Upload batch 8/8

README.md

@@ -20,59 +20,103 @@ pipeline_tag: text-generation
 
 # Wazuh-LLM Cisco Network Incident Response
 
-Automated network incident response pipeline for Cisco routers and switches.
-Takes Wazuh SIEM alerts, classifies them, queries live device state via RESTCONF,
-and generates CLI fix commands using fine-tuned LoRA adapters.
+Automated network incident response system for Cisco IOS-XE routers and switches.
+Takes Wazuh SIEM alerts, classifies them with a fine-tuned LLM, queries live device
+state via RESTCONF, generates CLI fix commands using domain-specific LoRA adapters,
+and applies the fixes automatically via RESTCONF PATCH.
+
+Two backends are provided: a **manual 3-script pipeline** for operator-controlled
+workflows, and a **fully autonomous daemon** that watches Wazuh logs and resolves
+incidents end-to-end without human intervention.
+
+---
 
 ## Architecture
 
+### Backend 1 — Manual Pipeline (3 scripts)
+
 ```
-Wazuh Alert (JSON)
-       │
-       ▼
- [prefilter.py]          ← detect SSH brute-force, drop auth noise
-       │
-       ▼
- [pipeline.py]
-   Stage 1 – Wazuh LLM (Ollama)     → incident_type, severity, IOCs
-   Stage 2 – Show command lookup     → deterministic table (incident → show cmds)
-   Stage 3 – RESTCONF mapping        → deterministic table (show cmd → YANG path)
-   Stage 4 – Domain routing          → selects correct LoRA adapter
-       │
-       ▼  creates show_outputs/alert_NNN_DEVICE_INCIDENT/
-           restconf_commands.json    ← execute these GETs against routers
-           alert_info.json
-       │
-    (operator drops RESTCONF response JSONs into the folder)
-       │
-       ▼
- [run_fix.py]            ← polls folders, runs domain LoRA, writes fix_commands.txt
+Wazuh alerts file
+        |
+        v
+[runners/prefilter.py]       filter level-12, drop auth noise
+        |
+        v
+[runners/pipeline.py]
+  Stage 1  Wazuh LLM (Ollama)       incident_type, severity, IOCs
+  Stage 2  Show command lookup       deterministic table (incident -> show cmds)
+  Stage 3  RESTCONF mapping          deterministic table (show cmd -> YANG path)
+  Stage 4  Domain routing            selects correct LoRA adapter
+        |
+        v  creates show_outputs/alert_NNN_DEVICE_INCIDENT/
+              restconf_commands.json   <- execute these GETs against routers
+              alert_info.json
+
+   (operator executes RESTCONF GETs and drops response JSONs into the folder)
+
+        |
+        v
+[runners/run_fix.py]         polls folders, runs domain LoRA
+        |
+        |-- fix_commands.txt              CLI fix commands (human readable)
+        +-- restconf_fix_commands.json    RESTCONF PATCH ops to apply the fix
+        +-- pipeline_fix_output.jsonl     full record of all alerts processed
 ```
 
+### Backend 2 — Autonomous Daemon (always-on)
+
+```
+/var/ossec/logs/alerts/alerts.json   (Wazuh live output, tailed continuously)
+        |
+        v
+[backend/daemon.py]
+  Watch    tail alerts file, detect new entries (level 7-12)
+  Detect   SSH brute-force: 5+ failures from same IP within 5-minute window
+        |
+        v  per alert, fully automatic:
+  [1]  Extract device       IP -> device map
+  [2]  Classify             Ollama wazuh-llama -> incident_type, IOCs, severity
+  [3]  Show commands        deterministic table lookup
+  [4]  RESTCONF GETs        execute live against device, collect YANG state
+  [5]  Domain LoRA          generate CLI fix commands
+  [6]  RESTCONF PATCHes     apply fixes directly to device
+  [7]  Log result           managed_incidents.jsonl + managed_incidents.log
+        |
+        v  per-alert folder:
+              restconf_get_results.json    what the device reported
+              fix_commands.txt             CLI commands the LLM generated
+              restconf_fix_commands.json   PATCH ops with YANG bodies
+              patch_results.json           HTTP status of each PATCH
+```
+
+---
+
 ## LoRA Adapters
 
 18 domain-specific adapters fine-tuned on Hermes-3-Llama-3.1-8B (r=8, alpha=32):
 
-| Domain | Adapter | Incidents covered |
-|--------|---------|-------------------|
-| OSPF   | `ospf_llm/lora_llm_ospf1` | Neighbor down, adjacency loss |
-| OSPF   | `ospf_llm/lora_llm_ospf2` | ExStart/Exchange stuck, MTU/area mismatch |
-| OSPF   | `ospf_llm/lora_llm_ospf3` | Auth, hello/dead timer, network-type mismatch |
-| OSPF   | `ospf_llm/lora_llm_ospf4` | LSA flood, LSDB inconsistency, redistribution |
-| BGP    | `bgp_llm/lora_llm_bgp1`  | Session flap, hold-timer expiry, reset |
-| BGP    | `bgp_llm/lora_llm_bgp2`  | Prefix limit, route leak, path selection |
-| BGP    | `bgp_llm/lora_llm_bgp3`  | Missing RIB routes, next-hop-self, AFI-SAFI |
-| Sec    | `sec_llm/lora_llm_sec1`  | ACL blocking legitimate traffic |
-| Sec    | `sec_llm/lora_llm_sec2`  | ACL misconfiguration |
-| Sec    | `sec_llm/lora_llm_sec3`  | Excessive deny entries, brute force, port scan |
-| Switch | `switch_llm/lora_llm_switch1` | MAC flapping, STP topology change, err-disable |
-| Switch | `switch_llm/lora_llm_switch2` | VLAN mismatch, trunk negotiation |
-| Switch | `switch_llm/lora_llm_switch3` | LLDP/CDP inconsistency, storm control |
-| Service| `service_llm/lora_llm_service1` | DHCP conflict, starvation, IP conflict |
-| Service| `service_llm/lora_llm_service2` | DNS issues, NTP unsync, ARP spoofing |
-| Sys    | `sys_llm/lora_llm_sys1`  | High CPU, memory exhaustion, process crash |
-| Sys    | `sys_llm/lora_llm_sys2`  | Interface flap, duplex mismatch |
-| Sys    | `sys_llm/lora_llm_sys3`  | Reload, environment, general system |
+| Domain  | Adapter                          | Incidents covered                                      |
+|---------|----------------------------------|--------------------------------------------------------|
+| OSPF    | `incidents/ospf/ospf1`           | Neighbor down, full-to-down, adjacency loss            |
+| OSPF    | `incidents/ospf/ospf2`           | ExStart/Exchange stuck, Init stuck, 2-Way              |
+| OSPF    | `incidents/ospf/ospf3`           | Auth, hello/dead mismatch, area, network-type, MTU     |
+| OSPF    | `incidents/ospf/ospf4`           | LSA flood, LSDB inconsistency, redistribution          |
+| BGP     | `incidents/bgp/lora_llm_bgp1`   | Session flap, hold-timer expiry, neighbor reset        |
+| BGP     | `incidents/bgp/lora_llm_bgp2`   | Prefix limit, route leak, path selection               |
+| BGP     | `incidents/bgp/lora_llm_bgp3`   | Missing RIB routes, next-hop-self, AFI-SAFI mismatch   |
+| Sec     | `incidents/security/lora_llm_sec1` | ACL blocking legitimate traffic                     |
+| Sec     | `incidents/security/lora_llm_sec2` | ACL misconfiguration (protocol, wildcard, direction)|
+| Sec     | `incidents/security/lora_llm_sec3` | Excessive denies, brute force, port scan            |
+| Switch  | `incidents/switch/lora_llm_switch1` | MAC flapping, STP topology change, err-disable    |
+| Switch  | `incidents/switch/lora_llm_switch2` | Port security, duplex/speed mismatch              |
+| Switch  | `incidents/switch/lora_llm_switch3` | VLAN mismatch, trunk negotiation, storm control   |
+| Service | `incidents/service/lora_llm_service1` | DHCP conflict, starvation, IP conflict          |
+| Service | `incidents/service/lora_llm_service2` | DNS failure, NTP unsync, ARP spoofing           |
+| Sys     | `incidents/sys/lora_llm_sys1`    | High CPU, memory exhaustion, process crash             |
+| Sys     | `incidents/sys/lora_llm_sys2`    | Interface flap, duplex/speed mismatch                  |
+| Sys     | `incidents/sys/lora_llm_sys3`    | Reload, environmental, general system health           |
+
+---
 
 ## Requirements
 
@@ -81,71 +125,142 @@ pip install -r requirements.txt
 ```
 
 The Wazuh LLM stage uses **Ollama** with a local `wazuh-llama` model:
+
 ```bash
 # Install Ollama: https://ollama.com
 ollama create wazuh-llama -f Modelfile
 ```
 
-## Quick Start
+---
+
+## Quick Start — Manual Pipeline
 
 ```bash
-# Step 1 — filter alerts (brute-force detection + auth noise removal)
-python prefilter.py --input alerts.json --output filtered_enriched.jsonl
+# Step 1 — pre-filter raw Wazuh export
+python runners/prefilter.py --input alerts.json --output s_alerts.jsonl
+
+# Step 2 — classify + build RESTCONF show commands + create per-alert folders
+python runners/pipeline.py --input s_alerts.jsonl --show-dir show_outputs
+
+# Step 3 — execute the RESTCONF GETs listed in each folder's restconf_commands.json
+#           and save JSON responses into the same folder
+
+# Step 4 — run domain LoRA, generate fix commands + RESTCONF PATCH ops
+python runners/run_fix.py --show-dir show_outputs
+```
+
+Per-alert output folder after all steps:
 
-# Step 2 — Phase 1: classify, map RESTCONF commands, create per-alert folders
-python pipeline.py --input filtered_enriched.jsonl
+```
+show_outputs/alert_001_R1_ospf_neighbor_down/
+    alert_info.json              alert metadata
+    restconf_commands.json       GET commands (written by pipeline.py)
+    show_ip_ospf_neighbor.json   RESTCONF GET response (you drop this)
+    fix_commands.txt             CLI fix commands (written by run_fix.py)
+    restconf_fix_commands.json   RESTCONF PATCH ops (written by run_fix.py)
+```
+
+---
+
+## Quick Start — Autonomous Daemon
+
+```bash
+# Standard — watch live Wazuh alerts, auto-apply fixes (level 7-12)
+python backend/daemon.py
 
-# Step 3 — execute the RESTCONF GETs listed in each alert folder's
-#           restconf_commands.json and save responses into the same folder
-#           (using the 'filename' field as the save name)
+# Dry run — classify + generate commands, but do NOT PATCH devices
+python backend/daemon.py --dry-run
 
-# Step 4 — Phase 2: run domain LoRA, generate fix commands
-python run_fix.py
+# Custom alert file and thresholds
+python backend/daemon.py \
+    --alerts /var/ossec/logs/alerts/alerts.json \
+    --min-level 7 \
+    --ssh-threshold 5 \
+    --ssh-window 300 \
+    --poll 3
 ```
 
+The daemon tail-follows the Wazuh alerts file and processes each alert
+automatically end-to-end with no operator involvement.
+
+### Daemon output files
+
+| File | Content |
+|------|---------|
+| `managed_incidents.jsonl` | Machine-readable: one JSON record per handled alert |
+| `managed_incidents.log` | Human-readable: one summary block per alert |
+| `daemon.log` | Full debug log of all daemon activity |
+| `show_outputs/alert_NNN_*/` | Per-alert audit folder (GET results, fix, patch results) |
+
+### SSH Brute-Force Detection
+
+The daemon tracks failed SSH login alerts independently of the level filter.
+When **5 or more failures from the same source IP occur within 5 minutes**,
+a synthetic `ssh_brute_force` incident is triggered and the full pipeline runs —
+even if each individual alert is below the level threshold.
+
+Tune with `--ssh-threshold N --ssh-window SECONDS`.
+
+---
+
 ## Device Configuration
 
-Edit the maps at the top of `pipeline.py` to match your lab:
+Edit the maps at the top of `runners/pipeline.py` and `backend/daemon.py` to match your network:
 
 ```python
 SOURCE_IP_DEVICE_MAP = {
     "10.10.10.10": "R1",
     "2.2.2.2":     "R2",
-    ...
+    # ...
 }
 DEVICE_MGMT_IP = {
-    "R1": "10.10.10.10",   # RESTCONF management IP
+    "R1": "10.10.10.10",   # management IP used for RESTCONF
     "R2": "2.2.2.2",
-    ...
+    # ...
 }
 ```
 
-Router credentials: `ROUTER_USER` / `ROUTER_PASS` constants in `pipeline.py`.
+Router credentials: `ROUTER_USER` / `ROUTER_PASS` constants (default: `admin` / `cisco123!`).
+
+---
 
 ## RESTCONF
 
-The pipeline uses RESTCONF over HTTPS (port 443) with Cisco IOS-XE YANG models.
-All show-command → YANG-path mappings are in the `_RESTCONF_RULES` table inside
-`pipeline.py` and also standalone in `show_to_restconf.py`.
-
-Supported YANG modules:
-- `Cisco-IOS-XE-ospf-oper`
-- `Cisco-IOS-XE-bgp-oper`
-- `Cisco-IOS-XE-interfaces-oper`
-- `Cisco-IOS-XE-acl-oper`
-- `Cisco-IOS-XE-spanning-tree-oper`
-- `Cisco-IOS-XE-dhcp-oper`
-- `Cisco-IOS-XE-arp-oper`
-- `Cisco-IOS-XE-nat-oper`
-- `Cisco-IOS-XE-ntp-oper`
-- `Cisco-IOS-XE-process-cpu-oper`
-- `Cisco-IOS-XE-process-memory-oper`
-- and more …
+All communication uses RESTCONF over HTTPS (port 443) with Cisco IOS-XE YANG models.
+
+**Read (GET)** — `_RESTCONF_RULES` table maps each show command to its YANG path:
+
+```
+show ip ospf neighbor  ->  /restconf/data/Cisco-IOS-XE-ospf-oper:ospf-oper-data/ospf-state
+show ip bgp summary    ->  /restconf/data/Cisco-IOS-XE-bgp-oper:bgp-state-data/bgp-route-vrfs
+show interfaces        ->  /restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces
+...
+```
+
+**Write (PATCH)** — CLI fix commands are parsed into context blocks and converted
+to RESTCONF PATCH operations with YANG-native JSON bodies:
+
+```
+interface GigabitEthernet0/0    ->  PATCH .../interface/GigabitEthernet=0%2F0
+ ip ospf hello-interval 10           body: Cisco-IOS-XE-ospf:ospf hello-interval 10
+router bgp 65001                ->  PATCH .../router/bgp=65001
+ neighbor 10.0.0.2 timers 30 90      body: neighbor timers keepalive 30 holdtime 90
+ip access-list extended INBOUND ->  PATCH .../ip/access-list/extended=INBOUND
+```
+
+Supported YANG modules include:
+`Cisco-IOS-XE-ospf-oper`, `Cisco-IOS-XE-bgp-oper`, `Cisco-IOS-XE-interfaces-oper`,
+`Cisco-IOS-XE-acl-oper`, `Cisco-IOS-XE-spanning-tree-oper`, `Cisco-IOS-XE-vlan-oper`,
+`Cisco-IOS-XE-dhcp-oper`, `Cisco-IOS-XE-arp-oper`, `Cisco-IOS-XE-nat-oper`,
+`Cisco-IOS-XE-ntp-oper`, `Cisco-IOS-XE-process-cpu-oper`,
+`Cisco-IOS-XE-process-memory-oper`, `Cisco-IOS-XE-native`
+
+---
 
 ## Training
 
 Training scripts and datasets are in `training/` and `datasets/`.
-Each adapter was trained for ~900–1500 examples with LoRA (r=8, alpha=32, dropout=0.1)
+Each adapter was trained on 900–1500 examples with LoRA (r=8, alpha=32, dropout=0.1)
 targeting `q_proj` and `v_proj` on Hermes-3-Llama-3.1-8B.
 
 ```bash
@@ -154,24 +269,37 @@ python training/train_bgp1.py
 # etc.
 ```
 
+---
+
 ## Lab Topology
 
-Tested on a 4-router + 2-switch Cisco lab:
-- R1 / R2 / R3 / R4 — IOS-XE routers (OSPF + BGP)
-- SW1 / SW2 — distribution switches
-- ACCESS-SW1 / ACCESS-SW2 — access switches
-- R4 — DHCP server (192.168.40.0/24)
+Tested on a 4-router + 4-switch Cisco IOS-XE lab:
 
-## Files
+- **R1 / R2 / R3 / R4** — IOS-XE routers running OSPF + BGP
+- **SW1 / SW2** — distribution switches
+- **ACCESS-SW1 / ACCESS-SW2** — access switches
+- **R4** — DHCP server (192.168.40.0/24 pool)
+- Wazuh manager collecting syslog from all devices
+
+---
 
-| File | Description |
+## Project Files
+
+| Path | Description |
 |------|-------------|
-| `pipeline.py` | Main Phase 1 pipeline (self-contained, no external imports) |
-| `prefilter.py` | Brute-force detection + auth alert filtering |
-| `run_fix.py` | Phase 2 — polls folders, runs domain LoRA, writes fix commands |
-| `show_to_restconf.py` | Standalone show→RESTCONF lookup tool |
-| `incident_to_showcommands.py` | Standalone incident→show-commands lookup tool |
-| `Modelfile` | Ollama model definition for the Wazuh classifier |
+| `runners/prefilter.py` | Pre-filter raw Wazuh export (level filter + brute-force detection) |
+| `runners/pipeline.py` | Manual backend Phase 1: classify, map RESTCONF GETs, create folders |
+| `runners/run_fix.py` | Manual backend Phase 2: run domain LoRA, generate and map fix commands |
+| `backend/daemon.py` | Autonomous daemon: watches live Wazuh alerts, resolves incidents end-to-end |
+| `Modelfile` | Ollama model definition for the Wazuh alert classifier |
+| `models/base/` | Hermes-3-Llama-3.1-8B base model |
+| `models/incidents/` | 18 domain-specific LoRA adapters |
+| `models/registry.json` | Adapter name -> path registry |
+| `datasets/` | Training datasets (JSONL, one incident type per file) |
+| `training/` | Training scripts (one per adapter) |
+| `cases/` | Incident test cases used for evaluation |
+
+---
 
 ## Citation
 

runners/run_fix.py

@@ -53,6 +53,17 @@ WORK_DIR     = Path(__file__).parent          # project-root/runners/
 PROJECT_ROOT = WORK_DIR.parent                # project-root/
 BASE_MODEL   = str(PROJECT_ROOT / "models" / "base" / "Hermes-3-Llama-3.1-8B")
 
+ROUTER_USER   = "admin"
+ROUTER_PASS   = "cisco123!"
+RESTCONF_PORT = 443
+
+import base64
+
+def _make_auth_header() -> str:
+    return "Basic " + base64.b64encode(
+        f"{ROUTER_USER}:{ROUTER_PASS}".encode()
+    ).decode()
+
 # ─────────────────────────────────────────────────────────────────────────────
 # DOMAIN INSTRUCTIONS
 # ─────────────────────────────────────────────────────────────────────────────
@@ -138,7 +149,8 @@ def load_show_outputs_from_folder(folder: Path) -> dict[str, str]:
 
     File naming:  show_ip_ospf_neighbor.json  (underscores = spaces)
     """
-    SKIP = {"restconf_commands.json", "alert_info.json", "fix_commands.json"}
+    SKIP = {"restconf_commands.json", "alert_info.json",
+            "fix_commands.json", "restconf_fix_commands.json"}
     result: dict[str, str] = {}
     for fp in sorted(folder.glob("*.json")):
         if fp.name in SKIP:
@@ -156,7 +168,8 @@ def load_show_outputs_from_folder(folder: Path) -> dict[str, str]:
 
 def folder_has_responses(folder: Path) -> bool:
     """True if the folder contains at least one RESTCONF response JSON file."""
-    SKIP = {"restconf_commands.json", "alert_info.json", "fix_commands.json"}
+    SKIP = {"restconf_commands.json", "alert_info.json",
+            "fix_commands.json", "restconf_fix_commands.json"}
     return any(
         fp.suffix == ".json" and fp.name not in SKIP
         for fp in folder.glob("*.json")
@@ -245,6 +258,422 @@ class FixRunner:
         return self._tokenizer.decode(out[0], skip_special_tokens=True)
 
 
+# ─────────────────────────────────────────────────────────────────────────────
+# CLI FIX COMMANDS → RESTCONF WRITE OPERATIONS
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Context-opening patterns (must NOT be indented in the CLI text)
+_CTX_PATTERNS = [
+    re.compile(r"^interface\s+(\S+)", re.I),
+    re.compile(r"^router\s+(ospf|bgp|eigrp|isis|rip)\s+(\S+)", re.I),
+    re.compile(r"^ip\s+access-list\s+(extended|standard)\s+(\S+)", re.I),
+    re.compile(r"^ip\s+dhcp\s+pool\s+(\S+)", re.I),
+    re.compile(r"^line\s+(con|vty|aux)\s+", re.I),
+]
+
+
+def _parse_cli_blocks(fix_text: str) -> list[dict]:
+    """
+    Parse CLI config text into context blocks.
+    Returns [{"context": "global" | "interface X" | "router ospf 1" | ...,
+              "lines": [cmd, ...]}]
+    """
+    blocks: list[dict] = []
+    current_ctx   = "global"
+    current_lines: list[str] = []
+
+    for raw_line in fix_text.splitlines():
+        stripped = raw_line.strip()
+        if not stripped:
+            continue
+
+        # "!" closes a block
+        if stripped == "!":
+            if current_lines:
+                blocks.append({"context": current_ctx, "lines": list(current_lines)})
+                current_lines = []
+                current_ctx = "global"
+            continue
+
+        # Non-indented line might open a new context
+        if not raw_line.startswith((" ", "\t")):
+            is_ctx = any(p.match(stripped) for p in _CTX_PATTERNS)
+            if is_ctx:
+                if current_lines:
+                    blocks.append({"context": current_ctx, "lines": list(current_lines)})
+                    current_lines = []
+                current_ctx = stripped
+                continue
+
+        current_lines.append(stripped)
+
+    if current_lines:
+        blocks.append({"context": current_ctx, "lines": list(current_lines)})
+
+    return blocks
+
+
+def _url_encode_slot(slot: str) -> str:
+    """Encode interface slot for RESTCONF URL:  0/0 -> 0%2F0"""
+    return slot.replace("/", "%2F").replace(".", "%2E")
+
+
+def _parse_interface_name(iface: str) -> tuple[str, str]:
+    """
+    'GigabitEthernet0/0' -> ('GigabitEthernet', '0/0')
+    'Loopback0'          -> ('Loopback', '0')
+    """
+    m = re.match(r"([A-Za-z]+)([\d/\.]+)", iface.strip())
+    if m:
+        return m.group(1), m.group(2)
+    return iface, "0"
+
+
+def _get_mgmt_ip_from_folder(folder: Path) -> str:
+    """Read mgmt_ip from restconf_commands.json written by pipeline.py."""
+    rc_file = folder / "restconf_commands.json"
+    if rc_file.exists():
+        try:
+            cmds = json.loads(rc_file.read_text(encoding="utf-8"))
+            if cmds and isinstance(cmds, list):
+                return cmds[0].get("mgmt_ip", "unknown")
+        except Exception:
+            pass
+    return "unknown"
+
+
+# ── YANG body generators ──────────────────────────────────────────────────────
+
+def _body_interface(itype: str, islot: str, lines: list[str]) -> dict:
+    inner: dict = {"name": islot}
+
+    for line in lines:
+        l = line.strip().lower()
+
+        if l in ("no shutdown", "no shut"):
+            inner["shutdown"] = False
+        elif l in ("shutdown", "shut"):
+            inner["shutdown"] = True
+
+        m = re.match(r"(?:no\s+)?ip\s+ospf\s+hello-interval\s+(\d+)", l)
+        if m:
+            ospf = inner.setdefault("ip", {}).setdefault("Cisco-IOS-XE-ospf:ospf", {})
+            ospf["hello-interval"] = int(m.group(1))
+
+        m = re.match(r"(?:no\s+)?ip\s+ospf\s+dead-interval\s+(\d+)", l)
+        if m:
+            ospf = inner.setdefault("ip", {}).setdefault("Cisco-IOS-XE-ospf:ospf", {})
+            ospf["dead-interval"] = int(m.group(1))
+
+        m = re.match(r"ip\s+ospf\s+(\d+)\s+area\s+(\S+)", l)
+        if m:
+            ospf = inner.setdefault("ip", {}).setdefault("Cisco-IOS-XE-ospf:ospf", {})
+            ospf["process-id"] = int(m.group(1))
+            ospf["area"] = m.group(2)
+
+        m = re.match(r"ip\s+ospf\s+network\s+(\S+)", l)
+        if m:
+            ospf = inner.setdefault("ip", {}).setdefault("Cisco-IOS-XE-ospf:ospf", {})
+            ospf["network"] = {"network-type": m.group(1)}
+
+        if re.match(r"ip\s+ospf\s+mtu-ignore", l):
+            inner.setdefault("ip", {}).setdefault("Cisco-IOS-XE-ospf:ospf", {})["mtu-ignore"] = True
+
+        if re.match(r"ip\s+ospf\s+authentication", l):
+            inner.setdefault("ip", {}).setdefault("Cisco-IOS-XE-ospf:ospf", {})["authentication"] = {}
+
+        m = re.match(r"switchport\s+mode\s+(\S+)", l)
+        if m:
+            (inner.setdefault("Cisco-IOS-XE-switch:switchport-conf", {})
+                  .setdefault("switchport", {})
+                  .setdefault("mode", {}))[m.group(1)] = {}
+
+        m = re.match(r"switchport\s+access\s+vlan\s+(\d+)", l)
+        if m:
+            (inner.setdefault("Cisco-IOS-XE-switch:switchport-conf", {})
+                  .setdefault("switchport", {})
+                  .setdefault("access", {}))["vlan"] = {"vlan": int(m.group(1))}
+
+        m = re.match(r"switchport\s+trunk\s+native\s+vlan\s+(\d+)", l)
+        if m:
+            (inner.setdefault("Cisco-IOS-XE-switch:switchport-conf", {})
+                  .setdefault("switchport", {})
+                  .setdefault("trunk", {}))["native"] = {"vlan": {"vlan-id": int(m.group(1))}}
+
+        if re.match(r"spanning-tree\s+portfast", l):
+            inner.setdefault("Cisco-IOS-XE-spanning-tree:spanning-tree", {})["portfast"] = {}
+
+        m = re.match(r"duplex\s+(\S+)", l)
+        if m:
+            inner["duplex"] = {"Cisco-IOS-XE-ethernet:duplex-enum": m.group(1)}
+
+        m = re.match(r"speed\s+(\d+)", l)
+        if m:
+            inner["speed"] = {"Cisco-IOS-XE-ethernet:value": int(m.group(1))}
+
+        m = re.match(r"description\s+(.+)", l)
+        if m:
+            inner["description"] = m.group(1)
+
+        m = re.match(r"ip\s+address\s+(\S+)\s+(\S+)", l)
+        if m:
+            inner.setdefault("ip", {}).setdefault("address", {})["primary"] = {
+                "address": m.group(1), "mask": m.group(2)
+            }
+
+        m = re.match(r"storm-control\s+broadcast\s+level\s+([\d\.]+)", l)
+        if m:
+            (inner.setdefault("Cisco-IOS-XE-storm-control:storm-control", {})
+                  .setdefault("action", {}))["broadcast"] = {
+                "level": {"threshold": float(m.group(1))}
+            }
+
+    return {f"Cisco-IOS-XE-native:{itype}": [inner]}
+
+
+def _body_ospf(process_id: str, lines: list[str]) -> dict:
+    inner: dict = {"id": int(process_id) if process_id.isdigit() else process_id}
+
+    for line in lines:
+        l = line.strip().lower()
+
+        m = re.match(r"area\s+(\S+)\s+authentication(\s+message-digest)?", l)
+        if m:
+            area_entry: dict = {"area-id": m.group(1)}
+            area_entry["authentication"] = {"message-digest": {}} if m.group(2) else {}
+            inner.setdefault("area", []).append(area_entry)
+
+        m = re.match(r"area\s+(\S+)\s+stub", l)
+        if m:
+            inner.setdefault("area", []).append({"area-id": m.group(1), "stub": {}})
+
+        m = re.match(r"network\s+(\S+)\s+(\S+)\s+area\s+(\S+)", l)
+        if m:
+            inner.setdefault("network", []).append({
+                "ip": m.group(1), "mask": m.group(2), "area": m.group(3)
+            })
+
+        m = re.match(r"router-id\s+(\S+)", l)
+        if m:
+            inner["router-id"] = m.group(1)
+
+        m = re.match(r"timers\s+spf\s+(\d+)\s+(\d+)", l)
+        if m:
+            inner["timers"] = {"throttle": {"spf": {
+                "initial-spf-delay": int(m.group(1)),
+                "minimum-hold": int(m.group(2))
+            }}}
+
+        m = re.match(r"redistribute\s+(\S+)", l)
+        if m:
+            inner.setdefault("redistribute", []).append({"source": m.group(1)})
+
+    return {"Cisco-IOS-XE-native:ospf": [inner]}
+
+
+def _body_bgp(asn: str, lines: list[str]) -> dict:
+    inner: dict = {"id": int(asn) if asn.isdigit() else asn}
+    neighbors: dict[str, dict] = {}  # ip -> neighbor dict
+
+    for line in lines:
+        l = line.strip().lower()
+
+        m = re.match(r"neighbor\s+(\S+)\s+timers\s+(\d+)\s+(\d+)", l)
+        if m:
+            nbr = neighbors.setdefault(m.group(1), {"id": m.group(1)})
+            nbr["timers"] = {"keepalive": int(m.group(2)), "holdtime": int(m.group(3))}
+
+        m = re.match(r"neighbor\s+(\S+)\s+maximum-prefix\s+(\d+)", l)
+        if m:
+            nbr = neighbors.setdefault(m.group(1), {"id": m.group(1)})
+            nbr["maximum-prefix"] = int(m.group(2))
+
+        m = re.match(r"neighbor\s+(\S+)\s+next-hop-self", l)
+        if m:
+            nbr = neighbors.setdefault(m.group(1), {"id": m.group(1)})
+            nbr["next-hop-self"] = {}
+
+        m = re.match(r"neighbor\s+(\S+)\s+remote-as\s+(\d+)", l)
+        if m:
+            nbr = neighbors.setdefault(m.group(1), {"id": m.group(1)})
+            nbr["remote-as"] = int(m.group(2))
+
+        m = re.match(r"neighbor\s+(\S+)\s+route-map\s+(\S+)\s+(in|out)", l)
+        if m:
+            nbr = neighbors.setdefault(m.group(1), {"id": m.group(1)})
+            nbr.setdefault("route-map", []).append({"inout": m.group(3), "route-map-name": m.group(2)})
+
+        m = re.match(r"bgp\s+router-id\s+(\S+)", l)
+        if m:
+            inner["bgp"] = {"router-id": {"ip": m.group(1)}}
+
+    if neighbors:
+        inner["neighbor"] = list(neighbors.values())
+
+    return {"Cisco-IOS-XE-native:bgp": [inner]}
+
+
+def _body_acl(acl_type: str, acl_name: str, lines: list[str]) -> dict:
+    entries = []
+    seq = 10
+    for line in lines:
+        m = re.match(r"(permit|deny)\s+(.+)", line.strip(), re.I)
+        if m:
+            entries.append({"sequence": seq, "action": m.group(1).lower(), "rule": m.group(2)})
+            seq += 10
+
+    return {f"Cisco-IOS-XE-native:{acl_type}": [{"name": acl_name, "access-list-seq-rule": entries}]}
+
+
+def _body_global_lines(lines: list[str]) -> list[dict]:
+    """
+    Parse global-level CLI commands.
+    Returns list of {"path_suffix": str, "body": dict}.
+    """
+    ops: list[dict] = []
+
+    for line in lines:
+        l = line.strip().lower()
+
+        m = re.match(r"ntp\s+server\s+(\S+)", l)
+        if m:
+            ops.append({"path_suffix": "/ntp", "body": {
+                "Cisco-IOS-XE-native:ntp": {"server": {"server-list": [{"ip-address": m.group(1)}]}}
+            }})
+
+        m = re.match(r"ip\s+route\s+(\S+)\s+(\S+)\s+(\S+)", l)
+        if m:
+            ops.append({"path_suffix": "/ip/route", "body": {
+                "Cisco-IOS-XE-native:route": {"ip-route-interface-forwarding-list": [{
+                    "prefix": m.group(1), "mask": m.group(2),
+                    "fwd-list": [{"fwd": m.group(3)}]
+                }]}
+            }})
+
+        if re.match(r"no\s+ip\s+http\s+secure-server", l):
+            ops.append({"path_suffix": "/ip/http", "body": {
+                "Cisco-IOS-XE-native:http": {"secure-server": False}
+            }})
+        elif re.match(r"no\s+ip\s+http\s+server", l):
+            ops.append({"path_suffix": "/ip/http", "body": {
+                "Cisco-IOS-XE-native:http": {"server": False}
+            }})
+
+        m = re.match(r"logging\s+buffered\s+(\d+)", l)
+        if m:
+            ops.append({"path_suffix": "/logging", "body": {
+                "Cisco-IOS-XE-native:logging": {"buffered": {"size": int(m.group(1))}}
+            }})
+
+        if re.match(r"no\s+logging\s+console", l):
+            ops.append({"path_suffix": "/logging", "body": {
+                "Cisco-IOS-XE-native:logging": {"console": False}
+            }})
+
+        m = re.match(r"exception\s+crashinfo\s+(?:file\s+)?(.+)", l)
+        if m:
+            ops.append({"path_suffix": "/exception", "body": {
+                "Cisco-IOS-XE-native:exception": {"crashinfo": {"filepath": m.group(1).strip()}}
+            }})
+
+        m = re.match(r"ip\s+access-list\s+(extended|standard)\s+(\S+)", l)
+        if m:
+            ops.append({"path_suffix": f"/ip/access-list/{m.group(1)}={m.group(2)}", "body": {
+                f"Cisco-IOS-XE-native:{m.group(1)}": [{"name": m.group(2)}]
+            }})
+
+    return ops
+
+
+def _cli_to_restconf_fix_ops(device: str, mgmt_ip: str, fix_text: str) -> list[dict]:
+    """
+    Parse CLI fix commands and return a list of RESTCONF PATCH operations
+    with best-effort YANG JSON bodies.
+    """
+    headers = {
+        "Accept":        "application/yang-data+json",
+        "Content-Type":  "application/yang-data+json",
+        "Authorization": _make_auth_header(),
+    }
+    base_url = f"https://{mgmt_ip}:{RESTCONF_PORT}/restconf/data/Cisco-IOS-XE-native:native"
+
+    blocks = _parse_cli_blocks(fix_text)
+    ops: list[dict] = []
+
+    for block in blocks:
+        ctx   = block["context"]
+        lines = block["lines"]
+        if not lines:
+            continue
+
+        ctx_l = ctx.strip().lower()
+
+        # ── interface ──
+        m = re.match(r"interface\s+(\S+)", ctx_l)
+        if m:
+            iface = m.group(1)
+            itype, islot = _parse_interface_name(iface)
+            url  = f"{base_url}/interface/{itype}={_url_encode_slot(islot)}"
+            body = _body_interface(itype, islot, lines)
+            ops.append({"method": "PATCH", "url": url, "headers": headers,
+                        "body": body, "cli_context": ctx, "cli_commands": lines})
+            continue
+
+        # ── router ospf ──
+        m = re.match(r"router\s+ospf\s+(\S+)", ctx_l)
+        if m:
+            pid = m.group(1)
+            url  = f"{base_url}/router/ospf={pid}"
+            body = _body_ospf(pid, lines)
+            ops.append({"method": "PATCH", "url": url, "headers": headers,
+                        "body": body, "cli_context": ctx, "cli_commands": lines})
+            continue
+
+        # ── router bgp ──
+        m = re.match(r"router\s+bgp\s+(\S+)", ctx_l)
+        if m:
+            asn  = m.group(1)
+            url  = f"{base_url}/router/bgp={asn}"
+            body = _body_bgp(asn, lines)
+            ops.append({"method": "PATCH", "url": url, "headers": headers,
+                        "body": body, "cli_context": ctx, "cli_commands": lines})
+            continue
+
+        # ── ip access-list ──
+        m = re.match(r"ip\s+access-list\s+(extended|standard)\s+(\S+)", ctx_l)
+        if m:
+            acl_type, acl_name = m.group(1), m.group(2)
+            url  = f"{base_url}/ip/access-list/{acl_type}={acl_name}"
+            body = _body_acl(acl_type, acl_name, lines)
+            ops.append({"method": "PATCH", "url": url, "headers": headers,
+                        "body": body, "cli_context": ctx, "cli_commands": lines})
+            continue
+
+        # ── global ──
+        if ctx_l == "global":
+            global_ops = _body_global_lines(lines)
+            if global_ops:
+                for gop in global_ops:
+                    ops.append({"method": "PATCH",
+                                "url": base_url + gop["path_suffix"],
+                                "headers": headers, "body": gop["body"],
+                                "cli_context": "global", "cli_commands": lines})
+            else:
+                # Unknown global commands — include as note
+                ops.append({"method": "PATCH", "url": base_url, "headers": headers,
+                            "body": None, "cli_context": "global",
+                            "cli_commands": lines,
+                            "note": "Could not map to YANG - apply manually via CLI"})
+            continue
+
+        # ── unrecognised context ──
+        ops.append({"method": "PATCH", "url": base_url, "headers": headers,
+                    "body": None, "cli_context": ctx, "cli_commands": lines,
+                    "note": "Context not mapped to RESTCONF - apply manually"})
+
+    return ops
+
+
 # ─────────────────────────────────────────────────────────────────────────────
 # MAIN
 # ─────────────────────────────────────────────────────────────────────────────
@@ -348,27 +777,44 @@ def run(stage1_file: Path, show_base: Path, output_file: Path, poll_secs: int):
             fix_file.write_text(fix, encoding="utf-8")
             log.info("Fix saved to: %s", fix_file)
 
+            # ── Convert CLI fix commands to RESTCONF PATCH operations ─────────
+            mgmt_ip    = _get_mgmt_ip_from_folder(folder)
+            restconf_ops = _cli_to_restconf_fix_ops(device, mgmt_ip, fix)
+            rc_fix_file  = folder / "restconf_fix_commands.json"
+            rc_fix_file.write_text(
+                json.dumps(restconf_ops, indent=2, ensure_ascii=False),
+                encoding="utf-8"
+            )
+            log.info("RESTCONF fix operations (%d) written to: %s",
+                     len(restconf_ops), rc_fix_file)
+            for op in restconf_ops:
+                flag = "  [NO BODY]" if op.get("body") is None else ""
+                log.info("  %-6s  %s%s", op["method"], op["url"], flag)
+
             # ── Write to main output file ────────────────────────────────────
             out_rec = {
-                "alert_index":        idx,
-                "timestamp":          rec.get("timestamp"),
-                "device":             device,
-                "incident_type":      incident,
-                "domain":             domain,
-                "sub_id":             sub_id,
-                "lora_used":          lora_rel,
-                "alert_folder":       str(folder),
-                "wazuh_alert":        alert,
-                "show_commands_used": list(show_outputs.keys()),
-                "fix_commands":       fix,
+                "alert_index":          idx,
+                "timestamp":            rec.get("timestamp"),
+                "device":               device,
+                "incident_type":        incident,
+                "domain":               domain,
+                "sub_id":               sub_id,
+                "lora_used":            lora_rel,
+                "alert_folder":         str(folder),
+                "wazuh_alert":          alert,
+                "show_commands_used":   list(show_outputs.keys()),
+                "fix_commands":         fix,
+                "restconf_fix_count":   len(restconf_ops),
+                "restconf_fix_file":    str(rc_fix_file),
             }
             fout.write(json.dumps(out_rec, ensure_ascii=False) + "\n")
             fout.flush()
 
     print("\n" + "=" * 65)
     print(f"  All alerts processed.")
-    print(f"  Results  -> {output_file.resolve()}")
-    print(f"  Fix files saved inside each alert folder as fix_commands.txt")
+    print(f"  Results          -> {output_file.resolve()}")
+    print(f"  Per-alert folder -> fix_commands.txt         (CLI commands)")
+    print(f"  Per-alert folder -> restconf_fix_commands.json (RESTCONF PATCH ops)")
     print("=" * 65 + "\n")