Upload batch 5/8

cases/switch3_test_incidents/incident2_storm_control/wazuh_alert.json

@@ -0,0 +1,7 @@
+{
+  "rule": "Storm control threshold exceeded",
+  "device": "ACCESS-SW2",
+  "severity": "high",
+  "interface": "GigabitEthernet0/15",
+  "vlan": 20
+}

cases/switch3_test_incidents/incident3_broadcast_storm/DIST-SW1/show_interface_counters.txt

@@ -0,0 +1,3 @@
+Port Gi0/2
+  Broadcast packets input rate 95000 pps
+  Multicast packets input rate 12000 pps

cases/switch3_test_incidents/incident3_broadcast_storm/DIST-SW1/show_run_interface.txt

@@ -0,0 +1,2 @@
+interface GigabitEthernet0/2
+ no storm-control broadcast

cases/switch3_test_incidents/incident3_broadcast_storm/wazuh_alert.json

@@ -0,0 +1,7 @@
+{
+  "rule": "Broadcast storm detected",
+  "device": "DIST-SW1",
+  "severity": "critical",
+  "interface": "GigabitEthernet0/2",
+  "vlan": 99
+}

cases/sys1_test_incidents/incident1_high_cpu/CORE-R1/show_control_plane.txt

@@ -0,0 +1,6 @@
+CORE-R1#show control-plane host open-ports
+Active open ports:
+  tcp 22   (ssh)
+  tcp 80   (http)
+  tcp 443  (https)
+  udp 161  (snmp)

cases/sys1_test_incidents/incident1_high_cpu/CORE-R1/show_processes_cpu.txt

@@ -0,0 +1,6 @@
+CORE-R1#show processes cpu sorted 5sec
+CPU utilization for five seconds: 98%/73%; one minute: 92%; five minutes: 88%
+PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process
+ 78   18234921   9223322       1975  71.21  60.11  55.10   0 IP Input
+ 59    2034921   1203322       1688  10.15   9.12   8.44   0 ARP Input
+ 12     923421    323322       2850   5.20   4.44   3.88   0 SNMP ENGINE

cases/sys1_test_incidents/incident1_high_cpu/CORE-R1/show_run_excerpt.txt

@@ -0,0 +1,7 @@
+CORE-R1#show running-config | include ip http|snmp-server|logging console|service tcp-small|service udp-small
+ip http server
+ip http secure-server
+snmp-server community public RO
+logging console debugging
+service tcp-small-servers
+service udp-small-servers

cases/sys1_test_incidents/incident1_high_cpu/wazuh_alert.json

@@ -0,0 +1,12 @@
+{
+  "rule": "High CPU utilization detected",
+  "device": "CORE-R1",
+  "severity": "critical",
+  "cpu_5s_percent": 98,
+  "cpu_1m_percent": 92,
+  "cpu_5m_percent": 88,
+  "top_process": "IP Input",
+  "source": "wazuh-agent",
+  "timestamp": "2026-02-06T21:14:20.054158Z",
+  "description": "CPU utilization exceeded threshold. Top consumer: IP Input."
+}

cases/sys1_test_incidents/incident2_high_memory/DIST-SW1/show_memory.txt

@@ -0,0 +1,6 @@
+DIST-SW1#show processes memory sorted
+Processor Pool Total: 4096000000 Used: 3810000000 Free: 286000000
+      I/O Pool Total: 200000000 Used: 120000000 Free: 80000000
+ PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs  Process
+  88   0  1200000000  1100000000  280000000   1200000     800000  HTTP Server
+  12   0   900000000   850000000  220000000    600000     450000  SNMP ENGINE

cases/sys1_test_incidents/incident2_high_memory/DIST-SW1/show_run_excerpt.txt

@@ -0,0 +1,5 @@
+DIST-SW1#show running-config | include ip http|logging buffered|logging console|logging persistent
+ip http server
+ip http secure-server
+logging console informational
+logging buffered 131072 debugging

cases/sys1_test_incidents/incident2_high_memory/DIST-SW1/show_version.txt

@@ -0,0 +1,3 @@
+DIST-SW1#show version | include IOS XE|uptime
+Cisco IOS XE Software, Version 17.09.03
+DIST-SW1 uptime is 4 weeks, 1 day, 2 hours, 10 minutes

cases/sys1_test_incidents/incident2_high_memory/wazuh_alert.json

@@ -0,0 +1,12 @@
+{
+  "rule": "High memory utilization detected",
+  "device": "DIST-SW1",
+  "severity": "high",
+  "memory_used_percent": 93,
+  "memory_free_mb": 120,
+  "memory_total_mb": 4096,
+  "top_consumer": "http",
+  "source": "wazuh-agent",
+  "timestamp": "2026-02-06T21:14:20.054158Z",
+  "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."
+}

cases/sys1_test_incidents/incident3_process_crash/EDGE-RTR1/show_crashinfo.txt

@@ -0,0 +1,2 @@
+EDGE-RTR1#dir bootflash: | include crashinfo
+-rw-  23456  Feb  6 2026 10:12:02  crashinfo_20260206-1012.txt

cases/sys1_test_incidents/incident3_process_crash/EDGE-RTR1/show_logging.txt

@@ -0,0 +1,5 @@
+EDGE-RTR1#show logging | last 20
+*Feb  6 10:11:01.112: %BGP-3-NOTIFICATION: received from neighbor 203.0.113.2 4/0 (hold time expired) 0 bytes
+*Feb  6 10:11:05.441: %SYS-3-CPUHOG: Task ran for 2140 msec (BGP Scanner)
+*Feb  6 10:11:10.003: %SYS-2-WATCHDOG: Process BGP Scanner timed out - process restarted
+*Feb  6 10:11:10.010: %SYS-5-RESTART: System restarted BGP process (pid=1240)

cases/sys1_test_incidents/incident3_process_crash/EDGE-RTR1/show_run_excerpt.txt

@@ -0,0 +1,3 @@
+EDGE-RTR1#show running-config | include exception crashinfo|archive|redundancy|logging trap|logging host
+logging trap warnings
+logging host 10.0.0.10

cases/sys1_test_incidents/incident3_process_crash/wazuh_alert.json

@@ -0,0 +1,12 @@
+{
+  "rule": "Process crash / restart detected",
+  "device": "EDGE-RTR1",
+  "severity": "high",
+  "process": "bgp",
+  "pid": 1240,
+  "crash_count_24h": 7,
+  "last_crash_reason": "Watchdog timeout",
+  "source": "wazuh-agent",
+  "timestamp": "2026-02-06T21:14:20.054158Z",
+  "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."
+}

cases/sys2_test_incidents/incident1_interface_flapping/DIST-SW1/show_int_counters.txt

@@ -0,0 +1,5 @@
+DIST-SW1#show interfaces GigabitEthernet0/1 | include line protocol|Last input|input errors|CRC|flapped
+GigabitEthernet0/1 is up, line protocol is down (notconnect)
+  Last input 00:00:02, output 00:00:01, output hang never
+  0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
+  Interface GigabitEthernet0/1 has flapped 27 times in last 10 minutes

cases/sys2_test_incidents/incident1_interface_flapping/DIST-SW1/show_int_status.txt

@@ -0,0 +1,3 @@
+DIST-SW1#show interfaces GigabitEthernet0/1 status
+Port      Name               Status       Vlan       Duplex  Speed Type
+Gi0/1                        notconnect   10         auto    auto 10/100/1000BaseTX

cases/sys2_test_incidents/incident1_interface_flapping/DIST-SW1/show_logging.txt

@@ -0,0 +1,4 @@
+DIST-SW1#show logging | last 20
+*Feb 10 09:11:12.101: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
+*Feb 10 09:11:15.512: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
+*Feb 10 09:11:20.887: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down

cases/sys2_test_incidents/incident1_interface_flapping/incident_type.txt

@@ -0,0 +1 @@
+interface_flapping

cases/sys2_test_incidents/incident1_interface_flapping/wazuh_alert.json

@@ -0,0 +1,10 @@
+{
+  "rule": "Interface flapping detected",
+  "device": "DIST-SW1",
+  "severity": "high",
+  "source": "wazuh-agent",
+  "timestamp": "2026-02-10T19:14:05.095278Z",
+  "interface": "GigabitEthernet0/1",
+  "flap_count_10m": 27,
+  "description": "Interface GigabitEthernet0/1 is flapping (27 transitions in 10 minutes)."
+}

cases/sys2_test_incidents/incident2_duplex_mismatch/EDGE-RTR1/show_int.txt

@@ -0,0 +1,6 @@
+EDGE-RTR1#show interfaces GigabitEthernet0/0
+GigabitEthernet0/0 is up, line protocol is up
+  Hardware is iGbE, address is 0011.2233.4455
+  MTU 1500 bytes, BW 1000000 Kbit/sec
+  Full-duplex, 1000Mb/s, media type is RJ45
+  15234 input errors, 14876 CRC, 0 frame, 0 overrun, 0 ignored

cases/sys2_test_incidents/incident2_duplex_mismatch/EDGE-RTR1/show_int_status.txt

@@ -0,0 +1,2 @@
+EDGE-RTR1#show interfaces GigabitEthernet0/0 status
+Gi0/0  connected  1  a-full  a-1000  10/100/1000BaseTX

cases/sys2_test_incidents/incident2_duplex_mismatch/EDGE-RTR1/show_logging.txt

@@ -0,0 +1,2 @@
+EDGE-RTR1#show logging | last 20
+*Feb 10 09:20:12.321: %PHY-4-DUPLEX_MISMATCH: Duplex mismatch discovered on GigabitEthernet0/0 (full/half)

cases/sys2_test_incidents/incident2_duplex_mismatch/incident_type.txt

@@ -0,0 +1 @@
+link_duplex_mismatch

cases/sys2_test_incidents/incident2_duplex_mismatch/wazuh_alert.json

@@ -0,0 +1,9 @@
+{
+  "rule": "Link duplex mismatch detected",
+  "device": "EDGE-RTR1",
+  "severity": "high",
+  "source": "wazuh-agent",
+  "timestamp": "2026-02-10T19:14:05.096430Z",
+  "interface": "GigabitEthernet0/0",
+  "description": "Duplex mismatch detected on interface GigabitEthernet0/0."
+}

cases/sys2_test_incidents/incident3_mtu_mismatch/CORE-R1/show_int.txt

@@ -0,0 +1,4 @@
+CORE-R1#show interfaces TenGigabitEthernet1/1
+TenGigabitEthernet1/1 is up, line protocol is up
+  MTU 9000 bytes, BW 10000000 Kbit/sec
+  Full-duplex, 10Gb/s

cases/sys2_test_incidents/incident3_mtu_mismatch/CORE-R1/show_ip_int.txt

@@ -0,0 +1,4 @@
+CORE-R1#show ip interface TenGigabitEthernet1/1 | include MTU|encapsulation
+  MTU is 9000 bytes
+  IP MTU is 9000 bytes
+  Encapsulation ARPA, loopback not set

cases/sys2_test_incidents/incident3_mtu_mismatch/CORE-R1/show_logging.txt

@@ -0,0 +1,2 @@
+CORE-R1#show logging | last 20
+*Feb 10 09:32:44.901: %PM-4-MTU_MISMATCH: MTU mismatch detected on TenGigabitEthernet1/1 (local 9000, peer 1500)

cases/sys2_test_incidents/incident3_mtu_mismatch/incident_type.txt

@@ -0,0 +1 @@
+mtu_mismatch

cases/sys2_test_incidents/incident3_mtu_mismatch/wazuh_alert.json

@@ -0,0 +1,11 @@
+{
+  "rule": "MTU mismatch detected (platform side)",
+  "device": "CORE-R1",
+  "severity": "medium",
+  "source": "wazuh-agent",
+  "timestamp": "2026-02-10T19:14:05.096880Z",
+  "interface": "TenGigabitEthernet1/1",
+  "local_mtu": 9000,
+  "peer_mtu": 1500,
+  "description": "MTU mismatch on TenGigabitEthernet1/1: local 9000, peer 1500."
+}

datasets/cisco_gold_100.jsonl

@@ -0,0 +1,100 @@
+{"instruction": "Mitigate SSH brute force from 185.199.108.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "185.199.108.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 130}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 185.199.108.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 167}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 185.199.108.1", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/3\n ip address 45.33.32.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 185.199.108.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "185.199.108.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Mitigate ICMP/UDP flood from 198.51.100.1 towards interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "198.51.100.1", "severity": "high", "pps": 74686}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
+{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 45.33.32.1", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/3\n ip address 185.199.108.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 45.33.32.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "45.33.32.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Mitigate ICMP/UDP flood from 185.199.108.1 towards interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "185.199.108.1", "severity": "high", "pps": 11504}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Increase logging and forward suspicious events to SIEM", "config_raw": "logging host 192.0.2.1\nlogging trap informational\n!\n", "wazuh_alert": {"type": "suspicious_activity_high_volume", "src_ip": "192.0.2.1", "severity": "medium"}, "gold_actions": [{"action_type": "monitoring", "commands": ["logging host 203.0.113.1", "logging trap warning", "service timestamps log datetime msec"], "verify": ["show logging"], "rollback": [], "explain": "Increase logging verbosity and forward logs to SIEM for detailed analysis."}]}
+{"instruction": "Mitigate repeated failed VPN negotiation attempts from 45.33.32.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "45.33.32.1", "severity": "high", "attempts": 60}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 45.33.32.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 45.33.32.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
+{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 117}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
+{"instruction": "Mitigate SSH brute force from 185.199.108.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "185.199.108.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 100}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 185.199.108.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 198.51.100.1", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/2\n ip address 203.0.113.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 198.51.100.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "198.51.100.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/1", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/1", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/3", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/3", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 57\n network 192.168.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
+{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 198.51.100.1", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/0\n ip address 203.0.113.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 198.51.100.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "198.51.100.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 10.0.0.1 to external 203.0.113.1", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/0\n ip address 198.51.100.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 10.0.0.1 203.0.113.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "10.0.0.1", "dst_ip": "203.0.113.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 10.0.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/3", "config_raw": "router ospf 28\n network 192.168.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Increase logging and forward suspicious events to SIEM", "config_raw": "logging host 198.51.100.1\nlogging trap informational\n!\n", "wazuh_alert": {"type": "suspicious_activity_high_volume", "src_ip": "45.33.32.1", "severity": "medium"}, "gold_actions": [{"action_type": "monitoring", "commands": ["logging host 45.33.32.1", "logging trap warning", "service timestamps log datetime msec"], "verify": ["show logging"], "rollback": [], "explain": "Increase logging verbosity and forward logs to SIEM for detailed analysis."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 45.33.32.1", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/3\n ip address 203.0.113.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 45.33.32.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "45.33.32.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Mitigate repeated failed VPN negotiation attempts from 203.0.113.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "203.0.113.1", "severity": "high", "attempts": 35}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 203.0.113.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 203.0.113.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 14\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Mitigate ICMP/UDP flood from 198.51.100.1 towards interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "198.51.100.1", "severity": "high", "pps": 46509}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
+{"instruction": "Mitigate ICMP/UDP flood from 198.51.100.1 towards interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "198.51.100.1", "severity": "high", "pps": 82132}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
+{"instruction": "Mitigate repeated failed VPN negotiation attempts from 203.0.113.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "203.0.113.1", "severity": "high", "attempts": 186}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 203.0.113.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 203.0.113.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
+{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "10.0.0.1", "severity": "critical", "attempts": 110}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 173}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "10.0.0.1", "severity": "critical", "attempts": 92}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
+{"instruction": "Respond to suspected BGP route injection originating via peer 45.33.32.1", "config_raw": "router bgp 64583\n neighbor 45.33.32.1 remote-as 65189\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "45.33.32.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 45.33.32.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 45.33.32.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
+{"instruction": "Block traffic from 45.33.32.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_45_33_32_1", " deny ip host 45.33.32.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_45_33_32_1 in"], "verify": ["show access-lists TEMP_BLOCK_45_33_32_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_45_33_32_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_45_33_32_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 45.33.32.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
+{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 188}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Mitigate repeated failed VPN negotiation attempts from 45.33.32.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "45.33.32.1", "severity": "high", "attempts": 148}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 45.33.32.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 45.33.32.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/1", "config_raw": "router ospf 8\n network 192.168.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 110}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/0", "config_raw": "router ospf 73\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Mitigate repeated failed VPN negotiation attempts from 185.199.108.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "185.199.108.1", "severity": "high", "attempts": 153}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 185.199.108.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 185.199.108.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 198.51.100.1", "config_raw": "interface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/1\n ip address 45.33.32.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 198.51.100.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "198.51.100.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 59\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "172.16.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Mitigate SSH brute force from 185.199.108.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "185.199.108.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 83}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 185.199.108.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 185.199.108.1", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/0\n ip address 185.199.108.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 185.199.108.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "185.199.108.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
+{"instruction": "Respond to suspected BGP route injection originating via peer 203.0.113.1", "config_raw": "router bgp 64529\n neighbor 203.0.113.1 remote-as 64782\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "203.0.113.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 203.0.113.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 203.0.113.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 192.0.2.1", "config_raw": "interface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/2\n ip address 192.0.2.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 192.0.2.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "192.0.2.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
+{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
+{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
+{"instruction": "Mitigate repeated failed VPN negotiation attempts from 185.199.108.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "185.199.108.1", "severity": "high", "attempts": 200}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 185.199.108.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 185.199.108.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
+{"instruction": "Block traffic from 185.199.108.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "185.199.108.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_185_199_108_1", " deny ip host 185.199.108.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_185_199_108_1 in"], "verify": ["show access-lists TEMP_BLOCK_185_199_108_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_185_199_108_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_185_199_108_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 185.199.108.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
+{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/1", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/1", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Mitigate ICMP/UDP flood from 185.199.108.1 towards interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "185.199.108.1", "severity": "high", "pps": 30257}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
+{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 192.0.2.1", "config_raw": "interface GigabitEthernet0/3\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/1\n ip address 198.51.100.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 192.0.2.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "192.0.2.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
+{"instruction": "Mitigate ICMP/UDP flood from 203.0.113.1 towards interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "203.0.113.1", "severity": "high", "pps": 71694}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
+{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/3", "config_raw": "router ospf 45\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Respond to suspected BGP route injection originating via peer 198.51.100.1", "config_raw": "router bgp 64563\n neighbor 198.51.100.1 remote-as 64848\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "198.51.100.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 198.51.100.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 198.51.100.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/0", "config_raw": "router ospf 99\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 4\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Mitigate ICMP/UDP flood from 203.0.113.1 towards interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "203.0.113.1", "severity": "high", "pps": 66959}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
+{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/3", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/3", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Mitigate repeated failed VPN negotiation attempts from 203.0.113.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "203.0.113.1", "severity": "high", "attempts": 131}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 203.0.113.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 203.0.113.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/1", "config_raw": "router ospf 47\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "172.16.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
+{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 125}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
+{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 37\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
+{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 163}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Mitigate repeated failed VPN negotiation attempts from 198.51.100.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "198.51.100.1", "severity": "high", "attempts": 150}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 198.51.100.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 198.51.100.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
+{"instruction": "Mitigate SSH brute force from 198.51.100.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 71}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 198.51.100.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
+{"instruction": "Respond to suspected BGP route injection originating via peer 185.199.108.1", "config_raw": "router bgp 64596\n neighbor 185.199.108.1 remote-as 65160\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "185.199.108.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 185.199.108.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 185.199.108.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
+{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
+{"instruction": "Mitigate repeated failed VPN negotiation attempts from 192.0.2.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "192.0.2.1", "severity": "high", "attempts": 77}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 192.0.2.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 192.0.2.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
+{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/1", "config_raw": "router ospf 4\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "172.16.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
+{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
+{"instruction": "Increase logging and forward suspicious events to SIEM", "config_raw": "logging host 45.33.32.1\nlogging trap informational\n!\n", "wazuh_alert": {"type": "suspicious_activity_high_volume", "src_ip": "198.51.100.1", "severity": "medium"}, "gold_actions": [{"action_type": "monitoring", "commands": ["logging host 45.33.32.1", "logging trap warning", "service timestamps log datetime msec"], "verify": ["show logging"], "rollback": [], "explain": "Increase logging verbosity and forward logs to SIEM for detailed analysis."}]}

datasets/eval_100.jsonl

@@ -0,0 +1,91 @@
+{"instruction": "Convert 'show ip interface brief' to RESTCONF GET", "output": "GET /restconf/data/ietf-interfaces:interfaces-state"}
+{"instruction": "Convert 'show interfaces description' to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/interface"}
+{"instruction": "Convert 'show ip route ospf' to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-routing-oper:routing-state"}
+{"instruction": "Convert 'show vlan brief' to RESTCONF GET", "output": "GET /restconf/data/Cisco-IOS-XE-vlan-oper:vlans"}
+{"instruction": "Generate RESTCONF path for interface GigabitEthernet1 config", "output": "PATCH /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1"}
+{"instruction": "Translate 'interface GigabitEthernet0/1' to RESTCONF YANG path", "output": "/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0%2F1"}
+{"instruction": "Convert ACL creation: 'ip access-list standard BLOCK_NET' to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-acl:acl/acl-sets/acl-set=BLOCK_NET-standard"}
+{"instruction": "Convert 'ip route 0.0.0.0 0.0.0.0 10.0.3.2' to RESTCONF", "output": "POST /restconf/data/Cisco-IOS-XE-native:native/ip/route"}
+{"instruction": "Convert 'router ospf 1' to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-ospf:ospf/processes/process=1"}
+{"instruction": "Convert 'show ip ospf interface' to RESTCONF GET", "output": "GET /restconf/data/Cisco-IOS-XE-ospf-oper:ospf-oper-data"}
+{"instruction": "Convert config VLAN 10 name USERS to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/vlan/vlan-list=10"}
+{"instruction": "RESTCONF for enabling interface Gi0/1", "output": "PATCH /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0%2F1 {\"enabled\": true}"}
+{"instruction": "RESTCONF to shut interface Gi0/2", "output": "PATCH /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0%2F2 {\"enabled\": false}"}
+{"instruction": "Convert NAT rule: 'ip nat inside source list 1 interface Gi0/0' to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-nat:native/ip/nat"}
+{"instruction": "Convert 'show nat statistics' to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-nat-oper:nat-statistics"}
+{"instruction": "Convert static route 'ip route 10.1.1.0 255.255.255.0 10.0.0.1' to RESTCONF", "output": "POST /restconf/data/Cisco-IOS-XE-native:native/ip/route"}
+{"instruction": "Convert 'show ip bgp summary' to RESTCONF GET", "output": "GET /restconf/data/Cisco-IOS-XE-bgp-oper:bgp-state-data"}
+{"instruction": "RESTCONF GET for operational interfaces", "output": "GET /restconf/data/ietf-interfaces:interfaces-state/interface"}
+{"instruction": "Convert 'interface loopback0' creation to RESTCONF", "output": "POST /restconf/data/ietf-interfaces:interfaces/interface=Loopback0"}
+{"instruction": "Convert 'no shutdown' on Gi0/3 to RESTCONF", "output": "PATCH /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0%2F3 {\"enabled\": true}"}
+{"instruction": "Convert zone-based firewall class-map creation to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-policy:policy/class-map"}
+{"instruction": "Convert 'show access-lists' to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-acl:acl"}
+{"instruction": "Convert OSPF neighbor check to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-ospf-oper:ospf-oper-data/ospf-state/neighbor"}
+{"instruction": "RESTCONF for deleting interface Loopback10", "output": "DELETE /restconf/data/ietf-interfaces:interfaces/interface=Loopback10"}
+{"instruction": "RESTCONF for creating VLAN 20", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/vlan/vlan-list=20"}
+{"instruction": "RESTCONF GET ARP table", "output": "GET /restconf/data/Cisco-IOS-XE-arp-oper:arp-data"}
+{"instruction": "Convert static NAT rule to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-nat:native/ip/nat"}
+{"instruction": "Convert 'show interfaces status' to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/interface"}
+{"instruction": "Convert 'no ip domain-lookup' to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/ip"}
+{"instruction": "Convert hostname CORE-R1 to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/hostname"}
+{"instruction": "Convert 'username admin privilege 15 secret test123' to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/username"}
+{"instruction": "Convert 'logging host 10.0.1.50' to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/logging"}
+{"instruction": "Convert SNMP-server community creation to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/snmp-server"}
+{"instruction": "Convert 'show cdp neighbors' to RESTCONF GET", "output": "GET /restconf/data/Cisco-IOS-XE-cdp-oper:cdp-neighbor-details"}
+{"instruction": "Convert 'show lldp neighbors' to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-lldp-oper:lldp-entries"}
+{"instruction": "RESTCONF GET CPU statistics", "output": "GET /restconf/data/Cisco-IOS-XE-process-cpu-oper:cpu-usage"}
+{"instruction": "RESTCONF GET memory statistics", "output": "GET /restconf/data/Cisco-IOS-XE-memory-oper:memory-statistics"}
+{"instruction": "Convert 'line vty 0 4' config to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/line/vty=0-4"}
+{"instruction": "Convert 'enable secret cisco' to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/enable/secret"}
+{"instruction": "Convert IPv6 interface config to RESTCONF", "output": "PATCH /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1"}
+{"instruction": "Convert DHCP pool creation to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-dhcp:dhcp"}
+{"instruction": "Convert 'ip dhcp excluded-address' to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/ip/dhcp/excluded-address"}
+{"instruction": "RESTCONF GET interface counters", "output": "GET /restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/interface/statistics"}
+{"instruction": "Convert crypto key RSA creation to RESTCONF", "output": "POST /restconf/data/Cisco-IOS-XE-crypto:crypto/rsa"}
+{"instruction": "Convert NTP server 1.1.1.1 config to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/ntp/server"}
+{"instruction": "RESTCONF GET version info", "output": "GET /restconf/data/Cisco-IOS-XE-native:native/version"}
+{"instruction": "Convert IP SLA configuration to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-ipsla-oper:ip-sla"}
+{"instruction": "Convert track object creation to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-track:track"}
+{"instruction": "Convert FTP username configuration to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/ip/ftp"}
+{"instruction": "Convert 'router bgp 65000' to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-bgp:bgp"}
+{"instruction": "RESTCONF GET startup config", "output": "GET /restconf/data/Cisco-IOS-XE-native:native"}
+{"instruction": "RESTCONF GET running config", "output": "GET /restconf/data/Cisco-IOS-XE-native:native"}
+{"instruction": "Convert prefix-list creation to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/ip/prefix-list"}
+{"instruction": "Convert route-map creation to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/route-map"}
+{"instruction": "Convert AAA new-model to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/aaa"}
+{"instruction": "Convert login banner to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/banner/login"}
+{"instruction": "Convert message-of-the-day banner to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/banner/motd"}
+{"instruction": "RESTCONF GET device hostname", "output": "GET /restconf/data/Cisco-IOS-XE-native:native/hostname"}
+{"instruction": "RESTCONF GET VRF list", "output": "GET /restconf/data/Cisco-IOS-XE-vrf-oper:vrf-oper-data"}
+{"instruction": "Convert VRF creation to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/vrf/definition"}
+{"instruction": "Convert 'interface Tunnel0' to RESTCONF", "output": "POST /restconf/data/ietf-interfaces:interfaces/interface=Tunnel0"}
+{"instruction": "Convert crypto isakmp policy creation to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-crypto:crypto"}
+{"instruction": "Convert IPSec transform-set creation to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-crypto:crypto"}
+{"instruction": "Convert VLAN trunk configuration to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-switching:interfaces/interface"}
+{"instruction": "RESTCONF GET switchport operational data", "output": "GET /restconf/data/Cisco-IOS-XE-switching-oper:switchport-info"}
+{"instruction": "RESTCONF GET MAC address table", "output": "GET /restconf/data/Cisco-IOS-XE-mac-oper:mac-table"}
+{"instruction": "Convert spanning-tree mode to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-stp:stp"}
+{"instruction": "Convert PoE config to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-poe:poe"}
+{"instruction": "RESTCONF GET power telemetry", "output": "GET /restconf/data/Cisco-IOS-XE-power-oper:power-info"}
+{"instruction": "Convert interface description to RESTCONF", "output": "PATCH /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1/description"}
+{"instruction": "RESTCONF for deleting ACL 'BLOCK_NET'", "output": "DELETE /restconf/data/Cisco-IOS-XE-acl:acl/acl-sets/acl-set=BLOCK_NET-standard"}
+{"instruction": "Convert show crypto session to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-crypto-oper:crypto-sessions"}
+{"instruction": "RESTCONF create static ARP entry", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/arp"}
+{"instruction": "RESTCONF create DHCP relay", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/ip/helper-address"}
+{"instruction": "RESTCONF create service-policy", "output": "PATCH /restconf/data/Cisco-IOS-XE-qos:policy"}
+{"instruction": "Convert policy-map configuration to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-policy:policy"}
+{"instruction": "Convert show qos interface output to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-qos-oper:qos-oper-data"}
+{"instruction": "Convert IPv6 OSPF process to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-ospfv3:ospfv3"}
+{"instruction": "Convert show ipv6 interface brief to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/interface"}
+{"instruction": "RESTCONF delete route-map TEST", "output": "DELETE /restconf/data/Cisco-IOS-XE-native:native/route-map=TEST"}
+{"instruction": "RESTCONF GET interface operational YANG", "output": "GET /restconf/data/ietf-interfaces:interfaces-state/interface"}
+{"instruction": "RESTCONF: create Loopback100", "output": "POST /restconf/data/ietf-interfaces:interfaces/interface=Loopback100"}
+{"instruction": "RESTCONF: delete Loopback100", "output": "DELETE /restconf/data/ietf-interfaces:interfaces/interface=Loopback100"}
+{"instruction": "RESTCONF get IOS-XE modules", "output": "GET /restconf/data/Cisco-IOS-XE-platform-oper:platform-oper-data"}
+{"instruction": "RESTCONF get routing table IPv6", "output": "GET /restconf/data/Cisco-IOS-XE-routing-oper:ipv6-routing-state"}
+{"instruction": "Convert IP SLA responder to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-ipsla:ipsla"}
+{"instruction": "Convert EIGRP config to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-eigrp:eigrp"}
+{"instruction": "RESTCONF GET interface MTU", "output": "GET /restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/interface/mtu"}
+{"instruction": "RESTCONF GET environmental monitoring", "output": "GET /restconf/data/Cisco-IOS-XE-envmon-oper:environmental-data"}
+{"instruction": "Convert show license to RESTCONF", "output": "GET /restconf/data/Cisco-IOS-XE-license-oper:license-info"}
+{"instruction": "Convert SSH configuration to RESTCONF", "output": "PATCH /restconf/data/Cisco-IOS-XE-native:native/ip/ssh"}

datasets/llm2_cli_output.jsonl

@@ -0,0 +1,12 @@
+{"agent": "EDGE-FW1", "instruction": "Analyze and mitigate the following benign activity detected in Wazuh logs.\nSeverity: low\nDevice: EDGE-FW1 (10.0.0.2)\nIndicators of compromise: None provided.\nRecommended actions: N/A.\nExplanation: This is a standard system log message indicating the service has started successfully.", "config_used": "!\nhostname EDGE-FW1\ninterface GigabitEthernet0/0\n nameif outside\n ip address 10.0.0.2 255.255.255.252\n no shutdown\n!\naccess-list OUTSIDE-IN permit tcp any host 10.0.0.2 eq 443\naccess-list OUTSIDE-IN deny ip any any\n!\nroute outside 0.0.0.0 0.0.0.0 10.0.0.1\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following benign activity detected in Wazuh logs.\nSeverity: low\nDevice: EDGE-FW1 (10.0.0.2)\nIndicators of compromise: None provided.\nRecommended actions: N/A.\nExplanation: This is a standard system log message indicating the service has started successfully.\n\n### Device configuration (EDGE-FW1):\n!\nhostname EDGE-FW1\ninterface GigabitEthernet0/0\n nameif outside\n ip address 10.0.0.2 255.255.255.252\n no shutdown\n!\naccess-list OUTSIDE-IN permit tcp any host 10.0.0.2 eq 443\naccess-list OUTSIDE-IN deny ip any any\n!\nroute outside 0.0.0.0 0.0.0.0 10.0.0.1\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"benign\",\n  \"severity\": \"low\",\n  \"explanation\": \"This is a standard system log message indicating the service has started successfully.\",\n  \"iocs\": [],\n  \"recommended_actions\": []\n}\n\n### Response:\nExtracted Device Name: EDGE-FW1\nInterface: GigabitEthernet0/0 (10.0.0.2/29), up\nSecurity: ACL OUTSIDE-IN\nRouting: 10.0.0.0/24 via 10.0.0.1\n\nVerification steps:\nShow ip interface brief\nShow access-lists\nShow ip route\n\nRollback plan:\n\n\nExplanation:\nThis is a low severity alert. EDGE-FW1 is a Cisco device with interface GigabitEthernet0/0 in up state, IP 10.0.0.2/29, ACL OUTSIDE-IN, and routing 10.0.0.0/24 via 10.0.0.1."}
+{"agent": "ACCESS-SW2", "instruction": "Analyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: OSPF-5-ADJCHG, Neighbor 10.0.1.10\nRecommended actions: Check OSPF configuration, Verify neighbor connectivity.\nExplanation: This alert indicates a change in OSPF adjacency, which could be indicative of a network issue. Further investigation is required to determine the cause.", "config_used": "!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: OSPF-5-ADJCHG, Neighbor 10.0.1.10\nRecommended actions: Check OSPF configuration, Verify neighbor connectivity.\nExplanation: This alert indicates a change in OSPF adjacency, which could be indicative of a network issue. Further investigation is required to determine the cause.\n\n### Device configuration (ACCESS-SW2):\n!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"suspicious\",\n  \"severity\": \"medium\",\n  \"explanation\": \"This alert indicates a change in OSPF adjacency, which could be indicative of a network issue. Further investigation is required to determine the cause.\",\n  \"iocs\": [\n    \"OSPF-5-ADJCHG\",\n    \"Neighbor 10.0.1.10\"\n  ],\n  \"recommended_actions\": [\n    \"Check OSPF configuration\",\n    \"Verify neighbor connectivity\"\n  ],\n  \"timestamp\": \"2025-11-12T12:04:00.000+0100\"\n}\n\n### Response:\nExtracted details:\nDevice name: ACCESS-SW2\nInterface: GigabitEthernet0/1 (10.0.2.2/24), up\nVLAN 30 (DEVS)\nVLAN 40 (ADMIN)\nRouting: OSPF enabled on 10.0.2.0, area 0\nACL 130: permit from 10.0.2.0, deny to 10.0.1.0\n\nVerification steps:\nshow ip interface brief\nshow ip ospf neighbor\nshow access-lists\n\nRollback plan:\nNo rollback planned.\n\nExplanation:\nThe device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.0.2.2/24 is up, VLANs 30 (DEVS) and 40 (ADMIN) are configured, and ACL 130 permits traffic from 10.0.2.0 and denies traffic to 10.0.1.0."}
+{"agent": "EDGE-FW1", "instruction": "Analyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: EDGE-FW1 (10.0.0.2)\nIndicators of compromise: 10.0.2.119, 10.0.1.21\nRecommended actions: Check for similar patterns in other logs, Verify network connectivity between EDGE-FW1 and other devices.\nExplanation: This alert indicates a potential security issue, but requires further investigation to determine the cause and impact.", "config_used": "!\nhostname EDGE-FW1\ninterface GigabitEthernet0/0\n nameif outside\n ip address 10.0.0.2 255.255.255.252\n no shutdown\n!\naccess-list OUTSIDE-IN permit tcp any host 10.0.0.2 eq 443\naccess-list OUTSIDE-IN deny ip any any\n!\nroute outside 0.0.0.0 0.0.0.0 10.0.0.1\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: EDGE-FW1 (10.0.0.2)\nIndicators of compromise: 10.0.2.119, 10.0.1.21\nRecommended actions: Check for similar patterns in other logs, Verify network connectivity between EDGE-FW1 and other devices.\nExplanation: This alert indicates a potential security issue, but requires further investigation to determine the cause and impact.\n\n### Device configuration (EDGE-FW1):\n!\nhostname EDGE-FW1\ninterface GigabitEthernet0/0\n nameif outside\n ip address 10.0.0.2 255.255.255.252\n no shutdown\n!\naccess-list OUTSIDE-IN permit tcp any host 10.0.0.2 eq 443\naccess-list OUTSIDE-IN deny ip any any\n!\nroute outside 0.0.0.0 0.0.0.0 10.0.0.1\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"suspicious\",\n  \"severity\": \"medium\",\n  \"explanation\": \"This alert indicates a potential security issue, but requires further investigation to determine the cause and impact.\",\n  \"iocs\": [\n    \"10.0.2.119\",\n    \"10.0.1.21\"\n  ],\n  \"recommended_actions\": [\n    \"Check for similar patterns in other logs\",\n    \"Verify network connectivity between EDGE-FW1 and other devices\"\n  ]\n}\n\n### Response:\nExtracted details:\nDevice name: EDGE-FW1\nInterface: GigabitEthernet0/0 (nameif outside, IP 10.0.0.2)\nACL: OUTSIDE-IN (permit TCP 443, deny IP)\nDefault route: 10.0.0.1\n\nActions:\n1. Investigate the traffic permitted by ACL OUTSIDE-IN on port 443.\n2. Check the connectivity between EDGE-FW1 and 10.0.0.1.\n\nVerification steps:\nShow ip interface brief\nShow access-lists\nShow ip route\n\nRollback plan:\nNo rollback planned."}
+{"agent": "ACCESS-SW1", "instruction": "Analyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW1 (10.0.1.2)\nIndicators of compromise: tcp, 3389\nRecommended actions: Investigation, Block source IP 10.0.1.57.\nExplanation: Rule level 3 indicates a potential threat, but further investigation is required to confirm. The ACL deny rule suggests that the traffic may be malicious.", "config_used": "!\nhostname ACCESS-SW1\ninterface GigabitEthernet0/1\n ip address 10.0.1.2 255.255.255.0\n no shutdown\n!\nvlan 10\n name USERS\n!\nvlan 20\n name SERVERS\n!\nrouter ospf 1\n network 10.0.1.0 0.0.0.255 area 0\n!\naccess-list 120 permit ip 10.0.1.0 0.0.0.255 any\naccess-list 120 deny ip any 192.168.0.0 0.0.255.255\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW1 (10.0.1.2)\nIndicators of compromise: tcp, 3389\nRecommended actions: Investigation, Block source IP 10.0.1.57.\nExplanation: Rule level 3 indicates a potential threat, but further investigation is required to confirm. The ACL deny rule suggests that the traffic may be malicious.\n\n### Device configuration (ACCESS-SW1):\n!\nhostname ACCESS-SW1\ninterface GigabitEthernet0/1\n ip address 10.0.1.2 255.255.255.0\n no shutdown\n!\nvlan 10\n name USERS\n!\nvlan 20\n name SERVERS\n!\nrouter ospf 1\n network 10.0.1.0 0.0.0.255 area 0\n!\naccess-list 120 permit ip 10.0.1.0 0.0.0.255 any\naccess-list 120 deny ip any 192.168.0.0 0.0.255.255\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"suspicious\",\n  \"severity\": \"medium\",\n  \"explanation\": \"Rule level 3 indicates a potential threat, but further investigation is required to confirm. The ACL deny rule suggests that the traffic may be malicious.\",\n  \"iocs\": [\n    \"tcp\",\n    \"3389\"\n  ],\n  \"recommended_actions\": [\n    \"Investigation\",\n    \"Block source IP 10.0.1.57\"\n  ]\n}\n\n### Response:\nExtracted details:\nDevice name: ACCESS-SW1\nInterface: GigabitEthernet0/1 (10.0.1.2/24), up\nVLAN: 10 (USERS), 20 (SERVERS)\nRouting: OSPF enabled on 10.0.1.0\nACL 120: deny traffic from 10.0.1.0 to 192.168.0.0\n\nActions:\n1. Investigate the detected potential threat.\n2. Block source IP 10.0.1.57.\n\nVerification steps:\n1. Show ip interface brief\n2. Show ip ospf neighbor\n3. Show access-lists\n\nRollback plan:\nNone"}
+{"agent": "ACCESS-SW2", "instruction": "Analyze and mitigate the following benign activity detected in Wazuh logs.\nSeverity: low\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: None provided.\nRecommended actions: N/A.\nExplanation: This is a normal system event indicating service startup.", "config_used": "!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following benign activity detected in Wazuh logs.\nSeverity: low\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: None provided.\nRecommended actions: N/A.\nExplanation: This is a normal system event indicating service startup.\n\n### Device configuration (ACCESS-SW2):\n!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"benign\",\n  \"severity\": \"low\",\n  \"explanation\": \"This is a normal system event indicating service startup.\",\n  \"iocs\": [],\n  \"recommended_actions\": []\n}\n\n### Response:\nExtracted hostname: ACCESS-SW2\nInterface: GigabitEthernet0/1 - 10.0.2.2/24 (up)\nVLAN 30: 10.0.2.0 (DEVS)\nVLAN 40: 10.0.2.0 (ADMIN)\nRouting: OSPF enabled on 10.0.2.0\nACL 130: permit from 10.0.2.0, deny from 10.0.1.0\n\nVerification steps:\nShow ip interface brief\nShow ip ospf neighbor\nShow access-lists\n\nRollback plan:\nNone"}
+{"agent": "ACCESS-SW2", "instruction": "Analyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: OSPF-5-ADJCHG\nRecommended actions: Investigation, Monitoring.\nExplanation: The rule level of 7 indicates a potential issue that requires further investigation. The decoder used is ospf, which suggests the alert is related to OSPF protocol changes.", "config_used": "!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: OSPF-5-ADJCHG\nRecommended actions: Investigation, Monitoring.\nExplanation: The rule level of 7 indicates a potential issue that requires further investigation. The decoder used is ospf, which suggests the alert is related to OSPF protocol changes.\n\n### Device configuration (ACCESS-SW2):\n!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"suspicious\",\n  \"severity\": \"medium\",\n  \"explanation\": \"The rule level of 7 indicates a potential issue that requires further investigation. The decoder used is ospf, which suggests the alert is related to OSPF protocol changes.\",\n  \"iocs\": [\n    \"OSPF-5-ADJCHG\"\n  ],\n  \"recommended_actions\": [\n    \"Investigation\",\n    \"Monitoring\"\n  ]\n}\n\n### Response:\nExtracted details:\nDevice name: ACCESS-SW2\nInterface: GigabitEthernet0/1 (10.0.2.2/24), up\nVLAN 30: 10.0.2.0, name DEVS\nVLAN 40: 10.0.1.0, name ADMIN\nRouting: OSPF enabled on 10.0.2.0\n\nProposed configuration:\nExtracted details show interface GigabitEthernet0/1 in an active state with IP 10.0.2.2/24. VLAN 30 and 40 are also configured with specific host IPs. OSPF protocol is active on 10.0.2.0. Monitor the network for unusual traffic or misconfigurations.\n\nVerification steps:\nShow ip interface brief\nShow ip ospf neighbor\nShow access-lists\n\nRollback plan:\nNo rollback planned."}
+{"agent": "CORE-R1", "instruction": "Analyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: CORE-R1 (10.0.0.1)\nIndicators of compromise: 10.0.3.200, Gi0/1, VLAN 30\nRecommended actions: Investigation, Anomaly detection tools, Network monitoring.\nExplanation: The alert indicates a potential anomaly in the network traffic, but more information is needed to determine the severity of the issue.", "config_used": "!\nhostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.252\n no shutdown\n!\ninterface GigabitEthernet0/1\n ip address 10.0.1.1 255.255.255.0\n no shutdown\n!\ninterface GigabitEthernet0/2\n ip address 10.0.2.1 255.255.255.0\n no shutdown\n!\nrouter ospf 1\n network 10.0.0.0 0.0.0.3 area 0\n network 10.0.1.0 0.0.0.255 area 0\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 110 permit ip any any\naccess-list 110 deny tcp any any eq 23\naccess-list 110 deny tcp any any eq 445\n!\nline vty...", "output": "### Instruction:\nAnalyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: CORE-R1 (10.0.0.1)\nIndicators of compromise: 10.0.3.200, Gi0/1, VLAN 30\nRecommended actions: Investigation, Anomaly detection tools, Network monitoring.\nExplanation: The alert indicates a potential anomaly in the network traffic, but more information is needed to determine the severity of the issue.\n\n### Device configuration (CORE-R1):\n!\nhostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.252\n no shutdown\n!\ninterface GigabitEthernet0/1\n ip address 10.0.1.1 255.255.255.0\n no shutdown\n!\ninterface GigabitEthernet0/2\n ip address 10.0.2.1 255.255.255.0\n no shutdown\n!\nrouter ospf 1\n network 10.0.0.0 0.0.0.3 area 0\n network 10.0.1.0 0.0.0.255 area 0\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 110 permit ip any any\naccess-list 110 deny tcp any any eq 23\naccess-list 110 deny tcp any any eq 445\n!\nline vty 0 4\n login local\n transport input ssh\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"suspicious\",\n  \"severity\": \"medium\",\n  \"explanation\": \"The alert indicates a potential anomaly in the network traffic, but more information is needed to determine the severity of the issue.\",\n  \"iocs\": [\n    \"10.0.3.200\",\n    \"Gi0/1\",\n    \"VLAN 30\"\n  ],\n  \"recommended_actions\": [\n    \"Investigation\",\n    \"Anomaly detection tools\",\n    \"Network monitoring\"\n  ],\n  \"timestamp\": \"2025-11-12T12:25:00.000+0100\"\n}\n\n### Response:\nExtracted details:\nDevice name: CORE-R1\nInterface: GigabitEthernet0/0, 10.0.0.1/29; GigabitEthernet0/1, 10.0.1.1/24; GigabitEthernet0/2, 10.0.2.1/24\nRouting: OSPF enabled on 10.0.0.0, 10.0.1.0, 10.0.2.0\nACL 110: deny TCP 23 and 445\nHostname: vty 0 4\n\nVerification steps:\nshow ip interface brief\nshow ip ospf neighbor\nshow access-lists\n\nRollback plan:\nNone"}
+{"agent": "ACCESS-SW2", "instruction": "Analyze and mitigate the following benign activity detected in Wazuh logs.\nSeverity: low\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: None provided.\nRecommended actions: N/A.\nExplanation: This log event indicates a normal system service start, which is expected behavior.", "config_used": "!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following benign activity detected in Wazuh logs.\nSeverity: low\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: None provided.\nRecommended actions: N/A.\nExplanation: This log event indicates a normal system service start, which is expected behavior.\n\n### Device configuration (ACCESS-SW2):\n!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"benign\",\n  \"severity\": \"low\",\n  \"explanation\": \"This log event indicates a normal system service start, which is expected behavior.\",\n  \"iocs\": [],\n  \"recommended_actions\": []\n}\n\n### Response:\nExtracted device name: ACCESS-SW2\nInterface: GigabitEthernet0/1 - 10.0.2.2/24 (up)\nVLAN 30: 10.0.2.0 (DEVS)\nVLAN 40: 10.0.1.0 (ADMIN)\nRouting: OSPF enabled on 10.0.2.0\nACL 130: permit from 10.0.2.0, deny from 10.0.1.0\n\nVerification steps:\nShow ip interface brief\nShow ip ospf neighbor\nShow access-lists\n\nRollback plan:\n\n\nExplanation:\nThe log indicates a normal system service start on ACCESS-SW2."}
+{"agent": "BRANCH-RTR1", "instruction": "Analyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: BRANCH-RTR1 (10.0.3.1)\nIndicators of compromise: 10.0.2.81, test\nRecommended actions: Continue monitoring, Document event.\nExplanation: Rule level 10 indicates a potential issue, but without further context or analysis, it's difficult to determine the severity.", "config_used": "!\nhostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.0.3.1 255.255.255.0\n no shutdown\n!\nrouter ospf 2\n network 10.0.3.0 0.0.0.255 area 0\n!\naccess-list 140 permit ip 10.0.3.0 0.0.0.255 any\naccess-list 140 deny ip any any eq 23\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: BRANCH-RTR1 (10.0.3.1)\nIndicators of compromise: 10.0.2.81, test\nRecommended actions: Continue monitoring, Document event.\nExplanation: Rule level 10 indicates a potential issue, but without further context or analysis, it's difficult to determine the severity.\n\n### Device configuration (BRANCH-RTR1):\n!\nhostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.0.3.1 255.255.255.0\n no shutdown\n!\nrouter ospf 2\n network 10.0.3.0 0.0.0.255 area 0\n!\naccess-list 140 permit ip 10.0.3.0 0.0.0.255 any\naccess-list 140 deny ip any any eq 23\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"suspicious\",\n  \"severity\": \"medium\",\n  \"explanation\": \"Rule level 10 indicates a potential issue, but without further context or analysis, it's difficult to determine the severity.\",\n  \"iocs\": [\n    \"10.0.2.81\",\n    \"test\"\n  ],\n  \"recommended_actions\": [\n    \"Continue monitoring\",\n    \"Document event\"\n  ]\n}\n\n### Response:\nExtracted details:\nDevice name: BRANCH-RTR1\nInterface: GigabitEthernet0/0 (10.0.3.1/24), up\nRouting: OSPF enabled on 10.0.3.0/24 area 0\nACL 140: permit 10.0.3.0, deny other directions on port 23\n\nActions:\n1. Monitor interface status and traffic\n2. Verify OSPF configuration and neighbors\n3. Check ACL 140 rules and traffic\n4. Document the event"}
+{"agent": "ACCESS-SW1", "instruction": "Analyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW1 (10.0.1.2)\nIndicators of compromise: None provided.\nRecommended actions: Check the user account and its permissions, Verify the authenticity of the login request.\nExplanation: The alert is suspicious because it indicates a failed SSH authentication attempt, which could be indicative of malicious activity. However, without more context or information about the user account and its permissions, we cannot confirm this classification.", "config_used": "!\nhostname ACCESS-SW1\ninterface GigabitEthernet0/1\n ip address 10.0.1.2 255.255.255.0\n no shutdown\n!\nvlan 10\n name USERS\n!\nvlan 20\n name SERVERS\n!\nrouter ospf 1\n network 10.0.1.0 0.0.0.255 area 0\n!\naccess-list 120 permit ip 10.0.1.0 0.0.0.255 any\naccess-list 120 deny ip any 192.168.0.0 0.0.255.255\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW1 (10.0.1.2)\nIndicators of compromise: None provided.\nRecommended actions: Check the user account and its permissions, Verify the authenticity of the login request.\nExplanation: The alert is suspicious because it indicates a failed SSH authentication attempt, which could be indicative of malicious activity. However, without more context or information about the user account and its permissions, we cannot confirm this classification.\n\n### Device configuration (ACCESS-SW1):\n!\nhostname ACCESS-SW1\ninterface GigabitEthernet0/1\n ip address 10.0.1.2 255.255.255.0\n no shutdown\n!\nvlan 10\n name USERS\n!\nvlan 20\n name SERVERS\n!\nrouter ospf 1\n network 10.0.1.0 0.0.0.255 area 0\n!\naccess-list 120 permit ip 10.0.1.0 0.0.0.255 any\naccess-list 120 deny ip any 192.168.0.0 0.0.255.255\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"suspicious\",\n  \"severity\": \"medium\",\n  \"explanation\": \"The alert is suspicious because it indicates a failed SSH authentication attempt, which could be indicative of malicious activity. However, without more context or information about the user account and its permissions, we cannot confirm this classification.\",\n  \"ioc\": [\n    \"sshd\",\n    \"Failed password\"\n  ],\n  \"recommended_actions\": [\n    \"Check the user account and its permissions\",\n    \"Verify the authenticity of the login request\"\n  ]\n}\n\n### Response:\nExtracted details:\nDevice name: ACCESS-SW1\nInterface: GigabitEthernet0/1 (10.0.1.2/24 - up)\nVLAN 10: USERS\nVLAN 20: SERVERS\nRouting: OSPF enabled on 10.0.1.0\nACL 120: permit 10.0.1.0, deny 192.168.0.0\n\nVerification steps:\nshow ip interface brief\nshow ip ospf neighbor\nshow access-lists\n\nRollback plan:\n\n\nExplanation:\nThe device ACCESS-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.0.1.2/24 is up, and ACL 120 permits traffic from 10.0.1.0 and denies traffic from 192.168.0.0."}
+{"agent": "BRANCH-RTR1", "instruction": "Analyze and mitigate the following benign activity detected in Wazuh logs.\nSeverity: low\nDevice: BRANCH-RTR1 (10.0.3.1)\nIndicators of compromise: None provided.\nRecommended actions: N/A.\nExplanation: This rule is a standard service event and does not indicate any malicious activity.", "config_used": "!\nhostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.0.3.1 255.255.255.0\n no shutdown\n!\nrouter ospf 2\n network 10.0.3.0 0.0.0.255 area 0\n!\naccess-list 140 permit ip 10.0.3.0 0.0.0.255 any\naccess-list 140 deny ip any any eq 23\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following benign activity detected in Wazuh logs.\nSeverity: low\nDevice: BRANCH-RTR1 (10.0.3.1)\nIndicators of compromise: None provided.\nRecommended actions: N/A.\nExplanation: This rule is a standard service event and does not indicate any malicious activity.\n\n### Device configuration (BRANCH-RTR1):\n!\nhostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.0.3.1 255.255.255.0\n no shutdown\n!\nrouter ospf 2\n network 10.0.3.0 0.0.0.255 area 0\n!\naccess-list 140 permit ip 10.0.3.0 0.0.0.255 any\naccess-list 140 deny ip any any eq 23\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"benign\",\n  \"severity\": \"low\",\n  \"explanation\": \"This rule is a standard service event and does not indicate any malicious activity.\",\n  \"iocs\": [],\n  \"recommended_actions\": []\n}\n\n### Response:\nExtracted details:\nDevice name: BRANCH-RTR1\nInterface: GigabitEthernet0/0 (10.0.3.1/24), up\nRouting: OSPF enabled on 10.0.3.0/24 area 0\nACL 140: permit from 10.0.3.0, deny from other hosts to port 23\n\nVerification steps:\nshow ip interface brief\nshow ip ospf neighbor\nshow access-lists\n\nRollback plan:\n\n\nExplanation:\nThe device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.0.3.1/24 is up, and ACL 140 permits traffic from 10.0.3.0 and denies traffic from other hosts to port 23."}
+{"agent": "ACCESS-SW2", "instruction": "Analyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: None provided.\nRecommended actions: Investigation required, Verify user account 'test' existence and validity.\nExplanation: The rule level is 7, which indicates a potential issue but requires further investigation. The log itself does not indicate malicious activity.", "config_used": "!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n...", "output": "### Instruction:\nAnalyze and mitigate the following suspicious activity detected in Wazuh logs.\nSeverity: medium\nDevice: ACCESS-SW2 (10.0.2.2)\nIndicators of compromise: None provided.\nRecommended actions: Investigation required, Verify user account 'test' existence and validity.\nExplanation: The rule level is 7, which indicates a potential issue but requires further investigation. The log itself does not indicate malicious activity.\n\n### Device configuration (ACCESS-SW2):\n!\nhostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.2.2 255.255.255.0\n no shutdown\n!\nvlan 30\n name DEVS\n!\nvlan 40\n name ADMIN\n!\nrouter ospf 1\n network 10.0.2.0 0.0.0.255 area 0\n!\naccess-list 130 permit ip 10.0.2.0 0.0.0.255 any\naccess-list 130 deny ip any 10.0.1.0 0.0.0.255\n!\nend\n\n\n### Wazuh alert:\n{\n  \"classification\": \"suspicious\",\n  \"severity\": \"medium\",\n  \"explanation\": \"The rule level is 7, which indicates a potential issue but requires further investigation. The log itself does not indicate malicious activity.\",\n  \"ioc_list\": [\n    \"ssh2\"\n  ],\n  \"recommended_actions\": [\n    \"Investigation required\",\n    \"Verify user account 'test' existence and validity\"\n  ],\n  \"timestamp\": \"2025-11-12T12:53:00.000+0100\"\n}\n\n### Response:\nExtracted details:\nDevice name: ACCESS-SW2\nInterface: GigabitEthernet0/1 (10.0.2.2/24), up\nVLAN 30 (DEVS)\nVLAN 40 (ADMIN)\nRouting: OSPF enabled on 10.0.2.0\nACL 130: permit from 10.0.2.0, deny from 10.0.1.0\n\nVerification steps:\nshow ip interface brief\nshow ip ospf neighbor\nshow access-lists\n\nRollback plan:\n\n\nExplanation:\nThe device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.0.2.2/24 is up, and ACL 130 permits traffic from 10.0.2.0 and denies traffic from 10.0.1.0."}

datasets/llm2_input.jsonl

@@ -0,0 +1,6 @@
+{"instruction": "Analyze and correlate the following Wazuh alert with the Cisco running configuration. Determine which device, interface, VLAN, or ACL is related to the given indicators, and describe the affected network components.", "context_summary": "Incident type: port_scan. Severity: high, classification: suspicious. Indicators: none. Recommended actions: Block source IP 203.0.113.45 at firewall, Notify security team.", "wazuh_alert": {"incident_type": "port_scan", "classification": "suspicious", "severity": "high", "source_ip": "203.0.113.45", "destination_ip": "10.0.20.7", "ioc": ["203.0.113.45"], "recommended_actions": ["Block source IP 203.0.113.45 at firewall", "Notify security team"], "explanation": "A port scan is an attempt to probe multiple ports on a system, which can be indicative of malicious activity"}, "config_raw": ""}
+{"instruction": "Analyze and correlate the following Wazuh alert with the Cisco running configuration. Determine which device, interface, VLAN, or ACL is related to the given indicators, and describe the affected network components.", "context_summary": "Incident type: data_exfiltration. Severity: high, classification: suspicious. Indicators: 10.1.1.15, 185.199.108.12. Recommended actions: Verify data transfer with network team, Review firewall rules and configurations.", "wazuh_alert": {"incident_type": "data_exfiltration", "classification": "suspicious", "severity": "high", "source_ip": "10.1.1.15", "destination_ip": "185.199.108.12", "iocs": ["10.1.1.15", "185.199.108.12"], "recommended_actions": ["Verify data transfer with network team", "Review firewall rules and configurations"], "explanation": "The event indicates a potential exfiltration of large amounts of data from the internal host to an external host over HTTPS"}, "config_raw": ""}
+{"instruction": "Analyze and correlate the following Wazuh alert with the Cisco running configuration. Determine which device, interface, VLAN, or ACL is related to the given indicators, and describe the affected network components.", "context_summary": "Incident type: malware. Severity: high, classification: suspicious. Indicators: d41d8cd98f00b204e9800998ecf8427e. Recommended actions: Remove the malware, Run full system scan.", "wazuh_alert": {"incident_type": "malware", "classification": "suspicious", "severity": "high", "source_ip": null, "destination_ip": null, "iocs": ["d41d8cd98f00b204e9800998ecf8427e"], "recommended_actions": ["Remove the malware", "Run full system scan"], "explanation": "The Wazuh alert indicates that a malicious binary was detected on the system, which suggests potential malware activity. The recommended actions are to remove the malware and run a full system scan to ensure no further issues."}, "config_raw": ""}
+{"instruction": "Analyze and correlate the following Wazuh alert with the Cisco running configuration. Determine which device, interface, VLAN, or ACL is related to the given indicators, and describe the affected network components.", "context_summary": "Incident type: bgp_route_table_anomaly. Severity: medium, classification: suspicious. Indicators: none. Recommended actions: Verify the BGP configuration on core-router-01, Check for any recent changes to the routing policy.", "wazuh_alert": {"incident_type": "bgp_route_table_anomaly", "classification": "suspicious", "severity": "medium", "source_ip": null, "destination_ip": "198.51.100.9", "ioc": ["10.0.0.0/8", "172.16.0.0/12"], "recommended_actions": ["Verify the BGP configuration on core-router-01", "Check for any recent changes to the routing policy"], "explanation": "The log indicates an unexpected prefix announcement from a peer router, which could be indicative of a potential security risk or misconfiguration."}, "config_raw": ""}
+{"instruction": "Analyze and correlate the following Wazuh alert with the Cisco running configuration. Determine which device, interface, VLAN, or ACL is related to the given indicators, and describe the affected network components.", "context_summary": "Incident type: brute_force. Severity: high, classification: suspicious. Indicators: none. Recommended actions: Block source IP 192.0.2.111, Investigate further.", "wazuh_alert": {"incident_type": "brute_force", "classification": "suspicious", "severity": "high", "source_ip": "192.0.2.111", "destination_ip": null, "ioc_list": ["192.0.2.111"], "recommended_actions": ["Block source IP 192.0.2.111", "Investigate further"], "explanation": "This alert indicates a high volume of RDP authentication failures, which may indicate a brute force attack"}, "config_raw": ""}
+{"instruction": "Analyze and correlate the following Wazuh alert with the Cisco running configuration. Determine which device, interface, VLAN, or ACL is related to the given indicators, and describe the affected network components.", "context_summary": "Incident type: suspicious. Severity: medium, classification: suspicious. Indicators: none. Recommended actions: Verify container logs for suspicious activity, Check for signs of unauthorized code execution.", "wazuh_alert": {"incident_type": "suspicious", "classification": "suspicious", "severity": "medium", "source_ip": "10.0.80.6", "destination_ip": "185.199.108.12", "ioc_list": ["185.199.108.12"], "recommended_actions": ["Verify container logs for suspicious activity", "Check for signs of unauthorized code execution"], "explanation": "This incident indicates that the container has been compromised by an external payload, which may lead to further malicious activity."}, "config_raw": ""}

datasets/llm_s_dataset_v2.jsonl

@@ -0,0 +1,100 @@
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.219.112", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.156.8", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.31.136", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.138.83", "event": "port scan", "severity": "high"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.6.221", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.7.130", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.227.147", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.134.59", "event": "acl block", "severity": "critical"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'bgp session flap' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.238.78", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.57.143", "event": "acl block", "severity": "medium"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.37.36", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.30.252", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'arp spoofing' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.176.204", "event": "arp spoofing", "severity": "low"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.136.78", "event": "dns exfiltration", "severity": "high"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.19.238", "event": "dhcp starvation", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.244.173", "event": "acl block", "severity": "high"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'arp spoofing' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.124.44", "event": "arp spoofing", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
+{"instruction": "Wazuh detected event 'bgp session flap' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.34.157", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
+{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.138.206", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
+{"instruction": "Wazuh detected event 'high cpu' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.232.238", "event": "high cpu", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.203.2", "event": "dns exfiltration", "severity": "medium"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.110.16", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.242.25", "event": "dns exfiltration", "severity": "medium"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.100.229", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.102.91", "event": "acl block", "severity": "high"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.28.8", "event": "port scan", "severity": "high"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.253.45", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.123.127", "event": "dhcp starvation", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'bgp session flap' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.85.117", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
+{"instruction": "Wazuh detected event 'arp spoofing' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.63.3", "event": "arp spoofing", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.82.69", "event": "acl block", "severity": "medium"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'arp spoofing' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.6.148", "event": "arp spoofing", "severity": "critical"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.212.253", "event": "port scan", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'bgp session flap' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.165.189", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.143.73", "event": "dns exfiltration", "severity": "critical"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'high cpu' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.68.221", "event": "high cpu", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
+{"instruction": "Wazuh detected event 'bgp session flap' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.160.70", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.129.230", "event": "dns exfiltration", "severity": "high"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'arp spoofing' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.252.159", "event": "arp spoofing", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
+{"instruction": "Wazuh detected event 'high cpu' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.149.233", "event": "high cpu", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.218.252", "event": "dhcp starvation", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'bgp session flap' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.57.87", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
+{"instruction": "Wazuh detected event 'arp spoofing' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.201.46", "event": "arp spoofing", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.254.14", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'high cpu' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.10.8", "event": "high cpu", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.28.185", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.157.241", "event": "port scan", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'arp spoofing' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.228.171", "event": "arp spoofing", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.61.212", "event": "dhcp starvation", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.156.109", "event": "port scan", "severity": "low"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.66.115", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.12.143", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.81.26", "event": "dhcp starvation", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.63.209", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.206.66", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.18.21", "event": "dns exfiltration", "severity": "medium"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.8.166", "event": "dhcp starvation", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.244.81", "event": "acl block", "severity": "low"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'arp spoofing' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.11.214", "event": "arp spoofing", "severity": "critical"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.241.157", "event": "dns exfiltration", "severity": "low"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.78.99", "event": "acl block", "severity": "low"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'high cpu' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.174.143", "event": "high cpu", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.15.153", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.71.111", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.139.119", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'high cpu' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.253.117", "event": "high cpu", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.47.14", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.54.20", "event": "acl block", "severity": "medium"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'bgp session flap' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.127.78", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.217.49", "event": "dhcp starvation", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.78.208", "event": "acl block", "severity": "critical"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.231.59", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.115.69", "event": "dns exfiltration", "severity": "critical"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.147.13", "event": "port scan", "severity": "high"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'high cpu' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.51.3", "event": "high cpu", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.20.45", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.224.94", "event": "dhcp starvation", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.43.118", "event": "dns exfiltration", "severity": "high"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'high cpu' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.152.113", "event": "high cpu", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.145.22", "event": "port scan", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.244.73", "event": "port scan", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.188.251", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.113.143", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.192.66", "event": "port scan", "severity": "high"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.30.224", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'bgp session flap' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.8.96", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.43.251", "event": "dns exfiltration", "severity": "medium"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'vpn tunnel down' originating from device ACCESS-SW1. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "192.168.164.34", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.96.66", "event": "dhcp starvation", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'dhcp starvation' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.42.163", "event": "dhcp starvation", "severity": "low"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
+{"instruction": "Wazuh detected event 'bgp session flap' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.113.241", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.184.26", "event": "acl block", "severity": "low"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device BRANCH-RTR1. Provide required show commands.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "192.168.171.212", "event": "dns exfiltration", "severity": "critical"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'high cpu' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.15.186", "event": "high cpu", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.220.231", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'dns exfiltration' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.221.105", "event": "dns exfiltration", "severity": "critical"}, "requested_show": ["show ip dns view", "show ip traffic", "show interfaces"]}
+{"instruction": "Wazuh detected event 'acl block' originating from device EDGE-FW1. Provide required show commands.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "192.168.178.89", "event": "acl block", "severity": "critical"}, "requested_show": ["show access-lists", "show logging", "show ip interface brief"]}
+{"instruction": "Wazuh detected event 'ssh brute-force' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.36.182", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show arp"]}
+{"instruction": "Wazuh detected event 'port scan' originating from device ACCESS-SW2. Provide required show commands.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "192.168.129.187", "event": "port scan", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show ip traffic", "show access-lists", "show firewall"]}
+{"instruction": "Wazuh detected event 'ospf neighbor down' originating from device CORE-R1. Provide required show commands.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "192.168.97.66", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}