Instructions to use JoeiBanana/ai-network-llms with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries
PEFT
How to use JoeiBanana/ai-network-llms with PEFT:
```
Task type is invalid.
```
Notebooks
Google Colab
Kaggle
Local Apps Settings

How to use JoeiBanana/ai-network-llms with llama.cpp:

Install (macOS, Linux)

curl -LsSf https://llama.app/install.sh | sh
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
llama cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
llama cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
./llama-cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf JoeiBanana/ai-network-llms:Q4_K_M
# Run inference directly in the terminal:
./build/bin/llama-cli -hf JoeiBanana/ai-network-llms:Q4_K_M

Use Docker

docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M

LM Studio
Jan

vLLM

How to use JoeiBanana/ai-network-llms with vLLM:

Install from pip and serve model

# Install vLLM from pip:
pip install vllm
# Start the vLLM server:
vllm serve "JoeiBanana/ai-network-llms"
# Call the server using curl (OpenAI-compatible API):
curl -X POST "http://localhost:8000/v1/chat/completions" \
	-H "Content-Type: application/json" \
	--data '{
		"model": "JoeiBanana/ai-network-llms",
		"messages": [
			{
				"role": "user",
				"content": "What is the capital of France?"
			}
		]
	}'

Use Docker

docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M

Ollama
How to use JoeiBanana/ai-network-llms with Ollama:
```
ollama run hf.co/JoeiBanana/ai-network-llms:Q4_K_M
```
Unsloth Desktop

How to use JoeiBanana/ai-network-llms with Pi:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure the model in Pi

# Install Pi:
npm install -g @earendil-works/pi-coding-agent
# Add to ~/.pi/agent/models.json:
{
  "providers": {
    "llama-cpp": {
      "baseUrl": "http://localhost:8080/v1",
      "api": "openai-completions",
      "apiKey": "none",
      "models": [
        {
          "id": "JoeiBanana/ai-network-llms:Q4_K_M"
        }
      ]
    }
  }
}

Run Pi

# Start Pi in your project directory:
pi

Docker Model Runner
How to use JoeiBanana/ai-network-llms with Docker Model Runner:
```
docker model run hf.co/JoeiBanana/ai-network-llms:Q4_K_M
```

Lemonade

How to use JoeiBanana/ai-network-llms with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull JoeiBanana/ai-network-llms:Q4_K_M

Run and chat with the model

lemonade run user.ai-network-llms-Q4_K_M

List all available models

lemonade list

Hermes Agent

How to use JoeiBanana/ai-network-llms with Hermes Agent:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure Hermes

# Install Hermes:
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
hermes setup
# Point Hermes at the local server:
hermes config set model.provider custom
hermes config set model.base_url http://127.0.0.1:8080/v1
hermes config set model.default JoeiBanana/ai-network-llms:Q4_K_M

Run Hermes

hermes

Atomic Chat

OpenClaw

How to use JoeiBanana/ai-network-llms with OpenClaw:

Start the llama.cpp server

# Install llama.cpp:
brew install llama.cpp
# Start a local OpenAI-compatible server:
llama serve -hf JoeiBanana/ai-network-llms:Q4_K_M

Configure OpenClaw

# Install OpenClaw:
npm install -g openclaw@latest
# Register the local server and set it as the default model:
openclaw onboard --non-interactive --mode local \
  --auth-choice custom-api-key \
  --custom-base-url http://127.0.0.1:8080/v1 \
  --custom-model-id "JoeiBanana/ai-network-llms:Q4_K_M" \
  --custom-provider-id llama-cpp \
  --custom-compatibility openai \
  --custom-text-input \
  --accept-risk \
  --skip-health

Run OpenClaw

openclaw agent --local --agent main --message "Hello from Hugging Face"

ai-network-llms / datasets /cisco_gold_100.jsonl

JoeiBanana

Upload batch 5/8

8f9d821 verified 5 months ago

Raw

History Blame Contribute Delete

82.3 kB

	{"instruction": "Mitigate SSH brute force from 185.199.108.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "185.199.108.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 130}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 185.199.108.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 167}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 185.199.108.1", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/3\n ip address 45.33.32.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 185.199.108.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "185.199.108.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Mitigate ICMP/UDP flood from 198.51.100.1 towards interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "198.51.100.1", "severity": "high", "pps": 74686}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", " police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
	{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 45.33.32.1", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/3\n ip address 185.199.108.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 45.33.32.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "45.33.32.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Mitigate ICMP/UDP flood from 185.199.108.1 towards interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "185.199.108.1", "severity": "high", "pps": 11504}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", " police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Increase logging and forward suspicious events to SIEM", "config_raw": "logging host 192.0.2.1\nlogging trap informational\n!\n", "wazuh_alert": {"type": "suspicious_activity_high_volume", "src_ip": "192.0.2.1", "severity": "medium"}, "gold_actions": [{"action_type": "monitoring", "commands": ["logging host 203.0.113.1", "logging trap warning", "service timestamps log datetime msec"], "verify": ["show logging"], "rollback": [], "explain": "Increase logging verbosity and forward logs to SIEM for detailed analysis."}]}
	{"instruction": "Mitigate repeated failed VPN negotiation attempts from 45.33.32.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "45.33.32.1", "severity": "high", "attempts": 60}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 45.33.32.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 45.33.32.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
	{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 117}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config \| section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
	{"instruction": "Mitigate SSH brute force from 185.199.108.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "185.199.108.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 100}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 185.199.108.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 198.51.100.1", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/2\n ip address 203.0.113.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 198.51.100.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "198.51.100.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/1", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/1", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/3", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/3", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 57\n network 192.168.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config \| section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
	{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 198.51.100.1", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/0\n ip address 203.0.113.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 198.51.100.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "198.51.100.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 10.0.0.1 to external 203.0.113.1", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/0\n ip address 198.51.100.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 10.0.0.1 203.0.113.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "10.0.0.1", "dst_ip": "203.0.113.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 10.0.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/3", "config_raw": "router ospf 28\n network 192.168.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Increase logging and forward suspicious events to SIEM", "config_raw": "logging host 198.51.100.1\nlogging trap informational\n!\n", "wazuh_alert": {"type": "suspicious_activity_high_volume", "src_ip": "45.33.32.1", "severity": "medium"}, "gold_actions": [{"action_type": "monitoring", "commands": ["logging host 45.33.32.1", "logging trap warning", "service timestamps log datetime msec"], "verify": ["show logging"], "rollback": [], "explain": "Increase logging verbosity and forward logs to SIEM for detailed analysis."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 45.33.32.1", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/3\n ip address 203.0.113.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 45.33.32.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "45.33.32.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Mitigate repeated failed VPN negotiation attempts from 203.0.113.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "203.0.113.1", "severity": "high", "attempts": 35}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 203.0.113.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 203.0.113.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 14\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Mitigate ICMP/UDP flood from 198.51.100.1 towards interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "198.51.100.1", "severity": "high", "pps": 46509}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", " police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
	{"instruction": "Mitigate ICMP/UDP flood from 198.51.100.1 towards interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "198.51.100.1", "severity": "high", "pps": 82132}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", " police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
	{"instruction": "Mitigate repeated failed VPN negotiation attempts from 203.0.113.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "203.0.113.1", "severity": "high", "attempts": 186}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 203.0.113.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 203.0.113.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
	{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "10.0.0.1", "severity": "critical", "attempts": 110}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 173}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "10.0.0.1", "severity": "critical", "attempts": 92}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
	{"instruction": "Respond to suspected BGP route injection originating via peer 45.33.32.1", "config_raw": "router bgp 64583\n neighbor 45.33.32.1 remote-as 65189\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "45.33.32.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 45.33.32.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 45.33.32.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
	{"instruction": "Block traffic from 45.33.32.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_45_33_32_1", " deny ip host 45.33.32.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_45_33_32_1 in"], "verify": ["show access-lists TEMP_BLOCK_45_33_32_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_45_33_32_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_45_33_32_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 45.33.32.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
	{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 188}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Mitigate repeated failed VPN negotiation attempts from 45.33.32.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "45.33.32.1", "severity": "high", "attempts": 148}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 45.33.32.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 45.33.32.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/1", "config_raw": "router ospf 8\n network 192.168.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 110}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/0", "config_raw": "router ospf 73\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Mitigate repeated failed VPN negotiation attempts from 185.199.108.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "185.199.108.1", "severity": "high", "attempts": 153}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 185.199.108.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 185.199.108.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 198.51.100.1", "config_raw": "interface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/1\n ip address 45.33.32.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 198.51.100.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "198.51.100.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 59\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "172.16.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Mitigate SSH brute force from 185.199.108.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "185.199.108.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 83}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 185.199.108.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 185.199.108.1", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/0\n ip address 185.199.108.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 185.199.108.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "185.199.108.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config \| section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
	{"instruction": "Respond to suspected BGP route injection originating via peer 203.0.113.1", "config_raw": "router bgp 64529\n neighbor 203.0.113.1 remote-as 64782\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "203.0.113.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 203.0.113.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 203.0.113.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 192.0.2.1", "config_raw": "interface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/2\n ip address 192.0.2.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 192.0.2.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "192.0.2.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config \| section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
	{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
	{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
	{"instruction": "Mitigate repeated failed VPN negotiation attempts from 185.199.108.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "185.199.108.1", "severity": "high", "attempts": 200}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 185.199.108.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 185.199.108.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
	{"instruction": "Block traffic from 185.199.108.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "185.199.108.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_185_199_108_1", " deny ip host 185.199.108.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_185_199_108_1 in"], "verify": ["show access-lists TEMP_BLOCK_185_199_108_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_185_199_108_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_185_199_108_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 185.199.108.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
	{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/1", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/1", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Mitigate ICMP/UDP flood from 185.199.108.1 towards interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "185.199.108.1", "severity": "high", "pps": 30257}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", " police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
	{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 192.0.2.1", "config_raw": "interface GigabitEthernet0/3\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/1\n ip address 198.51.100.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 192.0.2.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "192.0.2.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
	{"instruction": "Mitigate ICMP/UDP flood from 203.0.113.1 towards interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "203.0.113.1", "severity": "high", "pps": 71694}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", " police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
	{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config \| section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/3", "config_raw": "router ospf 45\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Respond to suspected BGP route injection originating via peer 198.51.100.1", "config_raw": "router bgp 64563\n neighbor 198.51.100.1 remote-as 64848\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "198.51.100.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 198.51.100.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 198.51.100.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/0", "config_raw": "router ospf 99\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 4\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Mitigate ICMP/UDP flood from 203.0.113.1 towards interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "203.0.113.1", "severity": "high", "pps": 66959}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", " police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
	{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/3", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/3", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Mitigate repeated failed VPN negotiation attempts from 203.0.113.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "203.0.113.1", "severity": "high", "attempts": 131}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 203.0.113.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 203.0.113.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/1", "config_raw": "router ospf 47\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "172.16.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
	{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 125}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
	{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 37\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config \| section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
	{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 163}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Mitigate repeated failed VPN negotiation attempts from 198.51.100.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "198.51.100.1", "severity": "high", "attempts": 150}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 198.51.100.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 198.51.100.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
	{"instruction": "Mitigate SSH brute force from 198.51.100.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 71}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 198.51.100.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
	{"instruction": "Respond to suspected BGP route injection originating via peer 185.199.108.1", "config_raw": "router bgp 64596\n neighbor 185.199.108.1 remote-as 65160\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "185.199.108.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 185.199.108.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 185.199.108.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
	{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
	{"instruction": "Mitigate repeated failed VPN negotiation attempts from 192.0.2.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "192.0.2.1", "severity": "high", "attempts": 77}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 192.0.2.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 192.0.2.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
	{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/1", "config_raw": "router ospf 4\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "172.16.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
	{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
	{"instruction": "Increase logging and forward suspicious events to SIEM", "config_raw": "logging host 45.33.32.1\nlogging trap informational\n!\n", "wazuh_alert": {"type": "suspicious_activity_high_volume", "src_ip": "198.51.100.1", "severity": "medium"}, "gold_actions": [{"action_type": "monitoring", "commands": ["logging host 45.33.32.1", "logging trap warning", "service timestamps log datetime msec"], "verify": ["show logging"], "rollback": [], "explain": "Increase logging verbosity and forward logs to SIEM for detailed analysis."}]}