ip bgp 192.0.2.214"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.25", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.25 timers 60 180", "clear ip bgp 192.0.2.25"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.187 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.111"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.111", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.111 timers 30 180", "clear ip bgp 192.0.2.111"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.239"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.239", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.239 timers 60 180", "clear ip bgp 192.0.2.239"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.202"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.202 timers 30 180", "clear ip bgp 192.0.2.202"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.251"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.251 timers 60 180", "clear ip bgp 192.0.2.251"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.58", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.58 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.120"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.120 timers 60 180", "clear ip bgp 192.0.2.120"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.121"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.121 timers 30 180", "clear ip bgp 192.0.2.121"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.34"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.34", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.34 timers 60 180", "clear ip bgp 192.0.2.34"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.126"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.126 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.31"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.31", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.31 timers 30 180", "clear ip bgp 192.0.2.31"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.207"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.207", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.207 timers 30 180", "clear ip bgp 192.0.2.207"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.55", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.55 timers 60 180", "clear ip bgp 192.0.2.55"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.213"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.213 timers 30 180", "clear ip bgp 192.0.2.213"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.77"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.77 timers 30 180", "clear ip bgp 192.0.2.77"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.80 timers 60 180", "clear ip bgp 192.0.2.80"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.72"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.72", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.72 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.242"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.242 timers 60 180", "clear ip bgp 192.0.2.242"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.10"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.10 timers 30 180", "clear ip bgp 192.0.2.10"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.237"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.237 timers 30 180", "clear ip bgp 192.0.2.237"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.114"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.114 timers 30 180", "clear ip bgp 192.0.2.114"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.219"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.219 timers 30 180", "clear ip bgp 192.0.2.219"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.110"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.110 timers 60 180", "clear ip bgp 192.0.2.110"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.167"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.167 timers 60 180", "clear ip bgp 192.0.2.167"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.105"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.105", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.105 timers 30 180", "clear ip bgp 192.0.2.105"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.52"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.52 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.44"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.44", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.44 timers 60 180", "clear ip bgp 192.0.2.44"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.189", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.189 timers 60 180", "clear ip bgp 192.0.2.189"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.134"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.134 timers 60 180", "clear ip bgp 192.0.2.134"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.62 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.201"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.201 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.92"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.92", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.92 timers 30 180", "clear ip bgp 192.0.2.92"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.212"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.212 timers 60 180", "clear ip bgp 192.0.2.212"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.89"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.89 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.11"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.11 timers 60 180", "clear ip bgp 192.0.2.11"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.247", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.247 timers 30 180", "clear ip bgp 192.0.2.247"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.10"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.10 timers 60 180", "clear ip bgp 192.0.2.10"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.193"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.193 timers 30 180", "clear ip bgp 192.0.2.193"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.141"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.141", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.141 timers 60 180", "clear ip bgp 192.0.2.141"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.53"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.53", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.53 timers 60 180", "clear ip bgp 192.0.2.53"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.53"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.53 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.64"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.64 timers 60 180", "clear ip bgp 192.0.2.64"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.74"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.74 timers 30 180", "clear ip bgp 192.0.2.74"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.124"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.124", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.124 timers 30 180", "clear ip bgp 192.0.2.124"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.149"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.149 timers 30 180", "clear ip bgp 192.0.2.149"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.208"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.208", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.208 timers 60 180", "clear ip bgp 192.0.2.208"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.13"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.13", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.13 timers 30 180", "clear ip bgp 192.0.2.13"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.254"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.254", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.254 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.62 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.21 timers 60 180", "clear ip bgp 192.0.2.21"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.11"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.11", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.11 timers 30 180", "clear ip bgp 192.0.2.11"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.60 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.244", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.244 timers 30 180", "clear ip bgp 192.0.2.244"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.84"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.84 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.241 timers 60 180", "clear ip bgp 192.0.2.241"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.129"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.129", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.129 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.243"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.243 timers 60 180", "clear ip bgp 192.0.2.243"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.218"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.218", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.218 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.53"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.53", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.53 timers 60 180", "clear ip bgp 192.0.2.53"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.87 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.7"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.7 timers 30 180", "clear ip bgp 192.0.2.7"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.33"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.33 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.50"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.50", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.50 timers 30 180", "clear ip bgp 192.0.2.50"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.113"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.113 timers 30 180", "clear ip bgp 192.0.2.113"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.11"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.11 timers 60 180", "clear ip bgp 192.0.2.11"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.125"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.125 timers 30 180", "clear ip bgp 192.0.2.125"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.161"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.161 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.2"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.2", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.2 timers 60 180", "clear ip bgp 192.0.2.2"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.92"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.92 timers 60 180", "clear ip bgp 192.0.2.92"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.153"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.153", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.153 timers 30 180", "clear ip bgp 192.0.2.153"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.46"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.46 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.9"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.9", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.9 timers 60 180", "clear ip bgp 192.0.2.9"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.15"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.15 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.161"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.161 timers 30 180", "clear ip bgp 192.0.2.161"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.111"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.111 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.90"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.90", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.90 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.36"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.36 timers 60 180", "clear ip bgp 192.0.2.36"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.80"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.80 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.65"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.65 timers 30 180", "clear ip bgp 192.0.2.65"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.170 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.124"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.124", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.124 timers 30 180", "clear ip bgp 192.0.2.124"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.215"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.215 timers 60 180", "clear ip bgp 192.0.2.215"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.222"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.222 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.121"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.121 timers 30 180", "clear ip bgp 192.0.2.121"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.134 timers 30 180", "clear ip bgp 192.0.2.134"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.234"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.234", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.234 timers 60 180", "clear ip bgp 192.0.2.234"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.170"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.170", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.170 timers 30 180", "clear ip bgp 192.0.2.170"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.151 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.108"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.108", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.108 timers 60 180", "clear ip bgp 192.0.2.108"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.9", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.9 timers 30 180", "clear ip bgp 192.0.2.9"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.52 timers 60 180", "clear ip bgp 192.0.2.52"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.39"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.39 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.247", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.247 timers 60 180", "clear ip bgp 192.0.2.247"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.141"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.141", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.141 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.92"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.92 timers 30 180", "clear ip bgp 192.0.2.92"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.216"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.216 timers 60 180", "clear ip bgp 192.0.2.216"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.71"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.71", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.71 timers 30 180", "clear ip bgp 192.0.2.71"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.46"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.46", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.46 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.201"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.201", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.201 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.7"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.7 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.176"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.176", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.176 timers 30 180", "clear ip bgp 192.0.2.176"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.109 timers 30 180", "clear ip bgp 192.0.2.109"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.38"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.38 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.220"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.220 timers 60 180", "clear ip bgp 192.0.2.220"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.209"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.209", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.209 timers 30 180", "clear ip bgp 192.0.2.209"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.17"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.17 timers 30 180", "clear ip bgp 192.0.2.17"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.229"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.229", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.229 timers 60 180", "clear ip bgp 192.0.2.229"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.112"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.112 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.25 timers 30 180", "clear ip bgp 192.0.2.25"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.196"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.196 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.127"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.127", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.127 timers 30 180", "clear ip bgp 192.0.2.127"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.241 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.156 timers 60 180", "clear ip bgp 192.0.2.156"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.60", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.60 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.90"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.90 timers 60 180", "clear ip bgp 192.0.2.90"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.24", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.24 timers 60 180", "clear ip bgp 192.0.2.24"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.129"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.129", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.129 timers 60 180", "clear ip bgp 192.0.2.129"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.202"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.202", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.202 timers 60 180", "clear ip bgp 192.0.2.202"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.242"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.242 timers 30 180", "clear ip bgp 192.0.2.242"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.82"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.82 timers 60 180", "clear ip bgp 192.0.2.82"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.218"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.218 timers 30 180", "clear ip bgp 192.0.2.218"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.170"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.170", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.170 timers 30 180", "clear ip bgp 192.0.2.170"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.35 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.25 timers 60 180", "clear ip bgp 192.0.2.25"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.185"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.185 timers 60 180", "clear ip bgp 192.0.2.185"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.117"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.117 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.64"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.64 timers 30 180", "clear ip bgp 192.0.2.64"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.14"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.14 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.184"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.184", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.184 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.2"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.2", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.2 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.29"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.29", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.29 timers 60 180", "clear ip bgp 192.0.2.29"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.19 timers 30 180", "clear ip bgp 192.0.2.19"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.24 timers 60 180", "clear ip bgp 192.0.2.24"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.147"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.147 timers 30 180", "clear ip bgp 192.0.2.147"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.68"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.68 timers 60 180", "clear ip bgp 192.0.2.68"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.112"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.112", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.112 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.223"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.223 timers 60 180", "clear ip bgp 192.0.2.223"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.99"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.99 timers 30 180", "clear ip bgp 192.0.2.99"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.217"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.217 timers 30 180", "clear ip bgp 192.0.2.217"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.115"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.115 timers 60 180", "clear ip bgp 192.0.2.115"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.218"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.218 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.64"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.64 timers 60 180", "clear ip bgp 192.0.2.64"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.237"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.237", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.237 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.52"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.52 timers 60 180", "clear ip bgp 192.0.2.52"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.110"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.110 timers 30 180", "clear ip bgp 192.0.2.110"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.125"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.125 timers 30 180", "clear ip bgp 192.0.2.125"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.204"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.204 timers 60 180", "clear ip bgp 192.0.2.204"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.214"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.214", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.214 timers 60 180", "clear ip bgp 192.0.2.214"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.73"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.73 timers 30 180", "clear ip bgp 192.0.2.73"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.244", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.244 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.178", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.178 timers 60 180", "clear ip bgp 192.0.2.178"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.17"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.17", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.17 timers 60 180", "clear ip bgp 192.0.2.17"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.6"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.6", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.6 timers 30 180", "clear ip bgp 192.0.2.6"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.31"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.31 timers 30 180", "clear ip bgp 192.0.2.31"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.251 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.251", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.251 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.125"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.125 timers 30 180", "clear ip bgp 192.0.2.125"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.225"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.225", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.225 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.64"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.64 timers 60 180", "clear ip bgp 192.0.2.64"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.202"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.202 timers 60 180", "clear ip bgp 192.0.2.202"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.112"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.112 timers 60 180", "clear ip bgp 192.0.2.112"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.159 timers 60 180", "clear ip bgp 192.0.2.159"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.241"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.241 timers 30 180", "clear ip bgp 192.0.2.241"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.41"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.41 timers 60 180", "clear ip bgp 192.0.2.41"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.41"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.41", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.41 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.229"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.229", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.229 timers 30 180", "clear ip bgp 192.0.2.229"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.5"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.5", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.5 timers 30 180", "clear ip bgp 192.0.2.5"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.227"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.227 timers 30 180", "clear ip bgp 192.0.2.227"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.5"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.5", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.5 timers 30 180", "clear ip bgp 192.0.2.5"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.17"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.17 timers 60 180", "clear ip bgp 192.0.2.17"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.204"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.204 timers 60 180", "clear ip bgp 192.0.2.204"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.62"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.62", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.62 timers 60 180", "clear ip bgp 192.0.2.62"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.92"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.92", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.92 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.55 timers 30 180", "clear ip bgp 192.0.2.55"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.80 timers 30 180", "clear ip bgp 192.0.2.80"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.224"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.224 timers 60 180", "clear ip bgp 192.0.2.224"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.240"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.240 timers 30 180", "clear ip bgp 192.0.2.240"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.60"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.60 timers 30 180", "clear ip bgp 192.0.2.60"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.37"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.37 timers 60 180", "clear ip bgp 192.0.2.37"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.23"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.23", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.23 timers 60 180", "clear ip bgp 192.0.2.23"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.226"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.226", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.226 timers 30 180", "clear ip bgp 192.0.2.226"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.175"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.175", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.175 timers 60 180", "clear ip bgp 192.0.2.175"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.187 timers 30 180", "clear ip bgp 192.0.2.187"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.92"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.92 timers 30 180", "clear ip bgp 192.0.2.92"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.178"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.178 timers 60 180", "clear ip bgp 192.0.2.178"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.186"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.186", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.186 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.48"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.48", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.48 timers 60 180", "clear ip bgp 192.0.2.48"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.164"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.164", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.164 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.54"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.54 timers 60 180", "clear ip bgp 192.0.2.54"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.125"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.125 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.184 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.30"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.30", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.30 timers 60 180", "clear ip bgp 192.0.2.30"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.33"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.33", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.33 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.200"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.200", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.200 timers 60 180", "clear ip bgp 192.0.2.200"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.62"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.62", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.62 timers 60 180", "clear ip bgp 192.0.2.62"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.94 timers 30 180", "clear ip bgp 192.0.2.94"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.39"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.39 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.53"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.53", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.53 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.203"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.203 timers 30 180", "clear ip bgp 192.0.2.203"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.17"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.17 timers 60 180", "clear ip bgp 192.0.2.17"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.115"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.115 timers 30 180", "clear ip bgp 192.0.2.115"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.94"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.94 timers 30 180", "clear ip bgp 192.0.2.94"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.146"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.146 timers 60 180", "clear ip bgp 192.0.2.146"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.181"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.181 timers 30 180", "clear ip bgp 192.0.2.181"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.28"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.28", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.28 timers 60 180", "clear ip bgp 192.0.2.28"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.211"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.211 timers 30 180", "clear ip bgp 192.0.2.211"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.220"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.220 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.241"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.241 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.6"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.6 timers 60 180", "clear ip bgp 192.0.2.6"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.140 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.232 timers 30 180", "clear ip bgp 192.0.2.232"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.67"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.67", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.67 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.211", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.211 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.162"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.162", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.162 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.228"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.228", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.228 timers 30 180", "clear ip bgp 192.0.2.228"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.81"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.81 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.94 timers 60 180", "clear ip bgp 192.0.2.94"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.91 timers 60 180", "clear ip bgp 192.0.2.91"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.27"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.27 timers 60 180", "clear ip bgp 192.0.2.27"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.60 timers 30 180", "clear ip bgp 192.0.2.60"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.6"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.6", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.6 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.203"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.203 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.174"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.174 timers 30 180", "clear ip bgp 192.0.2.174"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.67"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.67", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.67 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.64"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.64 timers 30 180", "clear ip bgp 192.0.2.64"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.142"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.142 timers 60 180", "clear ip bgp 192.0.2.142"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.96", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.96 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.246 timers 60 180", "clear ip bgp 192.0.2.246"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.248"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.248 timers 30 180", "clear ip bgp 192.0.2.248"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.21", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.21 timers 30 180", "clear ip bgp 192.0.2.21"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.149"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.149 timers 30 180", "clear ip bgp 192.0.2.149"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.186"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.186 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.183"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.183", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.183 timers 30 180", "clear ip bgp 192.0.2.183"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.126"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.126 timers 60 180", "clear ip bgp 192.0.2.126"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.57"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.57 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.199"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.199", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.199 timers 60 180", "clear ip bgp 192.0.2.199"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.22"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.22 timers 60 180", "clear ip bgp 192.0.2.22"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.168 timers 60 180", "clear ip bgp 192.0.2.168"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.214"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.214", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.214 timers 30 180", "clear ip bgp 192.0.2.214"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.64"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.64 timers 30 180", "clear ip bgp 192.0.2.64"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.24"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.24 timers 30 180", "clear ip bgp 192.0.2.24"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.194"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.194", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.194 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.196"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.196", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.196 timers 30 180", "clear ip bgp 192.0.2.196"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.94 timers 30 180", "clear ip bgp 192.0.2.94"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.49"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.49 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.85", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.85 timers 30 180", "clear ip bgp 192.0.2.85"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.113 timers 60 180", "clear ip bgp 192.0.2.113"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.131"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.131 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.51"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.51 timers 30 180", "clear ip bgp 192.0.2.51"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.99"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.99 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.3"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.3 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.197", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.197 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.165"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.165", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.165 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.98"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.98 timers 30 180", "clear ip bgp 192.0.2.98"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.218"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.218", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.218 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.64"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.64 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.222"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.222 timers 60 180", "clear ip bgp 192.0.2.222"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.160"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.160", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.160 timers 60 180", "clear ip bgp 192.0.2.160"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.210"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.210 timers 30 180", "clear ip bgp 192.0.2.210"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.236"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.236 timers 60 180", "clear ip bgp 192.0.2.236"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.130", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.130 timers 60 180", "clear ip bgp 192.0.2.130"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.178 timers 30 180", "clear ip bgp 192.0.2.178"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.65"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.65 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.157"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.157 timers 60 180", "clear ip bgp 192.0.2.157"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.134", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.134 timers 60 180", "clear ip bgp 192.0.2.134"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.181"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.181 timers 30 180", "clear ip bgp 192.0.2.181"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.156 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.68"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.68 timers 30 180", "clear ip bgp 192.0.2.68"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.72"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.72", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.72 timers 30 180", "clear ip bgp 192.0.2.72"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.234"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.234", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.234 timers 30 180", "clear ip bgp 192.0.2.234"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.121"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.121 timers 30 180", "clear ip bgp 192.0.2.121"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.218"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.218 timers 30 180", "clear ip bgp 192.0.2.218"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.113"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.113 timers 30 180", "clear ip bgp 192.0.2.113"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.202"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.202 timers 30 180", "clear ip bgp 192.0.2.202"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.180"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.180", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.180 timers 60 180", "clear ip bgp 192.0.2.180"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.247 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.3", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.3 timers 30 180", "clear ip bgp 192.0.2.3"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.67"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.67 timers 60 180", "clear ip bgp 192.0.2.67"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.106"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.106", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.106 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.85 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.151 timers 60 180", "clear ip bgp 192.0.2.151"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.47", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.47 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.231 timers 30 180", "clear ip bgp 192.0.2.231"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.7"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.7 timers 30 180", "clear ip bgp 192.0.2.7"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.220"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.220 timers 60 180", "clear ip bgp 192.0.2.220"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.233"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.233", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.233 timers 60 180", "clear ip bgp 192.0.2.233"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.102"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.102", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.102 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.170", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.170 timers 30 180", "clear ip bgp 192.0.2.170"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.37"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.37 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.251", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.251 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.20"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.20 timers 30 180", "clear ip bgp 192.0.2.20"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.125"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.125", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.125 timers 60 180", "clear ip bgp 192.0.2.125"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.49"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.49 timers 30 180", "clear ip bgp 192.0.2.49"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.115"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.115 timers 30 180", "clear ip bgp 192.0.2.115"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.87 timers 30 180", "clear ip bgp 192.0.2.87"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.116 timers 60 180", "clear ip bgp 192.0.2.116"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.83 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.105"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.105 timers 60 180", "clear ip bgp 192.0.2.105"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.92"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.92 timers 60 180", "clear ip bgp 192.0.2.92"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.112"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.112", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.112 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.78"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.78", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.78 timers 60 180", "clear ip bgp 192.0.2.78"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.202"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.202 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.245"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.245 timers 30 180", "clear ip bgp 192.0.2.245"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.47 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.103", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.103 timers 30 180", "clear ip bgp 192.0.2.103"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.35 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.228"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.228 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.175"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.175", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.175 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.234"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.234", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.234 timers 60 180", "clear ip bgp 192.0.2.234"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.146"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.146", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.146 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.53"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.53", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.53 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.239"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.239", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.239 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.118 timers 60 180", "clear ip bgp 192.0.2.118"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.62"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.62", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.62 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.205"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.205 timers 60 180", "clear ip bgp 192.0.2.205"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.96", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.96 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.100"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.100 timers 60 180", "clear ip bgp 192.0.2.100"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.228 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.134"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.134", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.134 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.44"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.44", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.44 timers 30 180", "clear ip bgp 192.0.2.44"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.127"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.127", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.127 timers 30 180", "clear ip bgp 192.0.2.127"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.123"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.123 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.84"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.84 timers 30 180", "clear ip bgp 192.0.2.84"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.219"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.219", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.219 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.165"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.165", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.165 timers 30 180", "clear ip bgp 192.0.2.165"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.65 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.7"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.7", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.7 timers 60 180", "clear ip bgp 192.0.2.7"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.138 timers 60 180", "clear ip bgp 192.0.2.138"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.16"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.16 timers 30 180", "clear ip bgp 192.0.2.16"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.17"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.17", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.17 timers 30 180", "clear ip bgp 192.0.2.17"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.159", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.159 timers 30 180", "clear ip bgp 192.0.2.159"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.169", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.169 timers 60 180", "clear ip bgp 192.0.2.169"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.189 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.162"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.162", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.162 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.207", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.207 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.16"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.16 timers 60 180", "clear ip bgp 192.0.2.16"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.159"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.159 timers 60 180", "clear ip bgp 192.0.2.159"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.198"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.198 timers 60 180", "clear ip bgp 192.0.2.198"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.183"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.183 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.139"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.139", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.139 timers 30 180", "clear ip bgp 192.0.2.139"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.91 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.140"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.140 timers 60 180", "clear ip bgp 192.0.2.140"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.10"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.10 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.245 timers 60 180", "clear ip bgp 192.0.2.245"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.251"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.251 timers 30 180", "clear ip bgp 192.0.2.251"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.248 timers 60 180", "clear ip bgp 192.0.2.248"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.131"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.131 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.34"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.34 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.225"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.225", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.225 timers 60 180", "clear ip bgp 192.0.2.225"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.82"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.82", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.82 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.49"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.49", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.49 timers 30 180", "clear ip bgp 192.0.2.49"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.206"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.206 timers 60 180", "clear ip bgp 192.0.2.206"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.158"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.158", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.158 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.250"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.250 timers 60 180", "clear ip bgp 192.0.2.250"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.248"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.248 timers 30 180", "clear ip bgp 192.0.2.248"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.102"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.102 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.188"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.188 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.99"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.99 timers 60 180", "clear ip bgp 192.0.2.99"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.85"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.85 timers 30 180", "clear ip bgp 192.0.2.85"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.252"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.252 timers 60 180", "clear ip bgp 192.0.2.252"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.80 timers 30 180", "clear ip bgp 192.0.2.80"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.109", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.109 timers 60 180", "clear ip bgp 192.0.2.109"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.213", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.213 timers 30 180", "clear ip bgp 192.0.2.213"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.209"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.209", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.209 timers 30 180", "clear ip bgp 192.0.2.209"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.65 timers 30 180", "clear ip bgp 192.0.2.65"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.169"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.169", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.169 timers 60 180", "clear ip bgp 192.0.2.169"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.231"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.231 timers 30 180", "clear ip bgp 192.0.2.231"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.140"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.140 timers 30 180", "clear ip bgp 192.0.2.140"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.35 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.52"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.52 timers 30 180", "clear ip bgp 192.0.2.52"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.234"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.234 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.30"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.30 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.129 timers 30 180", "clear ip bgp 192.0.2.129"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.63 timers 60 180", "clear ip bgp 192.0.2.63"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.9"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.9", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.9 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.197"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.197", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.197 timers 30 180", "clear ip bgp 192.0.2.197"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.10"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.10 timers 60 180", "clear ip bgp 192.0.2.10"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.252"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.252 timers 30 180", "clear ip bgp 192.0.2.252"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.125"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.125 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.222"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.222", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.222 timers 30 180", "clear ip bgp 192.0.2.222"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.64"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.64 timers 60 180", "clear ip bgp 192.0.2.64"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.150"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.150 timers 30 180", "clear ip bgp 192.0.2.150"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.127"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.127", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.127 timers 30 180", "clear ip bgp 192.0.2.127"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.88", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.88 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.94 timers 60 180", "clear ip bgp 192.0.2.94"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.188"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.188", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.188 timers 30 180", "clear ip bgp 192.0.2.188"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.137"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.137", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.137 timers 30 180", "clear ip bgp 192.0.2.137"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.110 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.11"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.11 timers 60 180", "clear ip bgp 192.0.2.11"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.97"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.97 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.34"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.34", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.34 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.211"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.211", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.211 timers 60 180", "clear ip bgp 192.0.2.211"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.192"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.192", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.192 timers 60 180", "clear ip bgp 192.0.2.192"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.42"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.42 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.135"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.135", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.135 timers 30 180", "clear ip bgp 192.0.2.135"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.50"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.50 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.125"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.125", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.125 timers 60 180", "clear ip bgp 192.0.2.125"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.30"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.30 timers 60 180", "clear ip bgp 192.0.2.30"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.55", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.55 timers 60 180", "clear ip bgp 192.0.2.55"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.73"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.73", "remote_as": 65100, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.73 timers 60 180", "clear ip bgp 192.0.2.73"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.3 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.80", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.80 timers 30 180", "clear ip bgp 192.0.2.80"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.144"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.144 timers 30 180", "clear ip bgp 192.0.2.144"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.139"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.139", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.139 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.140"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.140 timers 60 180", "clear ip bgp 192.0.2.140"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.3 timers 30 180", "clear ip bgp 192.0.2.3"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.233"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.233 timers 60 180", "clear ip bgp 192.0.2.233"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.82"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.82", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.82 timers 30 180", "clear ip bgp 192.0.2.82"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.170"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.170 timers 30 180", "clear ip bgp 192.0.2.170"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.234"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.234 timers 30 180", "clear ip bgp 192.0.2.234"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.109", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.109 timers 60 180", "clear ip bgp 192.0.2.109"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.20", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.20 timers 60 180", "clear ip bgp 192.0.2.20"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.25"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.25 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.174"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.174 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.230 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.240"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.240 timers 60 180", "clear ip bgp 192.0.2.240"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.241 timers 60 180", "clear ip bgp 192.0.2.241"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.30"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.30 timers 60 180", "clear ip bgp 192.0.2.30"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.201"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.201", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.201 timers 30 180", "clear ip bgp 192.0.2.201"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.24", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.24 timers 30 180", "clear ip bgp 192.0.2.24"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.220"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.220", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.220 timers 30 180", "clear ip bgp 192.0.2.220"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.19", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.19 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.225"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.225", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.225 timers 60 180", "clear ip bgp 192.0.2.225"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.205"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.205 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.253"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.253 timers 30 180", "clear ip bgp 192.0.2.253"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.245"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.245 timers 60 180", "clear ip bgp 192.0.2.245"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.93"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.93", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.93 timers 60 180", "clear ip bgp 192.0.2.93"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.28"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.28 timers 60 180", "clear ip bgp 192.0.2.28"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.191"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.191", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.191 timers 30 180", "clear ip bgp 192.0.2.191"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.67"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.67 timers 30 180", "clear ip bgp 192.0.2.67"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.20", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.20 timers 30 180", "clear ip bgp 192.0.2.20"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.16"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.16", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.16 timers 30 180", "clear ip bgp 192.0.2.16"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.75"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.75 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.52 timers 60 180", "clear ip bgp 192.0.2.52"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.75"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.75 timers 60 180", "clear ip bgp 192.0.2.75"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.77"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.77", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.77 timers 30 180", "clear ip bgp 192.0.2.77"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.157"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.157", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.157 timers 30 180", "clear ip bgp 192.0.2.157"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.111"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.111", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.111 timers 30 180", "clear ip bgp 192.0.2.111"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.212"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.212", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.212 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.14"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.14 timers 60 180", "clear ip bgp 192.0.2.14"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.8"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.8", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.8 timers 60 180", "clear ip bgp 192.0.2.8"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.41"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.41 timers 30 180", "clear ip bgp 192.0.2.41"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.63"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.63 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.85"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.85 timers 60 180", "clear ip bgp 192.0.2.85"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.42 timers 60 180", "clear ip bgp 192.0.2.42"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.186"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.186 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.105 timers 30 180", "clear ip bgp 192.0.2.105"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.239"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.239", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.239 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.11"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.11", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.11 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.226"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.226", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.226 timers 30 180", "clear ip bgp 192.0.2.226"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.244", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.244 timers 30 180", "clear ip bgp 192.0.2.244"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.189"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.189 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.4 timers 30 180", "clear ip bgp 192.0.2.4"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.213 timers 30 180", "clear ip bgp 192.0.2.213"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.146"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.146 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.232 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.250"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.250", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.250 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.106"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.106 timers 30 180", "clear ip bgp 192.0.2.106"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.212"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.212 timers 30 180", "clear ip bgp 192.0.2.212"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.59"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.59", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.59 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.73"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.73 timers 60 180", "clear ip bgp 192.0.2.73"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.83"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.83 timers 60 180", "clear ip bgp 192.0.2.83"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.130 timers 30 180", "clear ip bgp 192.0.2.130"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.201"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.201 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.176"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.176 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.239"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.239", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.239 timers 60 180", "clear ip bgp 192.0.2.239"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.231"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.231 timers 30 180", "clear ip bgp 192.0.2.231"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.87 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.189 timers 60 180", "clear ip bgp 192.0.2.189"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.85 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.243"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.243 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.149"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.149 timers 30 180", "clear ip bgp 192.0.2.149"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.64"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.64 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.251", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.251 timers 30 180", "clear ip bgp 192.0.2.251"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.168"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.168 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.48"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.48 timers 30 180", "clear ip bgp 192.0.2.48"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.126"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.126", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.126 timers 30 180", "clear ip bgp 192.0.2.126"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.143"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.143", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.143 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.134 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.132"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.132", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.132 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.138"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.138 timers 60 180", "clear ip bgp 192.0.2.138"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.140"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.140 timers 60 180", "clear ip bgp 192.0.2.140"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.247 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.110"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.110 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.230 timers 60 180", "clear ip bgp 192.0.2.230"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.249 timers 60 180", "clear ip bgp 192.0.2.249"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.144"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.144", "remote_as": 65100, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.144 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.229"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.229", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.229 timers 60 180", "clear ip bgp 192.0.2.229"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.224"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.224 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.88 timers 30 180", "clear ip bgp 192.0.2.88"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.80 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.120"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.120", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.120 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.84"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.84 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.211"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.211", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.211 timers 30 180", "clear ip bgp 192.0.2.211"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.202"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.202 timers 60 180", "clear ip bgp 192.0.2.202"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.135"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.135", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.135 timers 60 180", "clear ip bgp 192.0.2.135"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.114"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65100, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.114 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.160"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.160 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.198"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.198 timers 60 180", "clear ip bgp 192.0.2.198"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.83"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.83 timers 60 180", "clear ip bgp 192.0.2.83"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.98"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.98 timers 60 180", "clear ip bgp 192.0.2.98"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.198"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.198", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.198 timers 30 180", "clear ip bgp 192.0.2.198"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.11"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.11", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.11 timers 60 180", "clear ip bgp 192.0.2.11"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.136"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.136 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.191"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.191", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.191 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.4", "remote_as": 65100, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.4 timers 30 180", "clear ip bgp 192.0.2.4"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.61"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.61", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.61 timers 60 180", "clear ip bgp 192.0.2.61"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.5"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.5", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.5 timers 30 180", "clear ip bgp 192.0.2.5"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.144"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.144 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.11"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.11", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.11 timers 60 180", "clear ip bgp 192.0.2.11"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.88 timers 60 180", "clear ip bgp 192.0.2.88"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.85 soft out"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.243"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.243 timers 30 180", "clear ip bgp 192.0.2.243"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.204"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65001, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.204 timers 60 180", "clear ip bgp 192.0.2.204"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.106"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.106", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.106 timers 60 180", "clear ip bgp 192.0.2.106"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.74"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.74 timers 60 180", "clear ip bgp 192.0.2.74"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.118"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.118 timers 30 180", "clear ip bgp 192.0.2.118"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.148"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.148", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.148 timers 60 180", "clear ip bgp 192.0.2.148"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.142"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.142", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.142 timers 30 180", "clear ip bgp 192.0.2.142"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.45"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.45 timers 30 180", "clear ip bgp 192.0.2.45"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.80 timers 30 180", "clear ip bgp 192.0.2.80"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.161", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.161 timers 30 180", "clear ip bgp 192.0.2.161"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.150"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.150", "remote_as": 65001, "interface": "GigabitEthernet0/2", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.150 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.99"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.99 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.247", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.247 timers 60 180", "clear ip bgp 192.0.2.247"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.226"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.226", "remote_as": 65001, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.226 soft out"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.5"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.5", "remote_as": 65010, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.5 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.235"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.235", "remote_as": 65100, "interface": "GigabitEthernet0/0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.235 timers 60 180", "clear ip bgp 192.0.2.235"]}
	{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.168"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.168", "remote_as": 65002, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.168 timers 60 180", "clear ip bgp 192.0.2.168"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.214"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.214", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.214 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "interface": "Loopback0", "keepalive": 30, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.215 timers 30 180", "clear ip bgp 192.0.2.215"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.229"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.229", "remote_as": 65002, "interface": "GigabitEthernet0/2", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.229 timers 60 180", "clear ip bgp 192.0.2.229"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "Loopback0", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.42 soft out"]}
	{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.71"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.71", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.71 timers 60 180", "clear ip bgp 192.0.2.71"]}
	{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.107"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65010, "interface": "GigabitEthernet0/1", "keepalive": 60, "hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.107 soft out"]}