Upload batch 2/8

cases/bgp2_test_incidents/incident3_path_selection_incorrect/CORE-R1/show_logging_include_bgp.txt

@@ -0,0 +1 @@
+Nov 22 09:38:10.100: %BGP-5-ROUTECHANGE: bestpath change for 203.0.113.0/24, reason: policy/localpref

cases/bgp2_test_incidents/incident3_path_selection_incorrect/DC-RTR1/show_ip_bgp_summary.txt

@@ -0,0 +1,3 @@
+BGP router identifier 4.4.4.4, local AS number 65100
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+198.51.100.1    4 65001   55010   55210      700    0    0 10:22:01       800

cases/bgp2_test_incidents/incident3_path_selection_incorrect/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "Incorrect best path selected for 203.0.113.0/24: higher local-pref path exists but not chosen due to missing inbound policy on one neighbor."
+}

cases/bgp2_test_incidents/incident3_path_selection_incorrect/wazuh_alert.json

@@ -0,0 +1,8 @@
+{
+  "rule": "BGP path selection incorrect",
+  "device": "CORE-R1",
+  "severity": "medium",
+  "description": "Bestpath for 203.0.113.0/24 appears suboptimal; traffic shifted to backup provider.",
+  "timestamp": "2025-11-22T09:40:00Z",
+  "neighbor": "192.0.2.2"
+}

cases/bgp3_test_incidents/incident1_missing_routes_in_rib/CORE-R1/show_ip_bgp_203.0.113.0_24.txt

@@ -0,0 +1,9 @@
+BGP routing table entry for 203.0.113.0/24, version 1201
+Paths: (1 available, no best path)
+  65002
+    192.0.2.2 from 192.0.2.2 (2.2.2.2)
+      Origin IGP, metric 0, localpref 100, valid, external
+      rx pathid: 0, tx pathid: 0
+      Not advertised to any peer
+      RIB-failure(17), reason: next-hop unreachable
+      Next Hop: 192.0.2.254

cases/bgp3_test_incidents/incident1_missing_routes_in_rib/CORE-R1/show_ip_cef_192.0.2.254.txt

@@ -0,0 +1 @@
+%CEF: No route for 192.0.2.254/32

cases/bgp3_test_incidents/incident1_missing_routes_in_rib/CORE-R1/show_ip_route_192.0.2.254.txt

@@ -0,0 +1 @@
+% Network not in table

cases/bgp3_test_incidents/incident1_missing_routes_in_rib/CORE-R1/show_logging_include_bgp.txt

@@ -0,0 +1 @@
+Nov 23 10:03:11.901: %BGP-5-ROUTE: Route 203.0.113.0/24 from 192.0.2.2 not installed in RIB (nexthop unreachable)

cases/bgp3_test_incidents/incident1_missing_routes_in_rib/EDGE-RTR1/show_ip_bgp_summary.txt

@@ -0,0 +1,3 @@
+BGP router identifier 2.2.2.2, local AS number 65002
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+203.0.113.1     4 65001   88210   88190      990    0    0 03:12:10        980

cases/bgp3_test_incidents/incident1_missing_routes_in_rib/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "BGP shows prefix in BGP table but it is not installed in RIB due to next-hop unreachable."
+}

cases/bgp3_test_incidents/incident1_missing_routes_in_rib/wazuh_alert.json

@@ -0,0 +1,8 @@
+{
+  "rule": "BGP routes missing in RIB",
+  "device": "CORE-R1",
+  "severity": "high",
+  "description": "Prefix present in BGP table but missing in routing table; possible next-hop reachability issue.",
+  "timestamp": "2025-11-23T10:05:00Z",
+  "neighbor": "192.0.2.2"
+}

cases/bgp3_test_incidents/incident2_next_hop_self_issue/BRANCH-RTR1/show_run_bgp_snippet.txt

@@ -0,0 +1,3 @@
+router bgp 65001
+ neighbor 10.0.0.1 remote-as 65001
+ ! iBGP client side - no special config

cases/bgp3_test_incidents/incident2_next_hop_self_issue/CORE-R1/show_ip_bgp_10.10.0.0_16.txt

@@ -0,0 +1,7 @@
+BGP routing table entry for 10.10.0.0/16, version 1300
+Paths: (1 available, best #1)
+  65100
+    198.51.100.2 (metric 0) from 10.0.0.2 (10.0.0.2)
+      Origin IGP, localpref 100, valid, internal, best
+      Next Hop: 198.51.100.2
+      RIB-failure(17), reason: next-hop unreachable

cases/bgp3_test_incidents/incident2_next_hop_self_issue/CORE-R1/show_ip_bgp_neighbors_10.0.0.2.txt

@@ -0,0 +1,7 @@
+BGP neighbor is 10.0.0.2,  remote AS 65001, internal link
+  BGP state = Established, up for 10:22:12
+  Route refresh: advertised and received (new)
+  Inbound soft reconfiguration allowed
+  For address family: IPv4 Unicast
+    Route map for incoming advertisements is NONE
+    Route map for outgoing advertisements is NONE

cases/bgp3_test_incidents/incident2_next_hop_self_issue/CORE-R1/show_ip_route_198.51.100.2.txt

@@ -0,0 +1 @@
+% Network not in table

cases/bgp3_test_incidents/incident2_next_hop_self_issue/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "iBGP client receives routes with unreachable next-hop because next-hop-self is missing on RR."
+}

cases/bgp3_test_incidents/incident2_next_hop_self_issue/wazuh_alert.json

@@ -0,0 +1,8 @@
+{
+  "rule": "BGP next-hop self issue",
+  "device": "CORE-R1",
+  "severity": "medium",
+  "description": "Routes learned via iBGP have unreachable next-hop; next-hop-self may be missing.",
+  "timestamp": "2025-11-23T10:20:00Z",
+  "neighbor": "10.0.0.2"
+}

cases/bgp3_test_incidents/incident3_afi_safi_mismatch/CORE-R1/show_ip_bgp_summary.txt

@@ -0,0 +1,3 @@
+BGP router identifier 1.1.1.1, local AS number 65001
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+192.0.2.2       4 65002   88210   88190      990    0    0 03:12:10        980

cases/bgp3_test_incidents/incident3_afi_safi_mismatch/EDGE-RTR1/show_bgp_ipv6_unicast_summary.txt

@@ -0,0 +1,4 @@
+BGP router identifier 2.2.2.2, local AS number 65002
+For address family: IPv6 Unicast
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+2001:db8::2     4 65001   12010   11980        0    0    0 05:10:11          0

cases/bgp3_test_incidents/incident3_afi_safi_mismatch/EDGE-RTR1/show_bgp_neighbors_2001db8_2.txt

@@ -0,0 +1,8 @@
+BGP neighbor is 2001:db8::2, remote AS 65001, external link
+  BGP state = Established, up for 05:10:11
+  Neighbor capabilities:
+    Route refresh: advertised and received (new)
+    Address family IPv4 Unicast: advertised and received
+    Address family IPv6 Unicast: advertised and received
+  For address family: IPv6 Unicast
+    Neighbor is not activated

cases/bgp3_test_incidents/incident3_afi_safi_mismatch/EDGE-RTR1/show_run_bgp_snippet.txt

@@ -0,0 +1,6 @@
+router bgp 65002
+ neighbor 2001:db8::2 remote-as 65001
+ address-family ipv4
+  neighbor 2001:db8::2 activate
+ exit-address-family
+ ! NOTE: missing 'address-family ipv6 unicast' activation

cases/bgp3_test_incidents/incident3_afi_safi_mismatch/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "Neighbor is established but no IPv6 prefixes are exchanged because IPv6 address-family is not activated."
+}

cases/bgp3_test_incidents/incident3_afi_safi_mismatch/wazuh_alert.json

@@ -0,0 +1,8 @@
+{
+  "rule": "BGP AFI/SAFI mismatch",
+  "device": "EDGE-RTR1",
+  "severity": "high",
+  "description": "BGP neighbor session established but expected IPv6 prefixes are not received; AFI/SAFI activation mismatch.",
+  "timestamp": "2025-11-23T10:40:00Z",
+  "neighbor": "2001:db8::2"
+}

cases/ospf1_test_incidents/incident1_neighbor_down/ACCESS-SW1/show_ip_ospf_database.txt

@@ -0,0 +1 @@
+LSDB normal

cases/ospf1_test_incidents/incident1_neighbor_down/ACCESS-SW1/show_ip_ospf_interface.txt

@@ -0,0 +1 @@
+Gig0/1  State UP  MTU 1500

cases/ospf1_test_incidents/incident1_neighbor_down/ACCESS-SW1/show_ip_ospf_neighbor.txt

@@ -0,0 +1 @@
+Neighbor ID 1.1.1.1  ATTEMPT  Interface Gi0/1

cases/ospf1_test_incidents/incident1_neighbor_down/CORE-R1/show_ip_ospf_database.txt

@@ -0,0 +1 @@
+LSDB incomplete

cases/ospf1_test_incidents/incident1_neighbor_down/CORE-R1/show_ip_ospf_interface.txt

@@ -0,0 +1 @@
+Gig0/1  State DOWN  MTU 1500

cases/ospf1_test_incidents/incident1_neighbor_down/CORE-R1/show_ip_ospf_neighbor.txt

@@ -0,0 +1 @@
+Neighbor ID 2.2.2.2  DOWN  Interface Gi0/1

cases/ospf1_test_incidents/incident1_neighbor_down/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "OSPF neighbor down between CORE-R1 and ACCESS-SW1"
+}

cases/ospf1_test_incidents/incident2_stuck_init/ACCESS-SW2/show_ip_ospf_database.txt

@@ -0,0 +1 @@
+Missing Type-1 LSAs

cases/ospf1_test_incidents/incident2_stuck_init/ACCESS-SW2/show_ip_ospf_interface.txt

@@ -0,0 +1 @@
+Gig0/2  State BDR  MTU 1480

cases/ospf1_test_incidents/incident2_stuck_init/ACCESS-SW2/show_ip_ospf_neighbor.txt

@@ -0,0 +1 @@
+No neighbors in FULL state

cases/ospf1_test_incidents/incident2_stuck_init/CORE-R1/show_ip_ospf_database.txt

@@ -0,0 +1 @@
+All LSAs present

cases/ospf1_test_incidents/incident2_stuck_init/CORE-R1/show_ip_ospf_interface.txt

@@ -0,0 +1 @@
+Gig0/2  State DR  MTU 1500

cases/ospf1_test_incidents/incident2_stuck_init/CORE-R1/show_ip_ospf_neighbor.txt

@@ -0,0 +1 @@
+Neighbor ID 3.3.3.3  INIT  Interface Gi0/2

cases/ospf1_test_incidents/incident2_stuck_init/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "OSPF stuck in INIT state between CORE-R1 and ACCESS-SW2"
+}

cases/ospf1_test_incidents/incident3_exstart/BRANCH-RTR1/show_ip_ospf_database.txt

@@ -0,0 +1 @@
+Database exchange pending

cases/ospf1_test_incidents/incident3_exstart/BRANCH-RTR1/show_ip_ospf_interface.txt

@@ -0,0 +1 @@
+Gig0/0  State DR  MTU 1500

cases/ospf1_test_incidents/incident3_exstart/BRANCH-RTR1/show_ip_ospf_neighbor.txt

@@ -0,0 +1 @@
+Neighbor ID 1.1.1.1  EXSTART  Interface Gi0/0

cases/ospf1_test_incidents/incident3_exstart/CORE-R1/show_ip_ospf_database.txt

@@ -0,0 +1 @@
+Database exchange not started

cases/ospf1_test_incidents/incident3_exstart/CORE-R1/show_ip_ospf_interface.txt

@@ -0,0 +1 @@
+Gig0/0  State BDR  MTU 1492

cases/ospf1_test_incidents/incident3_exstart/CORE-R1/show_ip_ospf_neighbor.txt

@@ -0,0 +1 @@
+Neighbor ID 4.4.4.4  EXSTART  Interface Gi0/0

cases/ospf1_test_incidents/incident3_exstart/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "OSPF stuck in EXSTART between CORE-R1 and BRANCH-RTR1"
+}

cases/ospf2_test_incidents/incident1_exstart_exchange_stuck/ACCESS-SW1/show_ip_ospf_database.txt

@@ -0,0 +1,3 @@
+OSPF Router with ID (2.2.2.2)
+  Router Link States (Area 0)
+  NOTE: LSA requests outstanding; EXCHANGE stuck.

cases/ospf2_test_incidents/incident1_exstart_exchange_stuck/ACCESS-SW1/show_ip_ospf_interface.txt

@@ -0,0 +1,6 @@
+GigabitEthernet0/2 is up, line protocol is up
+  Internet Address 10.0.12.2/24, Area 0
+  MTU 1500 bytes
+  Process ID 1, Router ID 2.2.2.2, Network Type BROADCAST
+  State DR, Priority 1
+  Timer intervals: Hello 10, Dead 40, Wait 40, Retransmit 5

cases/ospf2_test_incidents/incident1_exstart_exchange_stuck/ACCESS-SW1/show_ip_ospf_neighbor.txt

@@ -0,0 +1,2 @@
+Neighbor ID     Pri   State           Dead Time   Address         Interface
+1.1.1.1          1    EXCHANGE        00:00:36    10.0.12.1       GigabitEthernet0/2

cases/ospf2_test_incidents/incident1_exstart_exchange_stuck/CORE-R1/show_ip_ospf_database.txt

@@ -0,0 +1,3 @@
+OSPF Router with ID (1.1.1.1) (Process ID 1)
+  Router Link States (Area 0)
+  NOTE: Database exchange not progressing; master/slave negotiation failed.

cases/ospf2_test_incidents/incident1_exstart_exchange_stuck/CORE-R1/show_ip_ospf_interface.txt

@@ -0,0 +1,8 @@
+GigabitEthernet0/2 is up, line protocol is up
+  Internet Address 10.0.12.1/24, Area 0
+  MTU 1500 bytes, BW 100000 Kbit/sec
+  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST
+  State BDR, Priority 1
+  Designated Router (ID) 2.2.2.2, Interface address 10.0.12.2
+  Backup Designated Router (ID) 1.1.1.1
+  Timer intervals: Hello 10, Dead 40, Wait 40, Retransmit 5

cases/ospf2_test_incidents/incident1_exstart_exchange_stuck/CORE-R1/show_ip_ospf_neighbor.txt

@@ -0,0 +1,2 @@
+Neighbor ID     Pri   State           Dead Time   Address         Interface
+2.2.2.2          1    EXSTART         00:00:32    10.0.12.2       GigabitEthernet0/2