Upload batch 1/8

.gitattributes

@@ -1,35 +1,8 @@
-*.7z filter=lfs diff=lfs merge=lfs -text
-*.arrow filter=lfs diff=lfs merge=lfs -text
+*.safetensors filter=lfs diff=lfs merge=lfs -text
 *.bin filter=lfs diff=lfs merge=lfs -text
-*.bz2 filter=lfs diff=lfs merge=lfs -text
-*.ckpt filter=lfs diff=lfs merge=lfs -text
-*.ftz filter=lfs diff=lfs merge=lfs -text
-*.gz filter=lfs diff=lfs merge=lfs -text
-*.h5 filter=lfs diff=lfs merge=lfs -text
-*.joblib filter=lfs diff=lfs merge=lfs -text
-*.lfs.* filter=lfs diff=lfs merge=lfs -text
-*.mlmodel filter=lfs diff=lfs merge=lfs -text
-*.model filter=lfs diff=lfs merge=lfs -text
-*.msgpack filter=lfs diff=lfs merge=lfs -text
-*.npy filter=lfs diff=lfs merge=lfs -text
-*.npz filter=lfs diff=lfs merge=lfs -text
-*.onnx filter=lfs diff=lfs merge=lfs -text
-*.ot filter=lfs diff=lfs merge=lfs -text
-*.parquet filter=lfs diff=lfs merge=lfs -text
-*.pb filter=lfs diff=lfs merge=lfs -text
-*.pickle filter=lfs diff=lfs merge=lfs -text
-*.pkl filter=lfs diff=lfs merge=lfs -text
 *.pt filter=lfs diff=lfs merge=lfs -text
 *.pth filter=lfs diff=lfs merge=lfs -text
-*.rar filter=lfs diff=lfs merge=lfs -text
-*.safetensors filter=lfs diff=lfs merge=lfs -text
-saved_model/**/* filter=lfs diff=lfs merge=lfs -text
-*.tar.* filter=lfs diff=lfs merge=lfs -text
-*.tar filter=lfs diff=lfs merge=lfs -text
-*.tflite filter=lfs diff=lfs merge=lfs -text
-*.tgz filter=lfs diff=lfs merge=lfs -text
-*.wasm filter=lfs diff=lfs merge=lfs -text
-*.xz filter=lfs diff=lfs merge=lfs -text
-*.zip filter=lfs diff=lfs merge=lfs -text
-*.zst filter=lfs diff=lfs merge=lfs -text
-*tfevents* filter=lfs diff=lfs merge=lfs -text
+*.gguf filter=lfs diff=lfs merge=lfs -text
+*.ggml filter=lfs diff=lfs merge=lfs -text
+*.h5 filter=lfs diff=lfs merge=lfs -text
+*.msgpack filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1,45 @@
+# Runtime outputs
+show_outputs/
+show_outputs*.zip
+pipeline_stage1.jsonl
+pipeline_fix_output.jsonl
+pipeline_results.jsonl
+results.jsonl
+results_raw.jsonl
+results_raw1.jsonl
+selector_output.jsonl
+selector_output1.jsonl
+s_alerts.jsonl
+alerts_transformed.jsonl
+filtered.json
+filtered_enriched.jsonl
+show_commands.jsonl
+test_llmt_output.jsonl
+cisco_input.jsonl
+cisco_input1.jsonl
+cisco_output.jsonl
+
+# Logs
+*.log
+logs.txt
+alerts.txt
+
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+env/
+
+# LoRA checkpoints (keep only final adapter_model.safetensors)
+**/checkpoint-*/
+
+# Scratch / test files
+aftertest*.py
+analyze_logs.py
+count_tokens.py
+tesp_ospf4.py
+
+# Large temp files
+*.tmp

backend/app/core/config.py

@@ -0,0 +1,30 @@
+import json
+from pathlib import Path
+
+BASE_DIR = Path(__file__).resolve().parents[3]
+MODELS_DIR = BASE_DIR / "models"
+
+
+class ModelRegistry:
+    def __init__(self, registry_path: Path):
+        if not registry_path.exists():
+            raise FileNotFoundError(f"Registry not found: {registry_path}")
+
+        with open(registry_path, "r", encoding="utf-8") as f:
+            self.registry = json.load(f)
+
+        self.base_model_path = Path(self.registry["base_model_path"])
+        self.adapters = self.registry["adapters"]
+
+    def get_base_model(self) -> Path:
+        return self.base_model_path
+
+    def get_adapter(self, name: str) -> Path:
+        if name not in self.adapters:
+            raise KeyError(f"Adapter '{name}' not found in registry")
+        return Path(self.adapters[name])
+
+
+REGISTRY = ModelRegistry(
+    registry_path=MODELS_DIR / "registry.json"
+)

backend/app/llm/translator_llm.py

@@ -0,0 +1,55 @@
+from transformers import AutoTokenizer, AutoModelForCausalLM
+from peft import PeftModel
+import torch
+
+from app.core.config import REGISTRY
+
+
+class TranslatorLLM:
+    def __init__(self):
+        base_path = REGISTRY.get_base_model()
+        adapter_path = REGISTRY.get_adapter("llm_t")
+
+        self.tokenizer = AutoTokenizer.from_pretrained(base_path)
+        base_model = AutoModelForCausalLM.from_pretrained(
+            base_path,
+            torch_dtype=torch.float16,
+            device_map="auto"
+        )
+        self.model = PeftModel.from_pretrained(base_model, adapter_path)
+
+    def translate(self, cli_commands: list[str], mode: str) -> list[dict]:
+        """
+        mode = 'show' -> RESTCONF GET
+        mode = 'fix'  -> RESTCONF PATCH/POST
+        """
+        prompt = self._build_prompt(cli_commands, mode)
+
+        inputs = self.tokenizer(prompt, return_tensors="pt").to(self.model.device)
+        outputs = self.model.generate(
+            **inputs,
+            max_new_tokens=512,
+            do_sample=False
+        )
+
+        text = self.tokenizer.decode(outputs[0], skip_special_tokens=True)
+        return self._parse_restconf(text)
+
+    def _build_prompt(self, cli_commands: list[str], mode: str) -> str:
+        header = (
+            "Convert the following Cisco CLI commands into RESTCONF API calls.\n"
+            f"Mode: {mode.upper()}\n"
+            "Return ONLY valid JSON.\n\n"
+        )
+        body = "\n".join(cli_commands)
+        return header + body
+
+    def _parse_restconf(self, output: str) -> list[dict]:
+        """
+        Očakáva JSON array RESTCONF callov.
+        """
+        import json
+        try:
+            return json.loads(output)
+        except Exception:
+            raise ValueError(f"Invalid RESTCONF output:\n{output}")

backend/app/net/restconf_client.py

@@ -0,0 +1,55 @@
+from transformers import AutoTokenizer, AutoModelForCausalLM
+from peft import PeftModel
+import torch
+
+from app.core.config import REGISTRY
+
+
+class TranslatorLLM:
+    def __init__(self):
+        base_path = REGISTRY.get_base_model()
+        adapter_path = REGISTRY.get_adapter("llm_t")
+
+        self.tokenizer = AutoTokenizer.from_pretrained(base_path)
+        base_model = AutoModelForCausalLM.from_pretrained(
+            base_path,
+            torch_dtype=torch.float16,
+            device_map="auto"
+        )
+        self.model = PeftModel.from_pretrained(base_model, adapter_path)
+
+    def translate(self, cli_commands: list[str], mode: str) -> list[dict]:
+        """
+        mode = 'show' -> RESTCONF GET
+        mode = 'fix'  -> RESTCONF PATCH/POST
+        """
+        prompt = self._build_prompt(cli_commands, mode)
+
+        inputs = self.tokenizer(prompt, return_tensors="pt").to(self.model.device)
+        outputs = self.model.generate(
+            **inputs,
+            max_new_tokens=512,
+            do_sample=False
+        )
+
+        text = self.tokenizer.decode(outputs[0], skip_special_tokens=True)
+        return self._parse_restconf(text)
+
+    def _build_prompt(self, cli_commands: list[str], mode: str) -> str:
+        header = (
+            "Convert the following Cisco CLI commands into RESTCONF API calls.\n"
+            f"Mode: {mode.upper()}\n"
+            "Return ONLY valid JSON.\n\n"
+        )
+        body = "\n".join(cli_commands)
+        return header + body
+
+    def _parse_restconf(self, output: str) -> list[dict]:
+        """
+        Očakáva JSON array RESTCONF callov.
+        """
+        import json
+        try:
+            return json.loads(output)
+        except Exception:
+            raise ValueError(f"Invalid RESTCONF output:\n{output}")

backend/app/pipeline/incident_router.py

@@ -0,0 +1,178 @@
+import re
+from dataclasses import dataclass
+from typing import Dict, Any, Optional
+
+
+@dataclass(frozen=True)
+class RouteDecision:
+    """
+    Výsledok rozhodnutia: ktorý incident model použiť.
+    adapter_key musí existovať v registry.json (REGISTRY.get_adapter(adapter_key))
+    """
+    adapter_key: str
+    domain: str
+    reason: str
+
+
+class IncidentRouter:
+    """
+    Deterministický router pre výber incident LLM.
+
+    Vstupy:
+      - wazuh_alert: dict (z LLM1 / priamo z Wazuh)
+      - evidence_text: Optional[str] (normalizované outputs zo show/RESTCONF)
+
+    Výstup:
+      - RouteDecision(adapter_key=..., domain=..., reason=...)
+    """
+
+    # --- Regex pomocníky ---
+    _re_ospf = re.compile(r"\bospf\b|neighbor|adjacency|lsa|lsdb|exstart|exchange", re.IGNORECASE)
+    _re_bgp = re.compile(r"\bbgp\b|neighbor|hold|keepalive|prefix|route leak|afi|safi|rib|next-hop", re.IGNORECASE)
+    _re_switch = re.compile(r"\bstp\b|spanning-tree|vlan|trunk|native vlan|mac flapp|err-disable|storm", re.IGNORECASE)
+    _re_sec = re.compile(r"\bacl\b|access-list|nat\b|spoof|ssh brute|failed login|snmp", re.IGNORECASE)
+    _re_service = re.compile(r"\bdns\b|nxdomain|ntp\b|unsync|clock is unsynchronized|arp spoof", re.IGNORECASE)
+
+    # OSPF sub-incident patterns
+    _re_ospf_exstart = re.compile(r"exstart|exchange|mtu mismatch|database exchange", re.IGNORECASE)
+    _re_ospf_auth = re.compile(r"auth|authentication|md5|key mismatch", re.IGNORECASE)
+    _re_ospf_timers = re.compile(r"hello|dead|timer mismatch", re.IGNORECASE)
+    _re_ospf_lsa = re.compile(r"lsa flood|lsdb inconsisten|too many lsa|throttle", re.IGNORECASE)
+
+    # BGP sub-incident patterns
+    _re_bgp_session = re.compile(r"session flap|hold timer|reset|cease|neighbor down|not established", re.IGNORECASE)
+    _re_bgp_policy = re.compile(r"prefix limit|route leak|path selection|weight|local-pref", re.IGNORECASE)
+    _re_bgp_rib = re.compile(r"missing routes|not in rib|next-hop self|afi|safi|address-family", re.IGNORECASE)
+
+    # SWITCH sub-incident patterns
+    _re_sw_l2 = re.compile(r"mac flapp|stp topology change|err-disable", re.IGNORECASE)
+    _re_sw_trunk = re.compile(r"vlan mismatch|trunk negotiation|native vlan mismatch", re.IGNORECASE)
+    _re_sw_misc = re.compile(r"lldp|cdp|storm control|broadcast storm", re.IGNORECASE)
+
+    # SECURITY sub-incident patterns
+    _re_sec_acl = re.compile(r"acl blocking|acl misconfig|excessive deny|access-list", re.IGNORECASE)
+    _re_sec_fw_nat_spoof = re.compile(r"connection exhaust|nat translation|spoofing suspected|uRPF|ip verify source", re.IGNORECASE)
+    _re_sec_bruteforce = re.compile(r"ssh brute|failed login|snmp brute", re.IGNORECASE)
+
+    # SERVICE sub-incident patterns
+    _re_svc_dhcp = re.compile(r"dhcp conflict|dhcp starvation|pool utilization|discover rate|ip conflict", re.IGNORECASE)
+    _re_svc_dns_ntp_arp = re.compile(r"dns|nxdomain|ntp|unsync|arp spoof", re.IGNORECASE)
+
+    def decide(self, wazuh_alert: Dict[str, Any], evidence_text: Optional[str] = None) -> RouteDecision:
+        text = self._join_text(wazuh_alert, evidence_text)
+
+        # 1) Hrubá doména
+        domain = self._detect_domain(text)
+
+        # 2) Sub-router podľa domény
+        if domain == "ospf":
+            return self._route_ospf(text)
+        if domain == "bgp":
+            return self._route_bgp(text)
+        if domain == "switch":
+            return self._route_switch(text)
+        if domain == "security":
+            return self._route_security(text)
+        if domain == "service":
+            return self._route_service(text)
+
+        # fallback: bezpečný default (nič nemení) – môžeš premapovať na "manual_review"
+        return RouteDecision(
+            adapter_key="incident_manual_review",
+            domain="unknown",
+            reason="No reliable domain match; route to manual review."
+        )
+
+    # --------------------------
+    # Domain detection
+    # --------------------------
+    def _detect_domain(self, text: str) -> str:
+        # poradie je zámerné – aby sa napr. "arp spoofing" neprilepilo k switch
+        if self._re_ospf.search(text):
+            return "ospf"
+        if self._re_bgp.search(text):
+            return "bgp"
+        if self._re_sec.search(text):
+            return "security"
+        if self._re_service.search(text):
+            return "service"
+        if self._re_switch.search(text):
+            return "switch"
+        return "unknown"
+
+    # --------------------------
+    # OSPF routing
+    # --------------------------
+    def _route_ospf(self, text: str) -> RouteDecision:
+        if self._re_ospf_exstart.search(text):
+            return RouteDecision("incident_ospf2", "ospf", "Matched EXSTART/EXCHANGE/MTU patterns.")
+        if self._re_ospf_auth.search(text) or self._re_ospf_timers.search(text):
+            return RouteDecision("incident_ospf3", "ospf", "Matched auth/timers/network-type mismatch patterns.")
+        if self._re_ospf_lsa.search(text):
+            return RouteDecision("incident_ospf4", "ospf", "Matched LSA/LSDB/redistribution patterns.")
+        # default OSPF adjacency loss/basic
+        return RouteDecision("incident_ospf1", "ospf", "Default OSPF adjacency/basic incident.")
+
+    # --------------------------
+    # BGP routing
+    # --------------------------
+    def _route_bgp(self, text: str) -> RouteDecision:
+        if self._re_bgp_session.search(text):
+            return RouteDecision("incident_bgp1", "bgp", "Matched session flap/hold timer/reset patterns.")
+        if self._re_bgp_policy.search(text):
+            return RouteDecision("incident_bgp2", "bgp", "Matched prefix-limit/route-leak/path selection patterns.")
+        if self._re_bgp_rib.search(text):
+            return RouteDecision("incident_bgp3", "bgp", "Matched RIB/next-hop/AFI-SAFI patterns.")
+        # fallback
+        return RouteDecision("incident_bgp1", "bgp", "Default BGP incident (session-level fallback).")
+
+    # --------------------------
+    # Switch routing
+    # --------------------------
+    def _route_switch(self, text: str) -> RouteDecision:
+        if self._re_sw_l2.search(text):
+            return RouteDecision("incident_switch1", "switch", "Matched MAC flap/STP change/err-disable patterns.")
+        if self._re_sw_trunk.search(text):
+            return RouteDecision("incident_switch2", "switch", "Matched VLAN/trunk/native VLAN mismatch patterns.")
+        if self._re_sw_misc.search(text):
+            return RouteDecision("incident_switch3", "switch", "Matched LLDP/CDP/storm-control patterns.")
+        return RouteDecision("incident_switch1", "switch", "Default switch incident (L2 fallback).")
+
+    # --------------------------
+    # Security routing
+    # --------------------------
+    def _route_security(self, text: str) -> RouteDecision:
+        if self._re_sec_acl.search(text):
+            return RouteDecision("incident_sec1", "security", "Matched ACL-related patterns.")
+        if self._re_sec_fw_nat_spoof.search(text):
+            return RouteDecision("incident_sec2", "security", "Matched FW/NAT/spoofing patterns.")
+        if self._re_sec_bruteforce.search(text):
+            return RouteDecision("incident_sec3", "security", "Matched SSH/SNMP brute force patterns.")
+        return RouteDecision("incident_sec1", "security", "Default security incident (ACL fallback).")
+
+    # --------------------------
+    # Service routing
+    # --------------------------
+    def _route_service(self, text: str) -> RouteDecision:
+        if self._re_svc_dhcp.search(text):
+            return RouteDecision("incident_service1", "service", "Matched DHCP/IP conflict/starvation patterns.")
+        if self._re_svc_dns_ntp_arp.search(text):
+            return RouteDecision("incident_service2", "service", "Matched DNS/NTP/ARP spoofing patterns.")
+        return RouteDecision("incident_service2", "service", "Default service incident fallback.")
+
+    # --------------------------
+    # Helpers
+    # --------------------------
+    @staticmethod
+    def _join_text(wazuh_alert: Dict[str, Any], evidence_text: Optional[str]) -> str:
+        parts = []
+        # vyber najdôležitejšie polia – robustné aj pri rozdielnych schemách
+        for k in ("rule", "event", "description", "severity", "device", "src_ip", "agent_name"):
+            v = wazuh_alert.get(k)
+            if v is not None:
+                parts.append(f"{k}: {v}")
+        # ak je alert celý už normalizovaný, prilep aj jeho raw json
+        parts.append(str(wazuh_alert))
+        if evidence_text:
+            parts.append(evidence_text)
+        return "\n".join(parts)

backend/app/pipeline/pipeline.py

@@ -0,0 +1,54 @@
+from app.llm.translator_llm import TranslatorLLM
+from app.net.restconf_client import RestconfClient
+
+
+class IncidentPipeline:
+    def __init__(self, inventory: dict):
+        """
+        inventory = {
+            "CORE-R1": {
+                "restconf_url": "...",
+                "username": "...",
+                "password": "..."
+            }
+        }
+        """
+        self.inventory = inventory
+        self.translator = TranslatorLLM()
+
+    def run(
+        self,
+        device: str,
+        show_cli: list[str],
+        fix_cli: list[str] | None = None
+    ) -> dict:
+        # ---- SHOW PHASE ----
+        show_rest = self.translator.translate(show_cli, mode="show")
+
+        client = self._get_client(device)
+        show_results = client.execute(show_rest)
+
+        # ---- INCIDENT LLM by tu reálne bežala ----
+        # fix_cli = incident_llm(wazuh_alert, show_results)
+
+        fix_results = None
+        if fix_cli:
+            fix_rest = self.translator.translate(fix_cli, mode="fix")
+            fix_results = client.execute(fix_rest)
+
+        return {
+            "device": device,
+            "show": show_results,
+            "fix": fix_results
+        }
+
+    def _get_client(self, device: str) -> RestconfClient:
+        if device not in self.inventory:
+            raise KeyError(f"Device '{device}' not found in inventory")
+
+        d = self.inventory[device]
+        return RestconfClient(
+            base_url=d["restconf_url"],
+            username=d["username"],
+            password=d["password"]
+        )

cases/bgp1_test_incidents/incident1_session_flap/CORE-R1/show_interface_gi0_1.txt

@@ -0,0 +1,12 @@
+GigabitEthernet0/1 is up, line protocol is up
+  Hardware is iGbE, address is 0c01.1111.0001 (bia 0c01.1111.0001)
+  Internet address is 203.0.113.1/30
+  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
+     reliability 255/255, txload 1/255, rxload 1/255
+  Encapsulation ARPA, loopback not set
+  Keepalive set (10 sec)
+  Full Duplex, 1000Mbps, media type is RJ45
+  5 minute input rate 12000 bits/sec, 15 packets/sec
+  5 minute output rate 11000 bits/sec, 14 packets/sec
+  5 minute input errors 0, CRC 0, frame 0, overrun 0, ignored 0
+  5 minute output errors 0, collisions 0, interface resets 6

cases/bgp1_test_incidents/incident1_session_flap/CORE-R1/show_ip_bgp_neighbors_192.0.2.2.txt

@@ -0,0 +1,9 @@
+BGP neighbor is 192.0.2.2,  remote AS 65002, external link
+  BGP version 4, remote router ID 2.2.2.2
+  BGP state = Established, up for 00:02:14
+  Last reset 00:00:31, due to Peer reset
+  External BGP neighbor may be up to 1 hops away.
+  Connection state is ESTAB, I/O status: 1, unread input bytes: 0
+  Keepalive interval is 10 seconds, hold time is 30 seconds
+  Received 1250 messages, 0 notifications, 0 in queue
+  Sent 1310 messages, 1 notifications, 0 in queue

cases/bgp1_test_incidents/incident1_session_flap/CORE-R1/show_ip_bgp_summary.txt

@@ -0,0 +1,8 @@
+BGP router identifier 1.1.1.1, local AS number 65001
+BGP table version is 112, main routing table version 112
+2 network entries using 288 bytes of memory
+2 path entries using 160 bytes of memory
+
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+192.0.2.2       4 65002    1250    1310      112    0    0 00:02:14        15
+198.51.100.2    4 65100     980     965      112    0    0 03:12:40        20

cases/bgp1_test_incidents/incident1_session_flap/CORE-R1/show_logging_include_bgp.txt

@@ -0,0 +1,6 @@
+Nov 21 12:07:11.123: %BGP-5-ADJCHANGE: neighbor 192.0.2.2 Down Peer reset
+Nov 21 12:07:18.447: %BGP-5-ADJCHANGE: neighbor 192.0.2.2 Up
+Nov 21 12:08:02.002: %BGP-5-ADJCHANGE: neighbor 192.0.2.2 Down Peer reset
+Nov 21 12:08:10.887: %BGP-5-ADJCHANGE: neighbor 192.0.2.2 Up
+Nov 21 12:09:44.551: %BGP-5-ADJCHANGE: neighbor 192.0.2.2 Down Peer reset
+Nov 21 12:09:52.331: %BGP-5-ADJCHANGE: neighbor 192.0.2.2 Up

cases/bgp1_test_incidents/incident1_session_flap/EDGE-R1/show_ip_bgp_neighbors.txt

@@ -0,0 +1,4 @@
+BGP neighbor is 192.0.2.2, remote AS 65002
+  BGP state = Idle
+  Last reset due to Hold Timer Expired
+  Connections dropped 17 times

cases/bgp1_test_incidents/incident1_session_flap/EDGE-R1/show_ip_bgp_summary.txt

@@ -0,0 +1,2 @@
+Neighbor        V    AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
+192.0.2.2       4 65002    1023    998      0    0    0 00:01:12 Idle

cases/bgp1_test_incidents/incident1_session_flap/EDGE-RTR1/show_ip_bgp_neighbors_203.0.113.1.txt

@@ -0,0 +1,5 @@
+BGP neighbor is 203.0.113.1,  remote AS 65001, external link
+  BGP version 4, remote router ID 1.1.1.1
+  BGP state = Established, up for 00:02:13
+  Last reset 00:00:39, due to Peer reset
+  Keepalive interval is 10 seconds, hold time is 30 seconds

cases/bgp1_test_incidents/incident1_session_flap/EDGE-RTR1/show_ip_bgp_summary.txt

@@ -0,0 +1,5 @@
+BGP router identifier 2.2.2.2, local AS number 65002
+BGP table version is 98, main routing table version 98
+
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+203.0.113.1     4 65001    1309    1249       98    0    0 00:02:13        15

cases/bgp1_test_incidents/incident1_session_flap/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "BGP session flap between CORE-R1 (AS65001) and EDGE-RTR1 (AS65002) over Gi0/1"
+}

cases/bgp1_test_incidents/incident1_session_flap/wazuh_alert.json

@@ -0,0 +1,8 @@
+{
+  "rule": "BGP session flap detected",
+  "device": "CORE-R1",
+  "severity": "high",
+  "description": "BGP neighbor 192.0.2.2 is flapping frequently (multiple resets in short time).",
+  "timestamp": "2025-11-21T12:10:00Z",
+  "neighbor": "192.0.2.2"
+}

cases/bgp1_test_incidents/incident2_hold_timer_expiration/BRANCH-RTR1/show_ip_bgp_neighbors_198.51.100.1.txt

@@ -0,0 +1,3 @@
+BGP neighbor is 198.51.100.1,  remote AS 65001, external link
+  BGP state = Established, up for 00:01:02
+  Keepalive interval is 60 seconds, hold time is 180 seconds

cases/bgp1_test_incidents/incident2_hold_timer_expiration/BRANCH-RTR1/show_ip_bgp_summary.txt

@@ -0,0 +1,3 @@
+BGP router identifier 3.3.3.3, local AS number 65010
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+198.51.100.1    4 65001     610     522       55    0    0 00:01:02        12

cases/bgp1_test_incidents/incident2_hold_timer_expiration/CORE-R1/show_interface_gi0_2.txt

@@ -0,0 +1,7 @@
+GigabitEthernet0/2 is up, line protocol is up
+  Internet address is 198.51.100.1/30
+  MTU 1500 bytes
+  5 minute input rate 2000 bits/sec, 3 packets/sec
+  5 minute output rate 1800 bits/sec, 2 packets/sec
+  input errors 0, CRC 0, frame 0, overrun 0, ignored 0
+  output errors 0, collisions 0, interface resets 0

cases/bgp1_test_incidents/incident2_hold_timer_expiration/CORE-R1/show_ip_bgp_neighbors_198.51.100.2.txt

@@ -0,0 +1,7 @@
+BGP neighbor is 198.51.100.2,  remote AS 65010, external link
+  BGP version 4, remote router ID 3.3.3.3
+  BGP state = Active
+  Last reset 00:00:12, due to Hold timer expired
+  Keepalive interval is 10 seconds, hold time is 30 seconds
+  Last read 00:00:31, Last write 00:00:08
+  Connections established 14; dropped 14

cases/bgp1_test_incidents/incident2_hold_timer_expiration/CORE-R1/show_ip_bgp_summary.txt

@@ -0,0 +1,3 @@
+BGP router identifier 1.1.1.1, local AS number 65001
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+198.51.100.2    4 65010     522     610      112    0    0 00:00:12 Active

cases/bgp1_test_incidents/incident2_hold_timer_expiration/CORE-R1/show_logging_include_bgp.txt

@@ -0,0 +1,4 @@
+Nov 21 12:19:40.900: %BGP-3-NOTIFICATION: sent to neighbor 198.51.100.2 4/0 (hold time expired) 0 bytes
+Nov 21 12:19:40.901: %BGP-5-ADJCHANGE: neighbor 198.51.100.2 Down Hold Timer Expired
+Nov 21 12:19:53.114: %BGP-5-ADJCHANGE: neighbor 198.51.100.2 Up
+Nov 21 12:19:59.227: %BGP-5-ADJCHANGE: neighbor 198.51.100.2 Down Hold Timer Expired

cases/bgp1_test_incidents/incident2_hold_timer_expiration/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "BGP resets due to hold timer expiration between CORE-R1 (AS65001) and BRANCH-RTR1 (AS65010)"
+}

cases/bgp1_test_incidents/incident2_hold_timer_expiration/wazuh_alert.json

@@ -0,0 +1,8 @@
+{
+  "rule": "BGP hold timer expiration",
+  "device": "CORE-R1",
+  "severity": "critical",
+  "description": "BGP neighbor 198.51.100.2 reset due to hold timer expiration.",
+  "timestamp": "2025-11-21T12:20:00Z",
+  "neighbor": "198.51.100.2"
+}

cases/bgp1_test_incidents/incident3_neighborship_reset/CORE-R1/show_ip_bgp_neighbors_192.0.2.2.txt

@@ -0,0 +1,3 @@
+BGP neighbor is 192.0.2.2,  remote AS 65002, external link
+  BGP state = Established, up for 00:10:24
+  Route refresh: advertised and received (old & new)

cases/bgp1_test_incidents/incident3_neighborship_reset/CORE-R1/show_ip_bgp_summary.txt

@@ -0,0 +1,3 @@
+BGP router identifier 1.1.1.1, local AS number 65001
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+192.0.2.2       4 65002    2190    2251      112    0    0 00:10:24        15

cases/bgp1_test_incidents/incident3_neighborship_reset/EDGE-RTR1/show_ip_bgp_neighbors_203.0.113.1.txt

@@ -0,0 +1,6 @@
+BGP neighbor is 203.0.113.1,  remote AS 65001, external link
+  BGP version 4, remote router ID 1.1.1.1
+  BGP state = Established, up for 00:10:22
+  Last reset 00:00:58, due to Cease/other configuration change
+  Route refresh: advertised and received (old & new)
+  Inbound soft reconfiguration allowed

cases/bgp1_test_incidents/incident3_neighborship_reset/EDGE-RTR1/show_ip_bgp_summary.txt

@@ -0,0 +1,3 @@
+BGP router identifier 2.2.2.2, local AS number 65002
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+203.0.113.1     4 65001    2250    2190       98    0    0 00:10:22        15

cases/bgp1_test_incidents/incident3_neighborship_reset/EDGE-RTR1/show_logging_include_bgp.txt

@@ -0,0 +1,3 @@
+Nov 21 12:28:59.010: %BGP-5-ADJCHANGE: neighbor 203.0.113.1 Down Cease/other configuration change
+Nov 21 12:29:03.552: %BGP-5-ADJCHANGE: neighbor 203.0.113.1 Up
+Nov 21 12:29:05.120: %BGP-5-ROUTECHANGE: neighbor 203.0.113.1 soft reset (inbound)

cases/bgp1_test_incidents/incident3_neighborship_reset/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "BGP neighborship reset after policy change; prefer soft clear to refresh routes"
+}

cases/bgp1_test_incidents/incident3_neighborship_reset/wazuh_alert.json

@@ -0,0 +1,8 @@
+{
+  "rule": "BGP neighborship reset detected",
+  "device": "EDGE-RTR1",
+  "severity": "medium",
+  "description": "BGP session reset/cleared detected for neighbor 203.0.113.1 (policy change).",
+  "timestamp": "2025-11-21T12:30:00Z",
+  "neighbor": "203.0.113.1"
+}

cases/bgp2_test_incidents/incident1_prefix_limit_exceeded/CORE-R1/show_ip_bgp_neighbors_192.0.2.2.txt

@@ -0,0 +1,10 @@
+BGP neighbor is 192.0.2.2,  remote AS 65002, external link
+  BGP version 4, remote router ID 2.2.2.2
+  BGP state = Idle (Admin), down for 00:00:18
+  Last reset 00:00:18, due to Cease/Maximum Number of Prefixes Reached
+  Last notification: Cease/Maximum Number of Prefixes Reached
+  Graceful Restart is enabled
+  Route refresh: advertised and received (new)
+  Keepalive interval is 30 seconds, hold time is 180 seconds
+  Maximum prefixes allowed 1000 (threshold 80%), warning-only is disabled
+  Prefixes received 1254, accepted 1254

cases/bgp2_test_incidents/incident1_prefix_limit_exceeded/CORE-R1/show_ip_bgp_summary.txt

@@ -0,0 +1,8 @@
+BGP router identifier 1.1.1.1, local AS number 65001
+BGP table version is 812, main routing table version 812
+2005 network entries using 288720 bytes of memory
+4100 path entries using 328000 bytes of memory
+
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+192.0.2.2       4 65002   98231   98190      812    0    0 00:00:18 Idle (Admin)
+198.51.100.2    4 65100   22110   22005      812    0    0 06:22:10        420

cases/bgp2_test_incidents/incident1_prefix_limit_exceeded/CORE-R1/show_logging_include_bgp.txt

@@ -0,0 +1,3 @@
+Nov 22 09:09:41.120: %BGP-3-NOTIFICATION: sent to neighbor 192.0.2.2 6/1 (Maximum Number of Prefixes Reached) 0 bytes
+Nov 22 09:09:41.121: %BGP-5-ADJCHANGE: neighbor 192.0.2.2 Down Cease/Maximum Number of Prefixes Reached
+Nov 22 09:09:42.005: %BGP-5-ADJCHANGE: neighbor 192.0.2.2 Down (Admin)

cases/bgp2_test_incidents/incident1_prefix_limit_exceeded/EDGE-RTR1/show_ip_bgp_summary.txt

@@ -0,0 +1,3 @@
+BGP router identifier 2.2.2.2, local AS number 65002
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+203.0.113.1     4 65001   98190   98231      511    0    0 00:00:20        980

cases/bgp2_test_incidents/incident1_prefix_limit_exceeded/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "Prefix limit exceeded on CORE-R1 from neighbor 192.0.2.2 (transit). Session torn down by max-prefix protection."
+}

cases/bgp2_test_incidents/incident1_prefix_limit_exceeded/wazuh_alert.json

@@ -0,0 +1,8 @@
+{
+  "rule": "BGP maximum-prefix limit exceeded",
+  "device": "CORE-R1",
+  "severity": "critical",
+  "description": "Neighbor 192.0.2.2 exceeded maximum-prefix limit; session reset to protect routing table.",
+  "timestamp": "2025-11-22T09:10:00Z",
+  "neighbor": "192.0.2.2"
+}

cases/bgp2_test_incidents/incident2_route_leak_suspected/BRANCH-RTR1/show_run_bgp_snippet.txt

@@ -0,0 +1,4 @@
+router bgp 65010
+ neighbor 198.51.100.1 remote-as 65001
+ ! WARNING: missing outbound route-map to restrict advertisements
+ ! no prefix-list / route-map applied

cases/bgp2_test_incidents/incident2_route_leak_suspected/CORE-R1/show_ip_bgp_community_no_export.txt

@@ -0,0 +1,3 @@
+CORE-R1#show ip bgp community no-export
+% Network not in table
+% No entries were displayed.

cases/bgp2_test_incidents/incident2_route_leak_suspected/CORE-R1/show_ip_bgp_neighbors_198.51.100.2.txt

@@ -0,0 +1,10 @@
+BGP neighbor is 198.51.100.2,  remote AS 65010, external link
+  BGP version 4, remote router ID 3.3.3.3
+  BGP state = Established, up for 01:12:44
+  Route refresh: advertised and received (new)
+  Keepalive interval is 30 seconds, hold time is 180 seconds
+  Inbound prefix policy: NONE
+  Outbound prefix policy: NONE
+  Community policy: send-community both
+  Prefixes received 18420, accepted 18400
+  Neighbor capabilities: route-refresh, 4-byte AS

cases/bgp2_test_incidents/incident2_route_leak_suspected/CORE-R1/show_ip_bgp_summary.txt

@@ -0,0 +1,4 @@
+BGP router identifier 1.1.1.1, local AS number 65001
+Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
+198.51.100.2    4 65010   55210   55001      812    0    0 01:12:44      18400
+192.0.2.2       4 65002   98231   98190      812    0    0 06:40:10       980

cases/bgp2_test_incidents/incident2_route_leak_suspected/CORE-R1/show_logging_include_bgp.txt

@@ -0,0 +1,3 @@
+Nov 22 09:20:05.331: %BGP-5-ADJCHANGE: neighbor 198.51.100.2 Up
+Nov 22 09:22:10.110: %BGP-4-MAXPREFIX: No max-prefix configured for neighbor 198.51.100.2; received-prefixes=18420
+Nov 22 09:22:12.771: %BGP-4-ROUTELEAK: Possible route leak detected from 198.51.100.2 (prefix-count anomaly)

cases/bgp2_test_incidents/incident2_route_leak_suspected/incident_info.json

@@ -0,0 +1,3 @@
+{
+  "description": "Route leak suspected: customer BRANCH-RTR1 is advertising full internet table to CORE-R1 (missing no-export / wrong policy)."
+}

cases/bgp2_test_incidents/incident2_route_leak_suspected/wazuh_alert.json

@@ -0,0 +1,8 @@
+{
+  "rule": "BGP route leak suspected",
+  "device": "CORE-R1",
+  "severity": "high",
+  "description": "Unusual spike of prefixes from neighbor 198.51.100.2; possible customer route leak.",
+  "timestamp": "2025-11-22T09:25:00Z",
+  "neighbor": "198.51.100.2"
+}

cases/bgp2_test_incidents/incident3_path_selection_incorrect/CORE-R1/show_ip_bgp_203.0.113.0_24.txt

@@ -0,0 +1,14 @@
+BGP routing table entry for 203.0.113.0/24, version 999
+Paths: (2 available, best #1, table default)
+  Advertised to update-groups:
+     1
+  65100
+    198.51.100.2 from 198.51.100.2 (4.4.4.4)
+      Origin IGP, metric 0, localpref 200, valid, external, best
+      Community: 65100:50
+      rx pathid: 0, tx pathid: 0
+  65002
+    192.0.2.2 from 192.0.2.2 (2.2.2.2)
+      Origin IGP, metric 0, localpref 100, valid, external
+      Community: 65002:100
+      rx pathid: 0, tx pathid: 0

cases/bgp2_test_incidents/incident3_path_selection_incorrect/CORE-R1/show_ip_bgp_bestpath.txt

@@ -0,0 +1,4 @@
+CORE-R1#show ip bgp bestpath
+BGP Bestpath Algorithm is enabled
+Paths are selected based on:
+  Weight, Local Preference, Locally originated, AS path, Origin, MED, eBGP/iBGP, IGP metric, Router ID

cases/bgp2_test_incidents/incident3_path_selection_incorrect/CORE-R1/show_ip_bgp_neighbors_192.0.2.2_policy.txt

@@ -0,0 +1,4 @@
+BGP neighbor is 192.0.2.2,  remote AS 65002, external link
+  Inbound route-map: NONE
+  Outbound route-map: NONE
+  Route refresh: advertised and received (new)