Hugging Face's logo

JoeiBanana
/
ai-network-llms

Text Generation
PEFT
Safetensors
GGUF
English
lora
cisco
networking
security
wazuh
incident-response
network-automation
restconf
ospf
bgp
conversational
Model card Files
xet
 Community
JoeiBanana commited on
Commit
374a013
·
verified ·
1 Parent(s): 8c3627f

Upload batch 4/8

Browse files
Files changed (50) hide show
  1. cases/sec1_test_incidents/incident3_excessive_denies/BRANCH-RTR1/show_access_lists.txt +3 -0
  2. cases/sec1_test_incidents/incident3_excessive_denies/wazuh_alert.json +9 -0
  3. cases/sec2_test_incidents/incident1_firewall_conn_exhaust/EDGE-FW1/show_conn_table.txt +3 -0
  4. cases/sec2_test_incidents/incident1_firewall_conn_exhaust/wazuh_alert.json +7 -0
  5. cases/sec2_test_incidents/incident2_nat_translation_failure/EDGE-FW1/show_ip_nat_statistics.txt +4 -0
  6. cases/sec2_test_incidents/incident2_nat_translation_failure/wazuh_alert.json +7 -0
  7. cases/sec2_test_incidents/incident3_ip_spoofing/CORE-R1/show_interface_counters.txt +3 -0
  8. cases/sec2_test_incidents/incident3_ip_spoofing/wazuh_alert.json +7 -0
  9. cases/sec3_test_incidents/incident1_ssh_bruteforce/CORE-R1/show_logging.txt +2 -0
  10. cases/sec3_test_incidents/incident1_ssh_bruteforce/wazuh_alert.json +7 -0
  11. cases/sec3_test_incidents/incident2_failed_logins/BRANCH-RTR1/show_logging.txt +3 -0
  12. cases/sec3_test_incidents/incident2_failed_logins/wazuh_alert.json +6 -0
  13. cases/sec3_test_incidents/incident3_snmp_bruteforce/EDGE-FW1/show_snmp_stats.txt +3 -0
  14. cases/sec3_test_incidents/incident3_snmp_bruteforce/wazuh_alert.json +7 -0
  15. cases/service1_test_incidents/incident1_dhcp_conflict/CORE-R1/show_ip_dhcp_conflict.txt +2 -0
  16. cases/service1_test_incidents/incident1_dhcp_conflict/wazuh_alert.json +8 -0
  17. cases/service1_test_incidents/incident2_dhcp_starvation/EDGE-FW1/show_ip_dhcp_pool.txt +4 -0
  18. cases/service1_test_incidents/incident2_dhcp_starvation/wazuh_alert.json +8 -0
  19. cases/service1_test_incidents/incident3_ip_conflict/BRANCH-RTR1/show_arp.txt +3 -0
  20. cases/service1_test_incidents/incident3_ip_conflict/wazuh_alert.json +8 -0
  21. cases/service2_test_incidents/incident1_dns_issues/CORE-R1/show_dns.txt +2 -0
  22. cases/service2_test_incidents/incident1_dns_issues/wazuh_alert.json +6 -0
  23. cases/service2_test_incidents/incident2_ntp_unsync/BRANCH-RTR1/show_ntp_status.txt +1 -0
  24. cases/service2_test_incidents/incident2_ntp_unsync/wazuh_alert.json +6 -0
  25. cases/service2_test_incidents/incident3_arp_spoofing/EDGE-FW1/show_arp.txt +2 -0
  26. cases/service2_test_incidents/incident3_arp_spoofing/wazuh_alert.json +7 -0
  27. cases/switch1_test_incidents/incident1_mac_flapping/ACCESS-SW1/int_gi0_3.txt +1 -0
  28. cases/switch1_test_incidents/incident1_mac_flapping/ACCESS-SW1/int_gi0_7.txt +1 -0
  29. cases/switch1_test_incidents/incident1_mac_flapping/ACCESS-SW1/log_mac_flap.txt +1 -0
  30. cases/switch1_test_incidents/incident1_mac_flapping/wazuh_alert.json +7 -0
  31. cases/switch1_test_incidents/incident2_stp_topology_change/DIST-SW1/int_gi0_12.txt +2 -0
  32. cases/switch1_test_incidents/incident2_stp_topology_change/DIST-SW1/show_spanning_tree_vlan30.txt +1 -0
  33. cases/switch1_test_incidents/incident2_stp_topology_change/wazuh_alert.json +7 -0
  34. cases/switch1_test_incidents/incident3_port_errdisable/ACCESS-SW2/errdisable_reason.txt +1 -0
  35. cases/switch1_test_incidents/incident3_port_errdisable/ACCESS-SW2/show_int_status.txt +1 -0
  36. cases/switch1_test_incidents/incident3_port_errdisable/wazuh_alert.json +7 -0
  37. cases/switch2_test_incidents/incident1_vlan_mismatch/ACCESS-SW1/show_int_switchport.txt +3 -0
  38. cases/switch2_test_incidents/incident1_vlan_mismatch/DIST-SW1/show_int_switchport.txt +3 -0
  39. cases/switch2_test_incidents/incident1_vlan_mismatch/wazuh_alert.json +6 -0
  40. cases/switch2_test_incidents/incident2_trunk_negotiation/ACCESS-SW2/show_int_switchport.txt +3 -0
  41. cases/switch2_test_incidents/incident2_trunk_negotiation/DIST-SW1/show_int_switchport.txt +3 -0
  42. cases/switch2_test_incidents/incident2_trunk_negotiation/wazuh_alert.json +6 -0
  43. cases/switch2_test_incidents/incident3_native_vlan_mismatch/ACCESS-SW2/show_int_trunk.txt +2 -0
  44. cases/switch2_test_incidents/incident3_native_vlan_mismatch/DIST-SW1/show_int_trunk.txt +2 -0
  45. cases/switch2_test_incidents/incident3_native_vlan_mismatch/wazuh_alert.json +6 -0
  46. cases/switch3_test_incidents/incident1_lldp_cdp_inconsistency/ACCESS-SW1/show_cdp_neighbors.txt +3 -0
  47. cases/switch3_test_incidents/incident1_lldp_cdp_inconsistency/ACCESS-SW1/show_lldp_neighbors.txt +1 -0
  48. cases/switch3_test_incidents/incident1_lldp_cdp_inconsistency/wazuh_alert.json +6 -0
  49. cases/switch3_test_incidents/incident2_storm_control/ACCESS-SW2/show_interface_counters.txt +3 -0
  50. cases/switch3_test_incidents/incident2_storm_control/ACCESS-SW2/show_run_interface.txt +2 -0
cases/sec1_test_incidents/incident3_excessive_denies/BRANCH-RTR1/show_access_lists.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Extended IP access list 150
2
+ 10 deny ip 192.168.1.0 0.0.0.255 any (5000 matches)
3
+ 20 permit ip any any
cases/sec1_test_incidents/incident3_excessive_denies/wazuh_alert.json ADDED
@@ -0,0 +1,9 @@
 
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "Excessive ACL deny entries",
3
+ "device": "BRANCH-RTR1",
4
+ "severity": "medium",
5
+ "acl": 150,
6
+ "interface": "GigabitEthernet0/1",
7
+ "direction": "in",
8
+ "description": "High volume of ACL deny logs causing CPU impact."
9
+ }
cases/sec2_test_incidents/incident1_firewall_conn_exhaust/EDGE-FW1/show_conn_table.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Current connections: 187432
2
+ Max connections: 200000
3
+ Half-open TCP connections: 15234
cases/sec2_test_incidents/incident1_firewall_conn_exhaust/wazuh_alert.json ADDED
@@ -0,0 +1,7 @@
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "Firewall connection table exhaustion",
3
+ "device": "EDGE-FW1",
4
+ "severity": "critical",
5
+ "interface": "GigabitEthernet0/0",
6
+ "description": "High number of concurrent sessions exhausting firewall resources."
7
+ }
cases/sec2_test_incidents/incident2_nat_translation_failure/EDGE-FW1/show_ip_nat_statistics.txt ADDED
@@ -0,0 +1,4 @@
 
 
 
 
 
1
+ Total translations: 65535
2
+ Static translations: 5
3
+ Dynamic translations: 65530
4
+ Pool PUBLIC_POOL: 100% used
cases/sec2_test_incidents/incident2_nat_translation_failure/wazuh_alert.json ADDED
@@ -0,0 +1,7 @@
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "NAT translation failure",
3
+ "device": "EDGE-FW1",
4
+ "severity": "high",
5
+ "public_ip": "203.0.113.10",
6
+ "description": "NAT translation table full or pool exhausted."
7
+ }
cases/sec2_test_incidents/incident3_ip_spoofing/CORE-R1/show_interface_counters.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Interface Gi0/1
2
+ Input packets with source 10.10.10.5 detected
3
+ Packets dropped by uRPF: 523
cases/sec2_test_incidents/incident3_ip_spoofing/wazuh_alert.json ADDED
@@ -0,0 +1,7 @@
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "IP spoofing suspected",
3
+ "device": "CORE-R1",
4
+ "severity": "high",
5
+ "interface": "GigabitEthernet0/1",
6
+ "description": "Private source IPs detected on public-facing interface."
7
+ }
cases/sec3_test_incidents/incident1_ssh_bruteforce/CORE-R1/show_logging.txt ADDED
@@ -0,0 +1,2 @@
 
 
 
1
+ %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: 203.0.113.45] [localport: 22]
2
+ (repeated 200 times)
cases/sec3_test_incidents/incident1_ssh_bruteforce/wazuh_alert.json ADDED
@@ -0,0 +1,7 @@
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "SSH brute force detected",
3
+ "device": "CORE-R1",
4
+ "severity": "high",
5
+ "source_ip": "203.0.113.45",
6
+ "description": "More than 200 failed SSH login attempts detected."
7
+ }
cases/sec3_test_incidents/incident2_failed_logins/BRANCH-RTR1/show_logging.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: guest]
2
+ %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: root]
3
+ %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: netops]
cases/sec3_test_incidents/incident2_failed_logins/wazuh_alert.json ADDED
@@ -0,0 +1,6 @@
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "Excessive failed login attempts",
3
+ "device": "BRANCH-RTR1",
4
+ "severity": "medium",
5
+ "description": "Repeated authentication failures detected."
6
+ }
cases/sec3_test_incidents/incident3_snmp_bruteforce/EDGE-FW1/show_snmp_stats.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ SNMP packets input 50000
2
+ Unknown community name detected from 198.51.100.77
3
+ Authentication failures 1200
cases/sec3_test_incidents/incident3_snmp_bruteforce/wazuh_alert.json ADDED
@@ -0,0 +1,7 @@
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "SNMP brute force detected",
3
+ "device": "EDGE-FW1",
4
+ "severity": "high",
5
+ "source_ip": "198.51.100.77",
6
+ "description": "Multiple SNMP authentication failures detected."
7
+ }
cases/service1_test_incidents/incident1_dhcp_conflict/CORE-R1/show_ip_dhcp_conflict.txt ADDED
@@ -0,0 +1,2 @@
 
 
 
1
+ IP address Client-ID Interface
2
+ 10.0.10.55 0100.11.2233.4455 Vlan10
cases/service1_test_incidents/incident1_dhcp_conflict/wazuh_alert.json ADDED
@@ -0,0 +1,8 @@
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "DHCP conflict detected",
3
+ "device": "CORE-R1",
4
+ "severity": "high",
5
+ "ip": "10.0.10.55",
6
+ "vlan": 10,
7
+ "description": "Duplicate IP address detected; DHCP client cannot obtain lease."
8
+ }
cases/service1_test_incidents/incident2_dhcp_starvation/EDGE-FW1/show_ip_dhcp_pool.txt ADDED
@@ -0,0 +1,4 @@
 
 
 
 
 
1
+ Pool VLAN20_POOL :
2
+ Utilization mark (high/low) : 100 / 0
3
+ Subnet size (first/next) : 0 / 0
4
+ Leased addresses : 254
cases/service1_test_incidents/incident2_dhcp_starvation/wazuh_alert.json ADDED
@@ -0,0 +1,8 @@
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "DHCP starvation suspected",
3
+ "device": "EDGE-FW1",
4
+ "severity": "critical",
5
+ "source_ip": "203.0.113.45",
6
+ "vlan": 20,
7
+ "description": "DHCP pool utilization near 100%, excessive DISCOVER messages."
8
+ }
cases/service1_test_incidents/incident3_ip_conflict/BRANCH-RTR1/show_arp.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Protocol Address Age (min) Hardware Addr Type Interface
2
+ Internet 192.168.10.12 2 aabb.ccdd.eeff ARPA Vlan30
3
+ Internet 192.168.10.12 0 00ff.eedd.ccbb ARPA Vlan30
cases/service1_test_incidents/incident3_ip_conflict/wazuh_alert.json ADDED
@@ -0,0 +1,8 @@
 
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "IP conflict suspected",
3
+ "device": "BRANCH-RTR1",
4
+ "severity": "medium",
5
+ "ip": "192.168.10.12",
6
+ "vlan": 30,
7
+ "description": "Duplicate IP detected via ARP instability."
8
+ }
cases/service2_test_incidents/incident1_dns_issues/CORE-R1/show_dns.txt ADDED
@@ -0,0 +1,2 @@
 
 
 
1
+ %DNS-3-TIMEOUT: DNS request timed out
2
+ %DNS-3-NXDOMAIN: Domain safe.local not found
cases/service2_test_incidents/incident1_dns_issues/wazuh_alert.json ADDED
@@ -0,0 +1,6 @@
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "DNS resolution issues detected",
3
+ "device": "CORE-R1",
4
+ "severity": "high",
5
+ "description": "DNS timeouts and NXDOMAIN responses observed."
6
+ }
cases/service2_test_incidents/incident2_ntp_unsync/BRANCH-RTR1/show_ntp_status.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ Clock is unsynchronized, stratum 16, no reference clock
cases/service2_test_incidents/incident2_ntp_unsync/wazuh_alert.json ADDED
@@ -0,0 +1,6 @@
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "NTP unsynchronized",
3
+ "device": "BRANCH-RTR1",
4
+ "severity": "medium",
5
+ "description": "NTP stratum 16, clock not synchronized."
6
+ }
cases/service2_test_incidents/incident3_arp_spoofing/EDGE-FW1/show_arp.txt ADDED
@@ -0,0 +1,2 @@
 
 
 
1
+ Internet 10.0.30.1 0 aabb.ccdd.eeff ARPA Vlan30
2
+ Internet 10.0.30.1 2 00ff.eedd.ccbb ARPA Vlan30
cases/service2_test_incidents/incident3_arp_spoofing/wazuh_alert.json ADDED
@@ -0,0 +1,7 @@
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "ARP spoofing suspected",
3
+ "device": "EDGE-FW1",
4
+ "severity": "critical",
5
+ "vlan": 30,
6
+ "description": "Duplicate ARP replies detected."
7
+ }
cases/switch1_test_incidents/incident1_mac_flapping/ACCESS-SW1/int_gi0_3.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ GigabitEthernet0/3 is up, line protocol is up
cases/switch1_test_incidents/incident1_mac_flapping/ACCESS-SW1/int_gi0_7.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ GigabitEthernet0/7 is up, line protocol is up
cases/switch1_test_incidents/incident1_mac_flapping/ACCESS-SW1/log_mac_flap.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ %SW_MATM-4-MACFLAP_NOTIF: Host 00aa.bbcc.ddee in vlan 20 is flapping between port Gi0/3 and port Gi0/7
cases/switch1_test_incidents/incident1_mac_flapping/wazuh_alert.json ADDED
@@ -0,0 +1,7 @@
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "MAC address flapping detected",
3
+ "device": "ACCESS-SW1",
4
+ "severity": "high",
5
+ "description": "MAC 00aa.bbcc.ddee is flapping between two interfaces.",
6
+ "vlan": 20
7
+ }
cases/switch1_test_incidents/incident2_stp_topology_change/DIST-SW1/int_gi0_12.txt ADDED
@@ -0,0 +1,2 @@
 
 
 
1
+ GigabitEthernet0/12 is up, line protocol is up
2
+ Portfast is disabled
cases/switch1_test_incidents/incident2_stp_topology_change/DIST-SW1/show_spanning_tree_vlan30.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ Number of topology changes 45 last change occurred 00:01:20 ago
cases/switch1_test_incidents/incident2_stp_topology_change/wazuh_alert.json ADDED
@@ -0,0 +1,7 @@
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "STP topology change detected",
3
+ "device": "DIST-SW1",
4
+ "severity": "medium",
5
+ "description": "Multiple STP topology changes detected on access port.",
6
+ "vlan": 30
7
+ }
cases/switch1_test_incidents/incident3_port_errdisable/ACCESS-SW2/errdisable_reason.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ Port Gi0/18 disabled due to bpduguard violation
cases/switch1_test_incidents/incident3_port_errdisable/ACCESS-SW2/show_int_status.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ Gi0/18 err-disabled a-full a-100
cases/switch1_test_incidents/incident3_port_errdisable/wazuh_alert.json ADDED
@@ -0,0 +1,7 @@
 
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "Switch port entered err-disable state",
3
+ "device": "ACCESS-SW2",
4
+ "severity": "critical",
5
+ "description": "Port Gi0/18 err-disabled due to BPDU Guard.",
6
+ "interface": "GigabitEthernet0/18"
7
+ }
cases/switch2_test_incidents/incident1_vlan_mismatch/ACCESS-SW1/show_int_switchport.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Name: Gi0/5
2
+ Administrative Mode: static access
3
+ Access Mode VLAN: 10
cases/switch2_test_incidents/incident1_vlan_mismatch/DIST-SW1/show_int_switchport.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Name: Gi0/1
2
+ Administrative Mode: static access
3
+ Access Mode VLAN: 20
cases/switch2_test_incidents/incident1_vlan_mismatch/wazuh_alert.json ADDED
@@ -0,0 +1,6 @@
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "VLAN mismatch detected",
3
+ "device": "ACCESS-SW1",
4
+ "severity": "high",
5
+ "interface": "GigabitEthernet0/5"
6
+ }
cases/switch2_test_incidents/incident2_trunk_negotiation/ACCESS-SW2/show_int_switchport.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Name: Gi0/24
2
+ Administrative Mode: dynamic auto
3
+ Operational Mode: static access
cases/switch2_test_incidents/incident2_trunk_negotiation/DIST-SW1/show_int_switchport.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Name: Gi0/12
2
+ Administrative Mode: dynamic desirable
3
+ Operational Mode: trunk
cases/switch2_test_incidents/incident2_trunk_negotiation/wazuh_alert.json ADDED
@@ -0,0 +1,6 @@
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "Trunk negotiation failure",
3
+ "device": "ACCESS-SW2",
4
+ "severity": "medium",
5
+ "interface": "GigabitEthernet0/24"
6
+ }
cases/switch2_test_incidents/incident3_native_vlan_mismatch/ACCESS-SW2/show_int_trunk.txt ADDED
@@ -0,0 +1,2 @@
 
 
 
1
+ Port Mode Encapsulation Status Native vlan
2
+ Gi0/24 on 802.1q trunking 1
cases/switch2_test_incidents/incident3_native_vlan_mismatch/DIST-SW1/show_int_trunk.txt ADDED
@@ -0,0 +1,2 @@
 
 
 
1
+ Port Mode Encapsulation Status Native vlan
2
+ Gi0/12 on 802.1q trunking 99
cases/switch2_test_incidents/incident3_native_vlan_mismatch/wazuh_alert.json ADDED
@@ -0,0 +1,6 @@
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "Native VLAN mismatch detected",
3
+ "device": "DIST-SW1",
4
+ "severity": "high",
5
+ "interface": "GigabitEthernet0/12"
6
+ }
cases/switch3_test_incidents/incident1_lldp_cdp_inconsistency/ACCESS-SW1/show_cdp_neighbors.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Capability Codes: R - Router, S - Switch
2
+ Device ID Local Intrfce Holdtme Capability Platform Port ID
3
+ CORE-R1 Gi0/10 153 R S ISR4451 Gi0/1
cases/switch3_test_incidents/incident1_lldp_cdp_inconsistency/ACCESS-SW1/show_lldp_neighbors.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ % LLDP is not enabled
cases/switch3_test_incidents/incident1_lldp_cdp_inconsistency/wazuh_alert.json ADDED
@@ -0,0 +1,6 @@
 
 
 
 
 
 
 
1
+ {
2
+ "rule": "LLDP/CDP inconsistency detected",
3
+ "device": "ACCESS-SW1",
4
+ "severity": "medium",
5
+ "interface": "GigabitEthernet0/10"
6
+ }
cases/switch3_test_incidents/incident2_storm_control/ACCESS-SW2/show_interface_counters.txt ADDED
@@ -0,0 +1,3 @@
 
 
 
 
1
+ Port Gi0/15
2
+ Broadcast packets input rate 35000 pps
3
+ Storm-control: broadcast level 1.00 exceeded
cases/switch3_test_incidents/incident2_storm_control/ACCESS-SW2/show_run_interface.txt ADDED
@@ -0,0 +1,2 @@
 
 
 
1
+ interface GigabitEthernet0/15
2
+ storm-control broadcast level 1.00