diff --git "a/datasets/bgp1_dataset_900.jsonl" "b/datasets/bgp1_dataset_900.jsonl"
new file mode 100644--- /dev/null
+++ "b/datasets/bgp1_dataset_900.jsonl"
@@ -0,0 +1,900 @@
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:30:00Z", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 39349, "tx_updates": 11347, "rx_keepalives": 1335, "tx_keepalives": 8446}, {"name": "EDGE-RTR1", "router_id": "3.1.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 7716, "tx_updates": 40992, "rx_keepalives": 21470, "tx_keepalives": 18013}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.161 shutdown", "neighbor 192.0.2.161 no shutdown", "clear ip bgp 192.0.2.161"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:30:00Z", "neighbor": "192.0.2.216"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.4.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 24635, "tx_updates": 33620, "rx_keepalives": 41791, "tx_keepalives": 2078}, {"name": "EDGE-RTR1", "router_id": "1.2.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 40706, "tx_updates": 26395, "rx_keepalives": 20173, "tx_keepalives": 28145}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.216 shutdown", "neighbor 192.0.2.216 no shutdown", "clear ip bgp 192.0.2.216"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:30:00Z", "neighbor": "192.0.2.172"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.4.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.172", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 35048, "tx_updates": 27304, "rx_keepalives": 44836, "tx_keepalives": 17968}, {"name": "CORE-R1", "router_id": "3.4.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.182", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 55, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 6790, "tx_updates": 34774, "rx_keepalives": 5606, "tx_keepalives": 28997}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.172 shutdown", "neighbor 192.0.2.172 no shutdown", "clear ip bgp 192.0.2.172"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:36:00Z", "neighbor": "192.0.2.211"}, "devices": [{"name": "DC-RTR1", "router_id": "2.3.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 34788, "tx_updates": 3955, "rx_keepalives": 35591, "tx_keepalives": 43724}, {"name": "CORE-R1", "router_id": "1.4.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 21459, "tx_updates": 18684, "rx_keepalives": 14685, "tx_keepalives": 20296}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.211"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:06:00Z", "neighbor": "192.0.2.126"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41193, "tx_updates": 25693, "rx_keepalives": 41126, "tx_keepalives": 39445}, {"name": "EDGE-RTR1", "router_id": "5.1.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 34848, "tx_updates": 31194, "rx_keepalives": 13370, "tx_keepalives": 35096}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "neighbor 192.0.2.126 timers 30 90", "clear ip bgp 192.0.2.126"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:37:00Z", "neighbor": "192.0.2.198"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 54, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 8504, "tx_updates": 14063, "rx_keepalives": 31413, "tx_keepalives": 6174}, {"name": "BRANCH-RTR1", "router_id": "1.2.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.50", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 22, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 17345, "tx_updates": 40558, "rx_keepalives": 49636, "tx_keepalives": 8215}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.198 shutdown", "neighbor 192.0.2.198 no shutdown", "clear ip bgp 192.0.2.198"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:19:00Z", "neighbor": "192.0.2.125"}, "devices": [{"name": "DC-RTR1", "router_id": "3.1.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.125", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 30, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 23462, "tx_updates": 17419, "rx_keepalives": 8509, "tx_keepalives": 27404}, {"name": "CORE-R1", "router_id": "1.5.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.195", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 40776, "tx_updates": 47932, "rx_keepalives": 5010, "tx_keepalives": 35039}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.125 shutdown", "neighbor 192.0.2.125 no shutdown", "clear ip bgp 192.0.2.125"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:51:00Z", "neighbor": "192.0.2.224"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32862, "tx_updates": 41399, "rx_keepalives": 31185, "tx_keepalives": 30826}, {"name": "CORE-R1", "router_id": "5.1.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 3307, "tx_updates": 1903, "rx_keepalives": 27790, "tx_keepalives": 29947}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.224 timers 30 90", "clear ip bgp 192.0.2.224"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:35:00Z", "neighbor": "192.0.2.142"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.142", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 18398, "tx_updates": 42540, "rx_keepalives": 27281, "tx_keepalives": 6481}, {"name": "EDGE-RTR1", "router_id": "5.4.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 6925, "tx_updates": 49231, "rx_keepalives": 16741, "tx_keepalives": 8607}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.142 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:27:00Z", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "router_id": "1.3.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.251", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 40654, "tx_updates": 37664, "rx_keepalives": 15091, "tx_keepalives": 17604}, {"name": "EDGE-RTR1", "router_id": "2.1.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27685, "tx_updates": 46487, "rx_keepalives": 18278, "tx_keepalives": 13148}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.251 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:56:00Z", "neighbor": "192.0.2.177"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.177", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 6629, "tx_updates": 25725, "rx_keepalives": 39034, "tx_keepalives": 22435}, {"name": "EDGE-RTR1", "router_id": "1.5.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 8048, "tx_updates": 14542, "rx_keepalives": 30657, "tx_keepalives": 26083}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.177"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:36:00Z", "neighbor": "192.0.2.139"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 17850, "tx_updates": 42437, "rx_keepalives": 26695, "tx_keepalives": 45664}, {"name": "DC-RTR1", "router_id": "1.2.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.57", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 10169, "tx_updates": 43909, "rx_keepalives": 16003, "tx_keepalives": 4768}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.139 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:37:00Z", "neighbor": "192.0.2.102"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 11937, "tx_updates": 39472, "rx_keepalives": 7505, "tx_keepalives": 25482}, {"name": "EDGE-RTR1", "router_id": "2.4.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.74", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 47581, "tx_updates": 30464, "rx_keepalives": 44686, "tx_keepalives": 15986}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.102 update-source Loopback0", "neighbor 192.0.2.102 timers 60 180", "clear ip bgp 192.0.2.102"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:36:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 41983, "tx_updates": 24765, "rx_keepalives": 29743, "tx_keepalives": 46436}, {"name": "DC-RTR1", "router_id": "4.5.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42171, "tx_updates": 3015, "rx_keepalives": 41392, "tx_keepalives": 15964}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.75 timers 30 180", "clear ip bgp 192.0.2.75"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:07:00Z", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 15, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 1710, "tx_updates": 49515, "rx_keepalives": 10877, "tx_keepalives": 37418}, {"name": "EDGE-RTR1", "router_id": "3.1.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 19238, "tx_updates": 26692, "rx_keepalives": 16139, "tx_keepalives": 4136}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.190"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:09:00Z", "neighbor": "192.0.2.168"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 36985, "tx_updates": 28889, "rx_keepalives": 39677, "tx_keepalives": 20320}, {"name": "BRANCH-RTR1", "router_id": "5.4.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 51, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 20384, "tx_updates": 15607, "rx_keepalives": 17324, "tx_keepalives": 27691}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.168"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:23:00Z", "neighbor": "192.0.2.105"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.105", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 23406, "tx_updates": 17375, "rx_keepalives": 24271, "tx_keepalives": 46091}, {"name": "BRANCH-RTR1", "router_id": "5.3.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.28", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 23369, "tx_updates": 12665, "rx_keepalives": 39077, "tx_keepalives": 19039}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.105 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:57:00Z", "neighbor": "192.0.2.98"}, "devices": [{"name": "CORE-R1", "router_id": "4.1.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 19991, "tx_updates": 36375, "rx_keepalives": 47381, "tx_keepalives": 38632}, {"name": "DC-RTR1", "router_id": "5.2.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42495, "tx_updates": 921, "rx_keepalives": 12494, "tx_keepalives": 5332}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.98 remote-as 65010", "neighbor 192.0.2.98 timers 10 30", "clear ip bgp 192.0.2.98"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:45:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "CORE-R1", "router_id": "5.1.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 43013, "tx_updates": 46197, "rx_keepalives": 18301, "tx_keepalives": 5847}, {"name": "BRANCH-RTR1", "router_id": "1.5.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 40478, "tx_updates": 2822, "rx_keepalives": 19401, "tx_keepalives": 20886}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.81 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:58:00Z", "neighbor": "192.0.2.135"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.135", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 13747, "tx_updates": 41303, "rx_keepalives": 4748, "tx_keepalives": 20948}, {"name": "EDGE-RTR1", "router_id": "5.3.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.3", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 47645, "tx_updates": 11890, "rx_keepalives": 44963, "tx_keepalives": 36861}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.135 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:42:00Z", "neighbor": "192.0.2.185"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.185", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 12761, "tx_updates": 17658, "rx_keepalives": 12749, "tx_keepalives": 29215}, {"name": "EDGE-RTR1", "router_id": "5.4.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 45614, "tx_updates": 20358, "rx_keepalives": 39468, "tx_keepalives": 49877}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.185 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:25:00Z", "neighbor": "192.0.2.41"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 11792, "tx_updates": 17148, "rx_keepalives": 10727, "tx_keepalives": 29536}, {"name": "CORE-R1", "router_id": "3.3.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27244, "tx_updates": 36098, "rx_keepalives": 35346, "tx_keepalives": 183}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.41 update-source Loopback0", "neighbor 192.0.2.41 timers 60 180", "clear ip bgp 192.0.2.41"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:17:00Z", "neighbor": "192.0.2.156"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.5.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.156", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 46888, "tx_updates": 1897, "rx_keepalives": 43732, "tx_keepalives": 30625}, {"name": "CORE-R1", "router_id": "2.1.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.170", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 7955, "tx_updates": 15789, "rx_keepalives": 8007, "tx_keepalives": 13441}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.156 update-source Loopback0", "neighbor 192.0.2.156 timers 60 360", "clear ip bgp 192.0.2.156"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:37:00Z", "neighbor": "192.0.2.123"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 38495, "tx_updates": 22529, "rx_keepalives": 3297, "tx_keepalives": 41848}, {"name": "DC-RTR1", "router_id": "1.2.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 35365, "tx_updates": 44309, "rx_keepalives": 26869, "tx_keepalives": 49850}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.123 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:28:00Z", "neighbor": "192.0.2.26"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 41661, "tx_updates": 40418, "rx_keepalives": 1128, "tx_keepalives": 4038}, {"name": "CORE-R1", "router_id": "4.1.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 33857, "tx_updates": 5079, "rx_keepalives": 3418, "tx_keepalives": 13258}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.26 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:08:00Z", "neighbor": "192.0.2.213"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.213", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 39809, "tx_updates": 35345, "rx_keepalives": 12462, "tx_keepalives": 6435}, {"name": "EDGE-RTR1", "router_id": "1.3.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 2, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 17730, "tx_updates": 30725, "rx_keepalives": 36124, "tx_keepalives": 32974}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.213 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:25:00Z", "neighbor": "192.0.2.110"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.5.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 46828, "tx_updates": 33990, "rx_keepalives": 10467, "tx_keepalives": 36892}, {"name": "EDGE-RTR1", "router_id": "1.1.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 23342, "tx_updates": 5860, "rx_keepalives": 4555, "tx_keepalives": 22816}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:50:00Z", "neighbor": "192.0.2.137"}, "devices": [{"name": "DC-RTR1", "router_id": "3.2.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.137", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 58, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 40866, "tx_updates": 46461, "rx_keepalives": 15377, "tx_keepalives": 21885}, {"name": "EDGE-RTR1", "router_id": "4.5.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.107", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 20477, "tx_updates": 16590, "rx_keepalives": 15146, "tx_keepalives": 10890}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.137 remote-as 65010", "neighbor 192.0.2.137 timers 10 60", "clear ip bgp 192.0.2.137"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:35:00Z", "neighbor": "192.0.2.217"}, "devices": [{"name": "CORE-R1", "router_id": "3.3.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 57, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 20966, "tx_updates": 27131, "rx_keepalives": 12795, "tx_keepalives": 23870}, {"name": "DC-RTR1", "router_id": "4.1.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 36, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 14020, "tx_updates": 16392, "rx_keepalives": 49842, "tx_keepalives": 12282}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.217"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:39:00Z", "neighbor": "192.0.2.53"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.53", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 14, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 25285, "tx_updates": 11863, "rx_keepalives": 36044, "tx_keepalives": 5534}, {"name": "EDGE-RTR1", "router_id": "5.3.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 6232, "tx_updates": 44033, "rx_keepalives": 41530, "tx_keepalives": 42071}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.53"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:21:00Z", "neighbor": "192.0.2.145"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.1.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.145", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 8189, "tx_updates": 11670, "rx_keepalives": 47169, "tx_keepalives": 21531}, {"name": "DC-RTR1", "router_id": "4.5.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 12791, "tx_updates": 20234, "rx_keepalives": 15493, "tx_keepalives": 6547}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.145 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:42:00Z", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 16432, "tx_updates": 39138, "rx_keepalives": 37316, "tx_keepalives": 25347}, {"name": "BRANCH-RTR1", "router_id": "2.5.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 20838, "tx_updates": 32309, "rx_keepalives": 8398, "tx_keepalives": 28831}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.216 update-source Loopback0", "neighbor 192.0.2.216 timers 30 180", "clear ip bgp 192.0.2.216"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:29:00Z", "neighbor": "192.0.2.62"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.4.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 8, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 25988, "tx_updates": 10307, "rx_keepalives": 15207, "tx_keepalives": 3989}, {"name": "BRANCH-RTR1", "router_id": "4.4.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 15150, "tx_updates": 2180, "rx_keepalives": 44798, "tx_keepalives": 6380}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.62 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:46:00Z", "neighbor": "192.0.2.104"}, "devices": [{"name": "DC-RTR1", "router_id": "4.3.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 20361, "tx_updates": 32849, "rx_keepalives": 29762, "tx_keepalives": 36601}, {"name": "EDGE-RTR1", "router_id": "3.1.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.180", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 38339, "tx_updates": 6529, "rx_keepalives": 23637, "tx_keepalives": 41082}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:13:00Z", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 26845, "tx_updates": 49727, "rx_keepalives": 8404, "tx_keepalives": 4009}, {"name": "DC-RTR1", "router_id": "2.1.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 46517, "tx_updates": 26609, "rx_keepalives": 30025, "tx_keepalives": 6491}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.140 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:43:00Z", "neighbor": "192.0.2.49"}, "devices": [{"name": "DC-RTR1", "router_id": "3.3.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 36222, "tx_updates": 7732, "rx_keepalives": 13481, "tx_keepalives": 25437}, {"name": "BRANCH-RTR1", "router_id": "4.1.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 30804, "tx_updates": 17277, "rx_keepalives": 22768, "tx_keepalives": 23348}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.49 shutdown", "neighbor 192.0.2.49 no shutdown", "clear ip bgp 192.0.2.49"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:52:00Z", "neighbor": "192.0.2.6"}, "devices": [{"name": "DC-RTR1", "router_id": "2.4.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.6", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 4425, "tx_updates": 30514, "rx_keepalives": 12525, "tx_keepalives": 24114}, {"name": "BRANCH-RTR1", "router_id": "5.5.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29418, "tx_updates": 42493, "rx_keepalives": 36985, "tx_keepalives": 41500}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.6 timers 60 180", "clear ip bgp 192.0.2.6"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:28:00Z", "neighbor": "192.0.2.147"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 60, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47205, "tx_updates": 35435, "rx_keepalives": 41155, "tx_keepalives": 2324}, {"name": "EDGE-RTR1", "router_id": "1.2.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 29, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 34677, "tx_updates": 41498, "rx_keepalives": 33136, "tx_keepalives": 16948}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.147 shutdown", "neighbor 192.0.2.147 no shutdown", "clear ip bgp 192.0.2.147"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:10:00Z", "neighbor": "192.0.2.198"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.198", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 35, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32711, "tx_updates": 49240, "rx_keepalives": 45203, "tx_keepalives": 19632}, {"name": "BRANCH-RTR1", "router_id": "4.3.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.192", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25690, "tx_updates": 43098, "rx_keepalives": 10807, "tx_keepalives": 26106}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.198 timers 30 180", "clear ip bgp 192.0.2.198"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:36:00Z", "neighbor": "192.0.2.79"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.79", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 57, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 41545, "tx_updates": 7944, "rx_keepalives": 14984, "tx_keepalives": 13513}, {"name": "BRANCH-RTR1", "router_id": "4.4.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 59, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 33552, "tx_updates": 13492, "rx_keepalives": 34042, "tx_keepalives": 43139}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:17:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 41, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 6573, "tx_updates": 12816, "rx_keepalives": 3803, "tx_keepalives": 34050}, {"name": "BRANCH-RTR1", "router_id": "1.3.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.206", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 10977, "tx_updates": 12883, "rx_keepalives": 7343, "tx_keepalives": 40717}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.75 shutdown", "neighbor 192.0.2.75 no shutdown", "clear ip bgp 192.0.2.75"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:25:00Z", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "router_id": "2.4.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 29112, "tx_updates": 41881, "rx_keepalives": 7342, "tx_keepalives": 34240}, {"name": "BRANCH-RTR1", "router_id": "1.2.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 18167, "tx_updates": 30082, "rx_keepalives": 10287, "tx_keepalives": 27178}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.130 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:26:00Z", "neighbor": "192.0.2.118"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 26059, "tx_updates": 38950, "rx_keepalives": 41468, "tx_keepalives": 7641}, {"name": "CORE-R1", "router_id": "2.4.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 19994, "tx_updates": 45756, "rx_keepalives": 39306, "tx_keepalives": 43902}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.118 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:18:00Z", "neighbor": "192.0.2.146"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 13906, "tx_updates": 6719, "rx_keepalives": 23659, "tx_keepalives": 49565}, {"name": "DC-RTR1", "router_id": "5.1.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 26852, "tx_updates": 41693, "rx_keepalives": 35038, "tx_keepalives": 49522}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.146 timers 30 180", "clear ip bgp 192.0.2.146"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:47:00Z", "neighbor": "192.0.2.94"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 34754, "tx_updates": 49829, "rx_keepalives": 23241, "tx_keepalives": 27962}, {"name": "BRANCH-RTR1", "router_id": "4.1.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 46530, "tx_updates": 35431, "rx_keepalives": 25645, "tx_keepalives": 38631}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.94"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:22:00Z", "neighbor": "192.0.2.142"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 11370, "tx_updates": 43024, "rx_keepalives": 45511, "tx_keepalives": 48522}, {"name": "BRANCH-RTR1", "router_id": "1.3.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 19461, "tx_updates": 41234, "rx_keepalives": 9582, "tx_keepalives": 2378}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.142 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:13:00Z", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 38798, "tx_updates": 32638, "rx_keepalives": 9668, "tx_keepalives": 42951}, {"name": "BRANCH-RTR1", "router_id": "2.2.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 7771, "tx_updates": 22958, "rx_keepalives": 33412, "tx_keepalives": 4688}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.109 timers 30 180", "clear ip bgp 192.0.2.109"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:02:00Z", "neighbor": "192.0.2.192"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.192", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 58, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42763, "tx_updates": 12055, "rx_keepalives": 15478, "tx_keepalives": 20276}, {"name": "DC-RTR1", "router_id": "3.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8582, "tx_updates": 19204, "rx_keepalives": 45984, "tx_keepalives": 4167}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.192"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:46:00Z", "neighbor": "192.0.2.25"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44038, "tx_updates": 36036, "rx_keepalives": 7646, "tx_keepalives": 14713}, {"name": "EDGE-RTR1", "router_id": "1.5.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8667, "tx_updates": 15763, "rx_keepalives": 372, "tx_keepalives": 17384}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.25 timers 30 180", "clear ip bgp 192.0.2.25"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:47:00Z", "neighbor": "192.0.2.121"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.2.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9338, "tx_updates": 27329, "rx_keepalives": 45939, "tx_keepalives": 370}, {"name": "DC-RTR1", "router_id": "3.1.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.124", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25484, "tx_updates": 15522, "rx_keepalives": 4471, "tx_keepalives": 40387}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.121 update-source Loopback0", "neighbor 192.0.2.121 timers 60 180", "clear ip bgp 192.0.2.121"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:15:00Z", "neighbor": "192.0.2.62"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.62", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 4697, "tx_updates": 44648, "rx_keepalives": 42371, "tx_keepalives": 15490}, {"name": "EDGE-RTR1", "router_id": "1.4.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.149", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32526, "tx_updates": 30903, "rx_keepalives": 34221, "tx_keepalives": 21658}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.62 timers 60 360", "clear ip bgp 192.0.2.62"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:32:00Z", "neighbor": "192.0.2.50"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 11703, "tx_updates": 27906, "rx_keepalives": 43512, "tx_keepalives": 20037}, {"name": "CORE-R1", "router_id": "2.1.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.246", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 16, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 47651, "tx_updates": 43144, "rx_keepalives": 41264, "tx_keepalives": 39320}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.50 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:15:00Z", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "router_id": "2.5.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.89", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 15853, "tx_updates": 945, "rx_keepalives": 43543, "tx_keepalives": 6814}, {"name": "EDGE-RTR1", "router_id": "2.5.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.78", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 29391, "tx_updates": 18501, "rx_keepalives": 21873, "tx_keepalives": 21197}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "neighbor 192.0.2.89 timers 30 180", "clear ip bgp 192.0.2.89"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:20:00Z", "neighbor": "192.0.2.36"}, "devices": [{"name": "CORE-R1", "router_id": "4.1.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.36", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 4807, "tx_updates": 37687, "rx_keepalives": 28900, "tx_keepalives": 47037}, {"name": "BRANCH-RTR1", "router_id": "4.2.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 28105, "tx_updates": 5044, "rx_keepalives": 22754, "tx_keepalives": 36652}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.36 remote-as 65002", "neighbor 192.0.2.36 timers 30 90", "clear ip bgp 192.0.2.36"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:51:00Z", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "router_id": "2.1.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.39", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 57, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 26220, "tx_updates": 45447, "rx_keepalives": 21670, "tx_keepalives": 20997}, {"name": "BRANCH-RTR1", "router_id": "2.4.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 36550, "tx_updates": 23330, "rx_keepalives": 32384, "tx_keepalives": 24515}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.39"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:34:00Z", "neighbor": "192.0.2.235"}, "devices": [{"name": "DC-RTR1", "router_id": "5.3.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 40161, "tx_updates": 17095, "rx_keepalives": 14732, "tx_keepalives": 28684}, {"name": "CORE-R1", "router_id": "4.2.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 45541, "tx_updates": 14383, "rx_keepalives": 2605, "tx_keepalives": 2484}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.235 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:00:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 11, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 4089, "tx_updates": 11543, "rx_keepalives": 3190, "tx_keepalives": 44496}, {"name": "DC-RTR1", "router_id": "1.3.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.161", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 14, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 8400, "tx_updates": 43663, "rx_keepalives": 42038, "tx_keepalives": 47305}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.75 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:52:00Z", "neighbor": "192.0.2.12"}, "devices": [{"name": "CORE-R1", "router_id": "4.1.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.12", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 49478, "tx_updates": 3257, "rx_keepalives": 29650, "tx_keepalives": 6894}, {"name": "BRANCH-RTR1", "router_id": "5.4.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 19720, "tx_updates": 35822, "rx_keepalives": 42929, "tx_keepalives": 4514}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.12 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:19:00Z", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 55, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 18595, "tx_updates": 24609, "rx_keepalives": 39026, "tx_keepalives": 30068}, {"name": "CORE-R1", "router_id": "4.5.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.141", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24171, "tx_updates": 1630, "rx_keepalives": 25508, "tx_keepalives": 43574}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.20"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:49:00Z", "neighbor": "192.0.2.128"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 52, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 8500, "tx_updates": 14393, "rx_keepalives": 5801, "tx_keepalives": 2737}, {"name": "EDGE-RTR1", "router_id": "5.4.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.133", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 51, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 15137, "tx_updates": 26314, "rx_keepalives": 27225, "tx_keepalives": 30088}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.128 shutdown", "neighbor 192.0.2.128 no shutdown", "clear ip bgp 192.0.2.128"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:45:00Z", "neighbor": "192.0.2.220"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 49, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 36218, "tx_updates": 49531, "rx_keepalives": 35278, "tx_keepalives": 32763}, {"name": "EDGE-RTR1", "router_id": "2.4.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.132", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 41, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 24028, "tx_updates": 3222, "rx_keepalives": 12463, "tx_keepalives": 30483}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.220"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:00:00Z", "neighbor": "192.0.2.197"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.197", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 40034, "tx_updates": 10731, "rx_keepalives": 28966, "tx_keepalives": 22799}, {"name": "EDGE-RTR1", "router_id": "1.1.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 13930, "tx_updates": 5544, "rx_keepalives": 15544, "tx_keepalives": 2091}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.197"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:39:00Z", "neighbor": "192.0.2.121"}, "devices": [{"name": "DC-RTR1", "router_id": "2.3.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 21409, "tx_updates": 16307, "rx_keepalives": 19411, "tx_keepalives": 20191}, {"name": "BRANCH-RTR1", "router_id": "2.3.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.77", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27055, "tx_updates": 39541, "rx_keepalives": 16923, "tx_keepalives": 1326}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.121"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:00:00Z", "neighbor": "192.0.2.111"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9521, "tx_updates": 35362, "rx_keepalives": 21257, "tx_keepalives": 38591}, {"name": "EDGE-RTR1", "router_id": "3.2.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 37761, "tx_updates": 420, "rx_keepalives": 15573, "tx_keepalives": 36493}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "neighbor 192.0.2.111 timers 30 180", "clear ip bgp 192.0.2.111"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:18:00Z", "neighbor": "192.0.2.4"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.4.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.4", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 45334, "tx_updates": 14930, "rx_keepalives": 2753, "tx_keepalives": 12869}, {"name": "CORE-R1", "router_id": "3.2.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 42046, "tx_updates": 41800, "rx_keepalives": 12002, "tx_keepalives": 30056}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.4 remote-as 65100", "neighbor 192.0.2.4 timers 10 60", "clear ip bgp 192.0.2.4"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:56:00Z", "neighbor": "192.0.2.240"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.240", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 39, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 48291, "tx_updates": 19258, "rx_keepalives": 21489, "tx_keepalives": 19421}, {"name": "DC-RTR1", "router_id": "2.1.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.79", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 41, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 40301, "tx_updates": 45222, "rx_keepalives": 16367, "tx_keepalives": 35428}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.240"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:04:00Z", "neighbor": "192.0.2.216"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.1.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9265, "tx_updates": 49175, "rx_keepalives": 5313, "tx_keepalives": 48938}, {"name": "DC-RTR1", "router_id": "3.1.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 10724, "tx_updates": 20900, "rx_keepalives": 15333, "tx_keepalives": 10128}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.216 timers 30 180", "clear ip bgp 192.0.2.216"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:22:00Z", "neighbor": "192.0.2.47"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 60, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 10379, "tx_updates": 16539, "rx_keepalives": 8562, "tx_keepalives": 44626}, {"name": "BRANCH-RTR1", "router_id": "5.5.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 16199, "tx_updates": 49776, "rx_keepalives": 39850, "tx_keepalives": 31597}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:21:00Z", "neighbor": "192.0.2.205"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.2.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 39128, "tx_updates": 7114, "rx_keepalives": 6295, "tx_keepalives": 12412}, {"name": "CORE-R1", "router_id": "5.3.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 18479, "tx_updates": 49597, "rx_keepalives": 14866, "tx_keepalives": 31032}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.205 update-source Loopback0", "neighbor 192.0.2.205 timers 60 180", "clear ip bgp 192.0.2.205"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:26:00Z", "neighbor": "192.0.2.193"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 15738, "tx_updates": 13866, "rx_keepalives": 4089, "tx_keepalives": 2002}, {"name": "DC-RTR1", "router_id": "4.5.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 35098, "tx_updates": 2180, "rx_keepalives": 27102, "tx_keepalives": 41460}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.193 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:59:00Z", "neighbor": "192.0.2.252"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2766, "tx_updates": 42389, "rx_keepalives": 17482, "tx_keepalives": 11525}, {"name": "BRANCH-RTR1", "router_id": "1.2.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 9001, "tx_updates": 42221, "rx_keepalives": 11945, "tx_keepalives": 39348}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.252 update-source Loopback0", "neighbor 192.0.2.252 timers 30 180", "clear ip bgp 192.0.2.252"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:54:00Z", "neighbor": "192.0.2.97"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.97", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 39522, "tx_updates": 3408, "rx_keepalives": 14489, "tx_keepalives": 5044}, {"name": "DC-RTR1", "router_id": "5.4.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 15470, "tx_updates": 20511, "rx_keepalives": 31222, "tx_keepalives": 2802}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.97 timers 60 180", "clear ip bgp 192.0.2.97"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:42:00Z", "neighbor": "192.0.2.15"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27399, "tx_updates": 3758, "rx_keepalives": 36991, "tx_keepalives": 31296}, {"name": "DC-RTR1", "router_id": "1.1.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.192", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21963, "tx_updates": 34986, "rx_keepalives": 5629, "tx_keepalives": 44472}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.15 timers 30 180", "clear ip bgp 192.0.2.15"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:01:00Z", "neighbor": "192.0.2.9"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.4.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.9", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 23530, "tx_updates": 30453, "rx_keepalives": 45494, "tx_keepalives": 6634}, {"name": "DC-RTR1", "router_id": "3.3.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 13159, "tx_updates": 42100, "rx_keepalives": 28652, "tx_keepalives": 33194}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.9"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:04:00Z", "neighbor": "192.0.2.46"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.2.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.46", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 58, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 9595, "tx_updates": 26705, "rx_keepalives": 44414, "tx_keepalives": 37295}, {"name": "DC-RTR1", "router_id": "1.2.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.66", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 22, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 30995, "tx_updates": 18870, "rx_keepalives": 21050, "tx_keepalives": 7228}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.46 shutdown", "neighbor 192.0.2.46 no shutdown", "clear ip bgp 192.0.2.46"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:04:00Z", "neighbor": "192.0.2.171"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.3.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.171", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 34289, "tx_updates": 15971, "rx_keepalives": 10684, "tx_keepalives": 23334}, {"name": "DC-RTR1", "router_id": "2.3.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.145", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 10230, "tx_updates": 45922, "rx_keepalives": 18464, "tx_keepalives": 12208}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.171 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:01:00Z", "neighbor": "192.0.2.150"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.150", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 5971, "tx_updates": 25722, "rx_keepalives": 33704, "tx_keepalives": 5409}, {"name": "CORE-R1", "router_id": "2.5.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.6", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 31859, "tx_updates": 37869, "rx_keepalives": 23502, "tx_keepalives": 42896}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.150 update-source Loopback0", "neighbor 192.0.2.150 timers 30 180", "clear ip bgp 192.0.2.150"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:41:00Z", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 26289, "tx_updates": 9968, "rx_keepalives": 27242, "tx_keepalives": 370}, {"name": "DC-RTR1", "router_id": "3.4.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.81", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 8083, "tx_updates": 31027, "rx_keepalives": 41009, "tx_keepalives": 42417}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.178"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:02:00Z", "neighbor": "192.0.2.71"}, "devices": [{"name": "DC-RTR1", "router_id": "5.1.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.71", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 26126, "tx_updates": 30808, "rx_keepalives": 39936, "tx_keepalives": 9084}, {"name": "BRANCH-RTR1", "router_id": "3.1.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.132", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 55, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 34506, "tx_updates": 2915, "rx_keepalives": 49951, "tx_keepalives": 29021}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.71 remote-as 65001", "neighbor 192.0.2.71 timers 30 180", "clear ip bgp 192.0.2.71"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:36:00Z", "neighbor": "192.0.2.206"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 11373, "tx_updates": 38325, "rx_keepalives": 45501, "tx_keepalives": 16163}, {"name": "BRANCH-RTR1", "router_id": "4.5.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 8196, "tx_updates": 39525, "rx_keepalives": 4789, "tx_keepalives": 15374}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.206"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:45:00Z", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 39304, "tx_updates": 33871, "rx_keepalives": 39794, "tx_keepalives": 31134}, {"name": "BRANCH-RTR1", "router_id": "2.3.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.238", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 31, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 677, "tx_updates": 27884, "rx_keepalives": 48559, "tx_keepalives": 17109}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.189 remote-as 65100", "neighbor 192.0.2.189 timers 10 60", "clear ip bgp 192.0.2.189"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:08:00Z", "neighbor": "192.0.2.69"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.1.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.69", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 55, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 5959, "tx_updates": 18088, "rx_keepalives": 5961, "tx_keepalives": 11239}, {"name": "EDGE-RTR1", "router_id": "1.3.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.46", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 60, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 9671, "tx_updates": 43879, "rx_keepalives": 40653, "tx_keepalives": 3356}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.69 remote-as 65002", "neighbor 192.0.2.69 timers 60 360", "clear ip bgp 192.0.2.69"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:58:00Z", "neighbor": "192.0.2.92"}, "devices": [{"name": "DC-RTR1", "router_id": "5.3.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 18045, "tx_updates": 37217, "rx_keepalives": 21829, "tx_keepalives": 45811}, {"name": "BRANCH-RTR1", "router_id": "2.5.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 22579, "tx_updates": 13813, "rx_keepalives": 41446, "tx_keepalives": 1081}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.92 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:07:00Z", "neighbor": "192.0.2.22"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.5.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.22", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32868, "tx_updates": 26601, "rx_keepalives": 2087, "tx_keepalives": 15321}, {"name": "BRANCH-RTR1", "router_id": "3.3.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.220", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 33351, "tx_updates": 35869, "rx_keepalives": 35899, "tx_keepalives": 29284}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.22 timers 60 180", "clear ip bgp 192.0.2.22"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:15:00Z", "neighbor": "192.0.2.170"}, "devices": [{"name": "CORE-R1", "router_id": "1.3.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.170", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27577, "tx_updates": 33190, "rx_keepalives": 3732, "tx_keepalives": 42509}, {"name": "BRANCH-RTR1", "router_id": "2.1.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 9300, "tx_updates": 9721, "rx_keepalives": 26963, "tx_keepalives": 32579}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.170 update-source Loopback0", "neighbor 192.0.2.170 timers 60 360", "clear ip bgp 192.0.2.170"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:58:00Z", "neighbor": "192.0.2.42"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31169, "tx_updates": 30911, "rx_keepalives": 46260, "tx_keepalives": 42814}, {"name": "EDGE-RTR1", "router_id": "3.3.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 11715, "tx_updates": 49786, "rx_keepalives": 28662, "tx_keepalives": 16758}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.42 update-source Loopback0", "neighbor 192.0.2.42 timers 30 180", "clear ip bgp 192.0.2.42"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:55:00Z", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.113", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 8538, "tx_updates": 31377, "rx_keepalives": 28031, "tx_keepalives": 30365}, {"name": "CORE-R1", "router_id": "2.4.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.123", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 1467, "tx_updates": 43870, "rx_keepalives": 23984, "tx_keepalives": 28503}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.113"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:29:00Z", "neighbor": "192.0.2.205"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44970, "tx_updates": 46966, "rx_keepalives": 40226, "tx_keepalives": 49717}, {"name": "BRANCH-RTR1", "router_id": "3.5.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 16801, "tx_updates": 831, "rx_keepalives": 8365, "tx_keepalives": 48129}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.205 update-source Loopback0", "neighbor 192.0.2.205 timers 30 90", "clear ip bgp 192.0.2.205"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:59:00Z", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 2819, "tx_updates": 42614, "rx_keepalives": 26957, "tx_keepalives": 35837}, {"name": "CORE-R1", "router_id": "2.2.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.126", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 8777, "tx_updates": 6142, "rx_keepalives": 33374, "tx_keepalives": 11443}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.65"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:32:00Z", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 3098, "tx_updates": 37948, "rx_keepalives": 20104, "tx_keepalives": 43587}, {"name": "BRANCH-RTR1", "router_id": "3.3.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 39, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 26172, "tx_updates": 28618, "rx_keepalives": 23202, "tx_keepalives": 34197}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.207 remote-as 65100", "neighbor 192.0.2.207 timers 60 180", "clear ip bgp 192.0.2.207"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:18:00Z", "neighbor": "192.0.2.41"}, "devices": [{"name": "CORE-R1", "router_id": "3.4.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 30, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 7048, "tx_updates": 18385, "rx_keepalives": 14646, "tx_keepalives": 30206}, {"name": "DC-RTR1", "router_id": "5.3.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 34, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 44755, "tx_updates": 28460, "rx_keepalives": 8165, "tx_keepalives": 49374}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.41 remote-as 65100", "neighbor 192.0.2.41 timers 60 180", "clear ip bgp 192.0.2.41"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:46:00Z", "neighbor": "192.0.2.17"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.2.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 12735, "tx_updates": 10431, "rx_keepalives": 43405, "tx_keepalives": 36409}, {"name": "BRANCH-RTR1", "router_id": "3.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 37108, "tx_updates": 30992, "rx_keepalives": 23730, "tx_keepalives": 45479}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.17 timers 30 180", "clear ip bgp 192.0.2.17"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:47:00Z", "neighbor": "192.0.2.85"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 6179, "tx_updates": 8073, "rx_keepalives": 48660, "tx_keepalives": 7993}, {"name": "EDGE-RTR1", "router_id": "5.4.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 22, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 35813, "tx_updates": 38623, "rx_keepalives": 2714, "tx_keepalives": 27122}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.85 remote-as 65100", "neighbor 192.0.2.85 timers 30 180", "clear ip bgp 192.0.2.85"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:23:00Z", "neighbor": "192.0.2.24"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.4.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 60, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 43238, "tx_updates": 37354, "rx_keepalives": 15438, "tx_keepalives": 27396}, {"name": "BRANCH-RTR1", "router_id": "2.4.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 55, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 5186, "tx_updates": 38152, "rx_keepalives": 40840, "tx_keepalives": 9128}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.24 shutdown", "neighbor 192.0.2.24 no shutdown", "clear ip bgp 192.0.2.24"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:40:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.75", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 41362, "tx_updates": 41879, "rx_keepalives": 25839, "tx_keepalives": 17500}, {"name": "BRANCH-RTR1", "router_id": "5.2.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 21055, "tx_updates": 47218, "rx_keepalives": 21952, "tx_keepalives": 14874}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.75 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:18:00Z", "neighbor": "192.0.2.175"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.4.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44156, "tx_updates": 15773, "rx_keepalives": 48444, "tx_keepalives": 2788}, {"name": "CORE-R1", "router_id": "2.2.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 41838, "tx_updates": 18517, "rx_keepalives": 11859, "tx_keepalives": 11957}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.175 update-source Loopback0", "neighbor 192.0.2.175 timers 30 90", "clear ip bgp 192.0.2.175"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:37:00Z", "neighbor": "192.0.2.228"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.4.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 17010, "tx_updates": 8118, "rx_keepalives": 19975, "tx_keepalives": 24643}, {"name": "BRANCH-RTR1", "router_id": "4.4.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.185", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 49428, "tx_updates": 31675, "rx_keepalives": 426, "tx_keepalives": 12301}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.228 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:46:00Z", "neighbor": "192.0.2.44"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.3.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.44", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 18578, "tx_updates": 37739, "rx_keepalives": 29109, "tx_keepalives": 40166}, {"name": "EDGE-RTR1", "router_id": "3.4.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 29379, "tx_updates": 20413, "rx_keepalives": 9071, "tx_keepalives": 14900}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.44 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:58:00Z", "neighbor": "192.0.2.188"}, "devices": [{"name": "DC-RTR1", "router_id": "2.2.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.188", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 2, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 5960, "tx_updates": 7785, "rx_keepalives": 13973, "tx_keepalives": 19368}, {"name": "CORE-R1", "router_id": "3.5.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.153", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 3244, "tx_updates": 25133, "rx_keepalives": 15829, "tx_keepalives": 25826}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.188 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:32:00Z", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 40, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 39903, "tx_updates": 4160, "rx_keepalives": 29862, "tx_keepalives": 3786}, {"name": "DC-RTR1", "router_id": "3.4.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.182", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 58, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 13182, "tx_updates": 3847, "rx_keepalives": 34776, "tx_keepalives": 40521}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.89"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:08:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.1.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.81", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 10853, "tx_updates": 34906, "rx_keepalives": 45757, "tx_keepalives": 49347}, {"name": "CORE-R1", "router_id": "4.1.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 35816, "tx_updates": 37594, "rx_keepalives": 19029, "tx_keepalives": 160}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.81 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:34:00Z", "neighbor": "192.0.2.245"}, "devices": [{"name": "CORE-R1", "router_id": "2.1.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 4587, "tx_updates": 42611, "rx_keepalives": 18023, "tx_keepalives": 28169}, {"name": "EDGE-RTR1", "router_id": "3.5.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 22103, "tx_updates": 23593, "rx_keepalives": 6888, "tx_keepalives": 44744}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "neighbor 192.0.2.245 timers 60 360", "clear ip bgp 192.0.2.245"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:43:00Z", "neighbor": "192.0.2.144"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.144", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 29101, "tx_updates": 43785, "rx_keepalives": 25373, "tx_keepalives": 29859}, {"name": "CORE-R1", "router_id": "2.3.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.177", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 6, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 39902, "tx_updates": 15497, "rx_keepalives": 49432, "tx_keepalives": 10060}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.144 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:03:00Z", "neighbor": "192.0.2.161"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 3, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 4124, "tx_updates": 9544, "rx_keepalives": 19202, "tx_keepalives": 5548}, {"name": "CORE-R1", "router_id": "1.1.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.171", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 45840, "tx_updates": 37532, "rx_keepalives": 34915, "tx_keepalives": 37266}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.161 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:03:00Z", "neighbor": "192.0.2.9"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.9", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 60, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 42537, "tx_updates": 10518, "rx_keepalives": 37026, "tx_keepalives": 30474}, {"name": "BRANCH-RTR1", "router_id": "1.1.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 47202, "tx_updates": 2829, "rx_keepalives": 40541, "tx_keepalives": 23699}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.9"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:04:00Z", "neighbor": "192.0.2.172"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.1.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.172", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 48, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 17362, "tx_updates": 15159, "rx_keepalives": 18751, "tx_keepalives": 38080}, {"name": "DC-RTR1", "router_id": "3.5.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 44, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 23054, "tx_updates": 34023, "rx_keepalives": 1864, "tx_keepalives": 73}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.172 remote-as 65001", "neighbor 192.0.2.172 timers 10 30", "clear ip bgp 192.0.2.172"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:30:00Z", "neighbor": "192.0.2.121"}, "devices": [{"name": "DC-RTR1", "router_id": "2.4.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 48, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 46292, "tx_updates": 6753, "rx_keepalives": 9409, "tx_keepalives": 29479}, {"name": "EDGE-RTR1", "router_id": "3.3.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 42, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 1652, "tx_updates": 8695, "rx_keepalives": 33150, "tx_keepalives": 49834}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.121"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:02:00Z", "neighbor": "192.0.2.245"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 45, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 33647, "tx_updates": 20574, "rx_keepalives": 34388, "tx_keepalives": 38852}, {"name": "BRANCH-RTR1", "router_id": "4.4.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 41, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29733, "tx_updates": 20826, "rx_keepalives": 32814, "tx_keepalives": 31994}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.245 remote-as 65010", "neighbor 192.0.2.245 timers 10 60", "clear ip bgp 192.0.2.245"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:49:00Z", "neighbor": "192.0.2.253"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.253", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 37181, "tx_updates": 3294, "rx_keepalives": 40160, "tx_keepalives": 23756}, {"name": "DC-RTR1", "router_id": "4.5.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.192", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 28, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 49001, "tx_updates": 30709, "rx_keepalives": 7000, "tx_keepalives": 8074}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.253 shutdown", "neighbor 192.0.2.253 no shutdown", "clear ip bgp 192.0.2.253"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:09:00Z", "neighbor": "192.0.2.142"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.5.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.142", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 38141, "tx_updates": 37228, "rx_keepalives": 34908, "tx_keepalives": 7902}, {"name": "BRANCH-RTR1", "router_id": "4.5.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 34275, "tx_updates": 1909, "rx_keepalives": 37761, "tx_keepalives": 29021}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.142 timers 30 180", "clear ip bgp 192.0.2.142"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:50:00Z", "neighbor": "192.0.2.230"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.230", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 21999, "tx_updates": 40259, "rx_keepalives": 18095, "tx_keepalives": 8173}, {"name": "CORE-R1", "router_id": "4.5.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.106", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 22497, "tx_updates": 748, "rx_keepalives": 17382, "tx_keepalives": 20053}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.230 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:40:00Z", "neighbor": "192.0.2.79"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 44, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 13454, "tx_updates": 16796, "rx_keepalives": 42146, "tx_keepalives": 30995}, {"name": "CORE-R1", "router_id": "3.3.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.117", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 4863, "tx_updates": 16826, "rx_keepalives": 39464, "tx_keepalives": 9043}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.79 remote-as 65100", "neighbor 192.0.2.79 timers 10 30", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:30:00Z", "neighbor": "192.0.2.71"}, "devices": [{"name": "CORE-R1", "router_id": "4.1.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.71", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 33021, "tx_updates": 34562, "rx_keepalives": 13009, "tx_keepalives": 20705}, {"name": "DC-RTR1", "router_id": "5.3.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.103", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44582, "tx_updates": 42031, "rx_keepalives": 23765, "tx_keepalives": 997}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.71 update-source Loopback0", "neighbor 192.0.2.71 timers 60 360", "clear ip bgp 192.0.2.71"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:55:00Z", "neighbor": "192.0.2.141"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.4.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.141", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42288, "tx_updates": 39256, "rx_keepalives": 15452, "tx_keepalives": 49939}, {"name": "EDGE-RTR1", "router_id": "3.2.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.212", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 27639, "tx_updates": 46099, "rx_keepalives": 32781, "tx_keepalives": 11099}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.141 timers 30 180", "clear ip bgp 192.0.2.141"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:48:00Z", "neighbor": "192.0.2.98"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 6890, "tx_updates": 8926, "rx_keepalives": 49862, "tx_keepalives": 29153}, {"name": "EDGE-RTR1", "router_id": "5.3.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 16, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 39618, "tx_updates": 45269, "rx_keepalives": 48482, "tx_keepalives": 35157}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.98 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:38:00Z", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.4.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.3", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 18, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 8558, "tx_updates": 39856, "rx_keepalives": 29286, "tx_keepalives": 46220}, {"name": "BRANCH-RTR1", "router_id": "3.2.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 22888, "tx_updates": 17601, "rx_keepalives": 9052, "tx_keepalives": 12643}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.3"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:49:00Z", "neighbor": "192.0.2.138"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 16, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 20036, "tx_updates": 46819, "rx_keepalives": 45590, "tx_keepalives": 48085}, {"name": "EDGE-RTR1", "router_id": "4.3.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.163", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 2, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 23888, "tx_updates": 33250, "rx_keepalives": 44813, "tx_keepalives": 48841}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.138 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:32:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "CORE-R1", "router_id": "2.2.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.81", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 35, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 27849, "tx_updates": 44230, "rx_keepalives": 1216, "tx_keepalives": 10984}, {"name": "BRANCH-RTR1", "router_id": "3.4.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.177", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 40, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 18503, "tx_updates": 21220, "rx_keepalives": 7197, "tx_keepalives": 39926}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:22:00Z", "neighbor": "192.0.2.171"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 3130, "tx_updates": 41861, "rx_keepalives": 13528, "tx_keepalives": 32481}, {"name": "EDGE-RTR1", "router_id": "3.5.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.166", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 10740, "tx_updates": 13244, "rx_keepalives": 32563, "tx_keepalives": 9197}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.171 timers 30 90", "clear ip bgp 192.0.2.171"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:24:00Z", "neighbor": "192.0.2.15"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.15", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 3563, "tx_updates": 22213, "rx_keepalives": 13378, "tx_keepalives": 3038}, {"name": "BRANCH-RTR1", "router_id": "3.5.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.137", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 30322, "tx_updates": 335, "rx_keepalives": 25872, "tx_keepalives": 2309}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.15 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:52:00Z", "neighbor": "192.0.2.175"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.5.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 30, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 14320, "tx_updates": 20227, "rx_keepalives": 20538, "tx_keepalives": 15927}, {"name": "CORE-R1", "router_id": "3.4.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 48269, "tx_updates": 31750, "rx_keepalives": 42605, "tx_keepalives": 33509}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.175"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:38:00Z", "neighbor": "192.0.2.107"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.107", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 24189, "tx_updates": 10836, "rx_keepalives": 26953, "tx_keepalives": 8686}, {"name": "EDGE-RTR1", "router_id": "4.2.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 30407, "tx_updates": 33454, "rx_keepalives": 38744, "tx_keepalives": 42465}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.107 update-source Loopback0", "neighbor 192.0.2.107 timers 60 360", "clear ip bgp 192.0.2.107"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:03:00Z", "neighbor": "192.0.2.174"}, "devices": [{"name": "DC-RTR1", "router_id": "4.3.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.174", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 4294, "tx_updates": 20351, "rx_keepalives": 2230, "tx_keepalives": 31929}, {"name": "BRANCH-RTR1", "router_id": "2.1.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.177", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 5472, "tx_updates": 49749, "rx_keepalives": 47786, "tx_keepalives": 22997}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.174 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:50:00Z", "neighbor": "192.0.2.120"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.120", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 60, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 39596, "tx_updates": 8962, "rx_keepalives": 25100, "tx_keepalives": 23260}, {"name": "BRANCH-RTR1", "router_id": "5.2.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 33, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 42839, "tx_updates": 39846, "rx_keepalives": 5594, "tx_keepalives": 35167}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.120 shutdown", "neighbor 192.0.2.120 no shutdown", "clear ip bgp 192.0.2.120"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:34:00Z", "neighbor": "192.0.2.164"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.164", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 5, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 12524, "tx_updates": 42709, "rx_keepalives": 39990, "tx_keepalives": 39420}, {"name": "CORE-R1", "router_id": "2.5.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.228", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 41, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 26971, "tx_updates": 48087, "rx_keepalives": 14106, "tx_keepalives": 1834}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.164 shutdown", "neighbor 192.0.2.164 no shutdown", "clear ip bgp 192.0.2.164"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:49:00Z", "neighbor": "192.0.2.20"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 4206, "tx_updates": 20414, "rx_keepalives": 42013, "tx_keepalives": 25732}, {"name": "CORE-R1", "router_id": "1.4.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 16, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 4106, "tx_updates": 2187, "rx_keepalives": 19394, "tx_keepalives": 12521}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.20"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:48:00Z", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.199", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47713, "tx_updates": 38220, "rx_keepalives": 46730, "tx_keepalives": 38105}, {"name": "EDGE-RTR1", "router_id": "3.2.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.6", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 49220, "tx_updates": 49179, "rx_keepalives": 8097, "tx_keepalives": 30472}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.199 update-source Loopback0", "neighbor 192.0.2.199 timers 30 180", "clear ip bgp 192.0.2.199"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:23:00Z", "neighbor": "192.0.2.240"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 44858, "tx_updates": 40113, "rx_keepalives": 23469, "tx_keepalives": 47248}, {"name": "BRANCH-RTR1", "router_id": "1.3.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 19423, "tx_updates": 37332, "rx_keepalives": 47122, "tx_keepalives": 14467}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.240 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:37:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.81", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 53, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 42128, "tx_updates": 10460, "rx_keepalives": 589, "tx_keepalives": 9101}, {"name": "EDGE-RTR1", "router_id": "1.3.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 8, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 18033, "tx_updates": 42896, "rx_keepalives": 49695, "tx_keepalives": 30198}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.81 remote-as 65002", "neighbor 192.0.2.81 timers 30 180", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:15:00Z", "neighbor": "192.0.2.212"}, "devices": [{"name": "DC-RTR1", "router_id": "5.3.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 49919, "tx_updates": 10564, "rx_keepalives": 12840, "tx_keepalives": 49777}, {"name": "CORE-R1", "router_id": "2.3.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.229", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 14528, "tx_updates": 27655, "rx_keepalives": 8907, "tx_keepalives": 25913}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.212 timers 60 360", "clear ip bgp 192.0.2.212"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:03:00Z", "neighbor": "192.0.2.105"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.105", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 60, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 8644, "tx_updates": 48950, "rx_keepalives": 16491, "tx_keepalives": 34131}, {"name": "EDGE-RTR1", "router_id": "1.3.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 37, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 9612, "tx_updates": 39381, "rx_keepalives": 15440, "tx_keepalives": 7938}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.105 shutdown", "neighbor 192.0.2.105 no shutdown", "clear ip bgp 192.0.2.105"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:55:00Z", "neighbor": "192.0.2.10"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.1.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 14645, "tx_updates": 7612, "rx_keepalives": 3193, "tx_keepalives": 9324}, {"name": "EDGE-RTR1", "router_id": "3.1.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 4945, "tx_updates": 48544, "rx_keepalives": 99, "tx_keepalives": 33362}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.10 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:13:00Z", "neighbor": "192.0.2.253"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.253", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 27931, "tx_updates": 41119, "rx_keepalives": 40706, "tx_keepalives": 10377}, {"name": "BRANCH-RTR1", "router_id": "4.3.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.251", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 31612, "tx_updates": 36412, "rx_keepalives": 9774, "tx_keepalives": 30393}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.253"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:42:00Z", "neighbor": "192.0.2.235"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.2.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 58, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 42920, "tx_updates": 40139, "rx_keepalives": 43751, "tx_keepalives": 46325}, {"name": "BRANCH-RTR1", "router_id": "2.1.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.5", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 51, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 234, "tx_updates": 7253, "rx_keepalives": 26020, "tx_keepalives": 14566}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.235"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:30:00Z", "neighbor": "192.0.2.26"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 50, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 25016, "tx_updates": 6363, "rx_keepalives": 19784, "tx_keepalives": 24699}, {"name": "BRANCH-RTR1", "router_id": "3.5.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 35020, "tx_updates": 3680, "rx_keepalives": 31728, "tx_keepalives": 34394}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.26"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:53:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 37332, "tx_updates": 31917, "rx_keepalives": 33248, "tx_keepalives": 42998}, {"name": "CORE-R1", "router_id": "5.3.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.244", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 22225, "tx_updates": 16307, "rx_keepalives": 40127, "tx_keepalives": 27180}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "neighbor 192.0.2.81 timers 30 180", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:31:00Z", "neighbor": "192.0.2.64"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.4.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 31392, "tx_updates": 7842, "rx_keepalives": 32732, "tx_keepalives": 44133}, {"name": "BRANCH-RTR1", "router_id": "3.4.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 46657, "tx_updates": 11956, "rx_keepalives": 31894, "tx_keepalives": 31761}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.64 shutdown", "neighbor 192.0.2.64 no shutdown", "clear ip bgp 192.0.2.64"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:02:00Z", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 44, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 19894, "tx_updates": 41359, "rx_keepalives": 16230, "tx_keepalives": 24995}, {"name": "DC-RTR1", "router_id": "5.5.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 5447, "tx_updates": 34447, "rx_keepalives": 36893, "tx_keepalives": 40311}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.151 remote-as 65100", "neighbor 192.0.2.151 timers 60 180", "clear ip bgp 192.0.2.151"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:05:00Z", "neighbor": "192.0.2.157"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.157", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 27344, "tx_updates": 42093, "rx_keepalives": 6145, "tx_keepalives": 44597}, {"name": "BRANCH-RTR1", "router_id": "4.3.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.164", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 48724, "tx_updates": 37946, "rx_keepalives": 25342, "tx_keepalives": 36213}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.157 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:17:00Z", "neighbor": "192.0.2.111"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.111", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 54, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 40946, "tx_updates": 11140, "rx_keepalives": 37388, "tx_keepalives": 40458}, {"name": "EDGE-RTR1", "router_id": "3.3.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 52, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 43129, "tx_updates": 26589, "rx_keepalives": 39437, "tx_keepalives": 1068}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.111 remote-as 65010", "neighbor 192.0.2.111 timers 60 180", "clear ip bgp 192.0.2.111"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:54:00Z", "neighbor": "192.0.2.134"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.4.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 5994, "tx_updates": 28620, "rx_keepalives": 18955, "tx_keepalives": 36997}, {"name": "EDGE-RTR1", "router_id": "3.2.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 41297, "tx_updates": 41413, "rx_keepalives": 21522, "tx_keepalives": 15292}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.134 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:25:00Z", "neighbor": "192.0.2.204"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.204", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 9114, "tx_updates": 5733, "rx_keepalives": 6055, "tx_keepalives": 3283}, {"name": "CORE-R1", "router_id": "4.2.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44549, "tx_updates": 47817, "rx_keepalives": 1833, "tx_keepalives": 44157}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.204 update-source Loopback0", "neighbor 192.0.2.204 timers 30 180", "clear ip bgp 192.0.2.204"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:30:00Z", "neighbor": "192.0.2.39"}, "devices": [{"name": "DC-RTR1", "router_id": "3.1.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 4459, "tx_updates": 22733, "rx_keepalives": 35452, "tx_keepalives": 49827}, {"name": "CORE-R1", "router_id": "3.5.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.91", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 5, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 9630, "tx_updates": 9594, "rx_keepalives": 15999, "tx_keepalives": 41155}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.39 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:49:00Z", "neighbor": "192.0.2.40"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.5.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.40", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 53, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 49035, "tx_updates": 10779, "rx_keepalives": 221, "tx_keepalives": 44135}, {"name": "DC-RTR1", "router_id": "3.2.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.158", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 28, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 44093, "tx_updates": 2795, "rx_keepalives": 10300, "tx_keepalives": 20723}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.40 remote-as 65002", "neighbor 192.0.2.40 timers 30 180", "clear ip bgp 192.0.2.40"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:45:00Z", "neighbor": "192.0.2.100"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.5.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.100", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47975, "tx_updates": 9045, "rx_keepalives": 41395, "tx_keepalives": 14037}, {"name": "DC-RTR1", "router_id": "4.2.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45276, "tx_updates": 41751, "rx_keepalives": 11673, "tx_keepalives": 47624}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "neighbor 192.0.2.100 timers 30 180", "clear ip bgp 192.0.2.100"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:40:00Z", "neighbor": "192.0.2.30"}, "devices": [{"name": "DC-RTR1", "router_id": "3.4.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 26, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 19194, "tx_updates": 45494, "rx_keepalives": 47499, "tx_keepalives": 27702}, {"name": "CORE-R1", "router_id": "1.1.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 53, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 31261, "tx_updates": 18246, "rx_keepalives": 47694, "tx_keepalives": 18466}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.30"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:17:00Z", "neighbor": "192.0.2.10"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 49174, "tx_updates": 38960, "rx_keepalives": 30431, "tx_keepalives": 36756}, {"name": "DC-RTR1", "router_id": "4.2.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 6848, "tx_updates": 48084, "rx_keepalives": 29888, "tx_keepalives": 41227}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.10"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:53:00Z", "neighbor": "192.0.2.80"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25645, "tx_updates": 28129, "rx_keepalives": 3978, "tx_keepalives": 17388}, {"name": "CORE-R1", "router_id": "5.2.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8967, "tx_updates": 30827, "rx_keepalives": 39795, "tx_keepalives": 13170}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.80 timers 30 180", "clear ip bgp 192.0.2.80"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:40:00Z", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.79", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 23339, "tx_updates": 43379, "rx_keepalives": 9126, "tx_keepalives": 42863}, {"name": "BRANCH-RTR1", "router_id": "4.5.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 40892, "tx_updates": 28912, "rx_keepalives": 45351, "tx_keepalives": 17150}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.79 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:41:00Z", "neighbor": "192.0.2.33"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2523, "tx_updates": 12753, "rx_keepalives": 49659, "tx_keepalives": 13583}, {"name": "DC-RTR1", "router_id": "1.1.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.13", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 39434, "tx_updates": 29550, "rx_keepalives": 16587, "tx_keepalives": 12899}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.33 timers 30 180", "clear ip bgp 192.0.2.33"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:07:00Z", "neighbor": "192.0.2.54"}, "devices": [{"name": "CORE-R1", "router_id": "2.2.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.54", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 43758, "tx_updates": 17491, "rx_keepalives": 27410, "tx_keepalives": 32887}, {"name": "BRANCH-RTR1", "router_id": "5.2.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 16992, "tx_updates": 48770, "rx_keepalives": 4800, "tx_keepalives": 28893}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.54"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:05:00Z", "neighbor": "192.0.2.206"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.1.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.206", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 21996, "tx_updates": 12019, "rx_keepalives": 7888, "tx_keepalives": 7337}, {"name": "CORE-R1", "router_id": "1.1.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.244", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 23411, "tx_updates": 6844, "rx_keepalives": 44496, "tx_keepalives": 45128}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.206 update-source Loopback0", "neighbor 192.0.2.206 timers 60 360", "clear ip bgp 192.0.2.206"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:31:00Z", "neighbor": "192.0.2.152"}, "devices": [{"name": "CORE-R1", "router_id": "2.2.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.152", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 21709, "tx_updates": 22342, "rx_keepalives": 2074, "tx_keepalives": 8012}, {"name": "EDGE-RTR1", "router_id": "1.3.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24532, "tx_updates": 16101, "rx_keepalives": 36823, "tx_keepalives": 22472}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.152 timers 30 180", "clear ip bgp 192.0.2.152"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:15:00Z", "neighbor": "192.0.2.17"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 1212, "tx_updates": 14268, "rx_keepalives": 3334, "tx_keepalives": 23010}, {"name": "BRANCH-RTR1", "router_id": "5.1.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.207", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47184, "tx_updates": 25243, "rx_keepalives": 9994, "tx_keepalives": 25115}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "neighbor 192.0.2.17 timers 60 360", "clear ip bgp 192.0.2.17"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:02:00Z", "neighbor": "192.0.2.37"}, "devices": [{"name": "DC-RTR1", "router_id": "2.3.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 19341, "tx_updates": 43469, "rx_keepalives": 5599, "tx_keepalives": 39006}, {"name": "EDGE-RTR1", "router_id": "5.5.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 57, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 15019, "tx_updates": 12668, "rx_keepalives": 46015, "tx_keepalives": 27787}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.37 remote-as 65100", "neighbor 192.0.2.37 timers 60 360", "clear ip bgp 192.0.2.37"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:58:00Z", "neighbor": "192.0.2.22"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 1504, "tx_updates": 37347, "rx_keepalives": 38608, "tx_keepalives": 31096}, {"name": "CORE-R1", "router_id": "4.3.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 21695, "tx_updates": 12964, "rx_keepalives": 20196, "tx_keepalives": 35602}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.22 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:57:00Z", "neighbor": "192.0.2.235"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2050, "tx_updates": 44620, "rx_keepalives": 39278, "tx_keepalives": 10509}, {"name": "EDGE-RTR1", "router_id": "3.2.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.18", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 15750, "tx_updates": 2590, "rx_keepalives": 17375, "tx_keepalives": 41541}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "neighbor 192.0.2.235 timers 30 180", "clear ip bgp 192.0.2.235"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:29:00Z", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "router_id": "4.3.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 6, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 32471, "tx_updates": 17285, "rx_keepalives": 31338, "tx_keepalives": 23750}, {"name": "EDGE-RTR1", "router_id": "5.5.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 44700, "tx_updates": 26984, "rx_keepalives": 36354, "tx_keepalives": 2260}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.35 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:30:00Z", "neighbor": "192.0.2.169"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.169", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 29, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 12952, "tx_updates": 7571, "rx_keepalives": 16754, "tx_keepalives": 29567}, {"name": "DC-RTR1", "router_id": "5.5.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 31, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 22505, "tx_updates": 39327, "rx_keepalives": 24562, "tx_keepalives": 26172}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.169 shutdown", "neighbor 192.0.2.169 no shutdown", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:18:00Z", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.2.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 28, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 46321, "tx_updates": 6727, "rx_keepalives": 28021, "tx_keepalives": 36967}, {"name": "DC-RTR1", "router_id": "5.5.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.169", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 33287, "tx_updates": 40148, "rx_keepalives": 31502, "tx_keepalives": 44021}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.65"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:52:00Z", "neighbor": "192.0.2.124"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.124", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 59, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 46920, "tx_updates": 8750, "rx_keepalives": 42580, "tx_keepalives": 21803}, {"name": "BRANCH-RTR1", "router_id": "4.1.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.153", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 54, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 48625, "tx_updates": 21122, "rx_keepalives": 5413, "tx_keepalives": 45210}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.124"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:33:00Z", "neighbor": "192.0.2.96"}, "devices": [{"name": "DC-RTR1", "router_id": "1.5.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 23705, "tx_updates": 11559, "rx_keepalives": 9791, "tx_keepalives": 19012}, {"name": "BRANCH-RTR1", "router_id": "4.5.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.142", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 49865, "tx_updates": 28949, "rx_keepalives": 47565, "tx_keepalives": 1277}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.96 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:43:00Z", "neighbor": "192.0.2.193"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.193", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 36, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 43842, "tx_updates": 37076, "rx_keepalives": 45383, "tx_keepalives": 22059}, {"name": "CORE-R1", "router_id": "3.4.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 5902, "tx_updates": 35164, "rx_keepalives": 36851, "tx_keepalives": 44061}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.193"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:24:00Z", "neighbor": "192.0.2.49"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.49", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 23336, "tx_updates": 41453, "rx_keepalives": 8478, "tx_keepalives": 43701}, {"name": "CORE-R1", "router_id": "5.1.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 4493, "tx_updates": 24314, "rx_keepalives": 21770, "tx_keepalives": 17959}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.49 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:34:00Z", "neighbor": "192.0.2.5"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.5", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 28095, "tx_updates": 2450, "rx_keepalives": 7908, "tx_keepalives": 44866}, {"name": "BRANCH-RTR1", "router_id": "2.1.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.216", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 42088, "tx_updates": 23025, "rx_keepalives": 1265, "tx_keepalives": 34709}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.5 timers 30 90", "clear ip bgp 192.0.2.5"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:18:00Z", "neighbor": "192.0.2.88"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.5.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.88", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 1943, "tx_updates": 37051, "rx_keepalives": 28708, "tx_keepalives": 12729}, {"name": "EDGE-RTR1", "router_id": "4.1.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 27232, "tx_updates": 47755, "rx_keepalives": 41338, "tx_keepalives": 18560}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.88 timers 60 180", "clear ip bgp 192.0.2.88"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:37:00Z", "neighbor": "192.0.2.224"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.2.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 60, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 3185, "tx_updates": 13298, "rx_keepalives": 28225, "tx_keepalives": 42363}, {"name": "BRANCH-RTR1", "router_id": "4.2.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.227", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 14716, "tx_updates": 42077, "rx_keepalives": 44605, "tx_keepalives": 41699}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.224 remote-as 65001", "neighbor 192.0.2.224 timers 30 90", "clear ip bgp 192.0.2.224"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:26:00Z", "neighbor": "192.0.2.38"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 46007, "tx_updates": 13950, "rx_keepalives": 21, "tx_keepalives": 39892}, {"name": "EDGE-RTR1", "router_id": "2.2.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 23246, "tx_updates": 42931, "rx_keepalives": 39183, "tx_keepalives": 39963}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.38 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:38:00Z", "neighbor": "192.0.2.163"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.163", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 10562, "tx_updates": 43889, "rx_keepalives": 38916, "tx_keepalives": 14469}, {"name": "BRANCH-RTR1", "router_id": "5.5.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 4516, "tx_updates": 28446, "rx_keepalives": 39971, "tx_keepalives": 19777}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.163 timers 60 360", "clear ip bgp 192.0.2.163"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:09:00Z", "neighbor": "192.0.2.145"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 48389, "tx_updates": 18335, "rx_keepalives": 13481, "tx_keepalives": 29988}, {"name": "BRANCH-RTR1", "router_id": "4.3.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.226", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 7555, "tx_updates": 36834, "rx_keepalives": 10162, "tx_keepalives": 31862}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.145 timers 30 180", "clear ip bgp 192.0.2.145"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:45:00Z", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21516, "tx_updates": 38140, "rx_keepalives": 40246, "tx_keepalives": 38480}, {"name": "BRANCH-RTR1", "router_id": "3.4.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.254", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 49289, "tx_updates": 23127, "rx_keepalives": 20719, "tx_keepalives": 13872}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.178 update-source Loopback0", "neighbor 192.0.2.178 timers 30 90", "clear ip bgp 192.0.2.178"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:05:00Z", "neighbor": "192.0.2.82"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.5.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.82", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8094, "tx_updates": 29175, "rx_keepalives": 31565, "tx_keepalives": 35955}, {"name": "CORE-R1", "router_id": "2.4.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.163", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 113, "tx_updates": 31630, "rx_keepalives": 43119, "tx_keepalives": 36758}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.82 timers 30 180", "clear ip bgp 192.0.2.82"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:38:00Z", "neighbor": "192.0.2.41"}, "devices": [{"name": "DC-RTR1", "router_id": "3.5.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 8201, "tx_updates": 5340, "rx_keepalives": 5269, "tx_keepalives": 38882}, {"name": "EDGE-RTR1", "router_id": "5.3.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 29302, "tx_updates": 48342, "rx_keepalives": 35756, "tx_keepalives": 3360}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.41 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:47:00Z", "neighbor": "192.0.2.125"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 35633, "tx_updates": 18560, "rx_keepalives": 6219, "tx_keepalives": 7576}, {"name": "BRANCH-RTR1", "router_id": "5.5.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.223", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 35242, "tx_updates": 44957, "rx_keepalives": 28385, "tx_keepalives": 9292}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.125 timers 30 180", "clear ip bgp 192.0.2.125"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:56:00Z", "neighbor": "192.0.2.115"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.4.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2903, "tx_updates": 2782, "rx_keepalives": 15091, "tx_keepalives": 5927}, {"name": "DC-RTR1", "router_id": "4.2.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.174", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 13048, "tx_updates": 8905, "rx_keepalives": 10665, "tx_keepalives": 16192}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.115 update-source Loopback0", "neighbor 192.0.2.115 timers 60 360", "clear ip bgp 192.0.2.115"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:03:00Z", "neighbor": "192.0.2.152"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.152", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 43687, "tx_updates": 16453, "rx_keepalives": 48076, "tx_keepalives": 46500}, {"name": "DC-RTR1", "router_id": "4.1.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 40347, "tx_updates": 4576, "rx_keepalives": 27404, "tx_keepalives": 31249}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.152 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:50:00Z", "neighbor": "192.0.2.115"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.2.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 37, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 8745, "tx_updates": 7321, "rx_keepalives": 735, "tx_keepalives": 48288}, {"name": "EDGE-RTR1", "router_id": "1.2.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 40, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 33204, "tx_updates": 46074, "rx_keepalives": 49372, "tx_keepalives": 29979}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.115 shutdown", "neighbor 192.0.2.115 no shutdown", "clear ip bgp 192.0.2.115"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:21:00Z", "neighbor": "192.0.2.122"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.2.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24807, "tx_updates": 46552, "rx_keepalives": 17888, "tx_keepalives": 28526}, {"name": "CORE-R1", "router_id": "4.2.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 35, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 13033, "tx_updates": 9266, "rx_keepalives": 39290, "tx_keepalives": 15618}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.122 remote-as 65001", "neighbor 192.0.2.122 timers 30 180", "clear ip bgp 192.0.2.122"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:20:00Z", "neighbor": "192.0.2.96"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.96", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 12098, "tx_updates": 511, "rx_keepalives": 11156, "tx_keepalives": 16992}, {"name": "EDGE-RTR1", "router_id": "3.5.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 8141, "tx_updates": 4767, "rx_keepalives": 40599, "tx_keepalives": 2021}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.96 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:10:00Z", "neighbor": "192.0.2.5"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.2.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.5", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 40, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 47731, "tx_updates": 48807, "rx_keepalives": 15071, "tx_keepalives": 5525}, {"name": "EDGE-RTR1", "router_id": "1.1.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 5241, "tx_updates": 16075, "rx_keepalives": 25419, "tx_keepalives": 29016}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.5"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:31:00Z", "neighbor": "192.0.2.134"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 47698, "tx_updates": 35269, "rx_keepalives": 9244, "tx_keepalives": 38285}, {"name": "EDGE-RTR1", "router_id": "4.4.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.66", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 19100, "tx_updates": 17818, "rx_keepalives": 31662, "tx_keepalives": 28730}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.134 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:46:00Z", "neighbor": "192.0.2.129"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.4.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 4521, "tx_updates": 48964, "rx_keepalives": 42061, "tx_keepalives": 38929}, {"name": "DC-RTR1", "router_id": "1.2.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.195", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 20, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 26177, "tx_updates": 48774, "rx_keepalives": 43204, "tx_keepalives": 18338}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.129 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:16:00Z", "neighbor": "192.0.2.112"}, "devices": [{"name": "DC-RTR1", "router_id": "1.3.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 40473, "tx_updates": 1746, "rx_keepalives": 16364, "tx_keepalives": 40091}, {"name": "BRANCH-RTR1", "router_id": "1.2.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.47", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 610, "tx_updates": 46264, "rx_keepalives": 7876, "tx_keepalives": 14452}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.112 timers 30 180", "clear ip bgp 192.0.2.112"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:50:00Z", "neighbor": "192.0.2.11"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.11", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44694, "tx_updates": 331, "rx_keepalives": 47193, "tx_keepalives": 16635}, {"name": "CORE-R1", "router_id": "2.5.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 37109, "tx_updates": 28800, "rx_keepalives": 16361, "tx_keepalives": 18727}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.11 timers 30 180", "clear ip bgp 192.0.2.11"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:21:00Z", "neighbor": "192.0.2.112"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.112", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 26, "tx_updates": 20549, "rx_keepalives": 22275, "tx_keepalives": 29276}, {"name": "BRANCH-RTR1", "router_id": "5.4.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.141", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29005, "tx_updates": 33819, "rx_keepalives": 43846, "tx_keepalives": 11514}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.112 timers 30 180", "clear ip bgp 192.0.2.112"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:51:00Z", "neighbor": "192.0.2.239"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.239", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8070, "tx_updates": 47367, "rx_keepalives": 42816, "tx_keepalives": 35239}, {"name": "CORE-R1", "router_id": "3.5.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42762, "tx_updates": 13653, "rx_keepalives": 24291, "tx_keepalives": 13984}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.239 update-source Loopback0", "neighbor 192.0.2.239 timers 30 180", "clear ip bgp 192.0.2.239"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:27:00Z", "neighbor": "192.0.2.196"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 22447, "tx_updates": 41754, "rx_keepalives": 22090, "tx_keepalives": 33347}, {"name": "DC-RTR1", "router_id": "4.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.101", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 53, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 4715, "tx_updates": 10492, "rx_keepalives": 19683, "tx_keepalives": 8464}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.196 remote-as 65001", "neighbor 192.0.2.196 timers 10 60", "clear ip bgp 192.0.2.196"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:53:00Z", "neighbor": "192.0.2.127"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27012, "tx_updates": 33255, "rx_keepalives": 8410, "tx_keepalives": 47308}, {"name": "CORE-R1", "router_id": "4.2.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 23011, "tx_updates": 43122, "rx_keepalives": 1440, "tx_keepalives": 47964}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.127 timers 30 180", "clear ip bgp 192.0.2.127"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:05:00Z", "neighbor": "192.0.2.23"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 21890, "tx_updates": 36258, "rx_keepalives": 48344, "tx_keepalives": 20371}, {"name": "CORE-R1", "router_id": "1.5.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 36816, "tx_updates": 401, "rx_keepalives": 13638, "tx_keepalives": 1694}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.23 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:56:00Z", "neighbor": "192.0.2.177"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.3.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.177", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 25, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 14233, "tx_updates": 45998, "rx_keepalives": 2203, "tx_keepalives": 15299}, {"name": "DC-RTR1", "router_id": "2.1.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 49, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 36259, "tx_updates": 35382, "rx_keepalives": 29212, "tx_keepalives": 4479}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.177 shutdown", "neighbor 192.0.2.177 no shutdown", "clear ip bgp 192.0.2.177"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:54:00Z", "neighbor": "192.0.2.218"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.218", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 34970, "tx_updates": 798, "rx_keepalives": 7767, "tx_keepalives": 36607}, {"name": "BRANCH-RTR1", "router_id": "2.4.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.221", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 56, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 36222, "tx_updates": 45194, "rx_keepalives": 33803, "tx_keepalives": 16543}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.218 remote-as 65001", "neighbor 192.0.2.218 timers 10 30", "clear ip bgp 192.0.2.218"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:47:00Z", "neighbor": "192.0.2.22"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 22154, "tx_updates": 44867, "rx_keepalives": 2965, "tx_keepalives": 43299}, {"name": "BRANCH-RTR1", "router_id": "1.4.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 15, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 43601, "tx_updates": 24906, "rx_keepalives": 24053, "tx_keepalives": 44351}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.22 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:06:00Z", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "router_id": "1.3.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 27, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 18480, "tx_updates": 27464, "rx_keepalives": 29722, "tx_keepalives": 6042}, {"name": "DC-RTR1", "router_id": "5.3.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 49489, "tx_updates": 43945, "rx_keepalives": 34634, "tx_keepalives": 35254}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.216"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:15:00Z", "neighbor": "192.0.2.148"}, "devices": [{"name": "CORE-R1", "router_id": "1.3.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.148", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 5737, "tx_updates": 38811, "rx_keepalives": 1937, "tx_keepalives": 48118}, {"name": "BRANCH-RTR1", "router_id": "4.3.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 15, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 12636, "tx_updates": 23250, "rx_keepalives": 17355, "tx_keepalives": 1822}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.148"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:34:00Z", "neighbor": "192.0.2.187"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 56, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 993, "tx_updates": 46775, "rx_keepalives": 29352, "tx_keepalives": 36309}, {"name": "CORE-R1", "router_id": "3.2.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 34, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 31652, "tx_updates": 28480, "rx_keepalives": 3241, "tx_keepalives": 25931}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.187 remote-as 65010", "neighbor 192.0.2.187 timers 60 180", "clear ip bgp 192.0.2.187"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:56:00Z", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.185", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 24350, "tx_updates": 6245, "rx_keepalives": 9892, "tx_keepalives": 34506}, {"name": "DC-RTR1", "router_id": "3.4.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 30161, "tx_updates": 219, "rx_keepalives": 49943, "tx_keepalives": 24186}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.185"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:39:00Z", "neighbor": "192.0.2.201"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.1.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 18062, "tx_updates": 18833, "rx_keepalives": 3319, "tx_keepalives": 27547}, {"name": "DC-RTR1", "router_id": "1.1.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.41", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 18593, "tx_updates": 11154, "rx_keepalives": 13810, "tx_keepalives": 46436}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.201 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:23:00Z", "neighbor": "192.0.2.25"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.4.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 16929, "tx_updates": 37391, "rx_keepalives": 40288, "tx_keepalives": 35786}, {"name": "DC-RTR1", "router_id": "2.2.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.112", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 1097, "tx_updates": 26366, "rx_keepalives": 30736, "tx_keepalives": 8616}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.25 remote-as 65002", "neighbor 192.0.2.25 timers 10 60", "clear ip bgp 192.0.2.25"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:30:00Z", "neighbor": "192.0.2.84"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 49644, "tx_updates": 42547, "rx_keepalives": 49044, "tx_keepalives": 29965}, {"name": "CORE-R1", "router_id": "1.2.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.253", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8606, "tx_updates": 25546, "rx_keepalives": 42984, "tx_keepalives": 27090}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "neighbor 192.0.2.84 timers 60 360", "clear ip bgp 192.0.2.84"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:18:00Z", "neighbor": "192.0.2.150"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.150", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 40427, "tx_updates": 10524, "rx_keepalives": 37079, "tx_keepalives": 34794}, {"name": "BRANCH-RTR1", "router_id": "3.5.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 15065, "tx_updates": 9488, "rx_keepalives": 33447, "tx_keepalives": 35450}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.150 timers 60 180", "clear ip bgp 192.0.2.150"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:44:00Z", "neighbor": "192.0.2.226"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 16729, "tx_updates": 37247, "rx_keepalives": 15036, "tx_keepalives": 6367}, {"name": "BRANCH-RTR1", "router_id": "2.3.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.226", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 12338, "tx_updates": 35841, "rx_keepalives": 44044, "tx_keepalives": 43933}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.226 update-source Loopback0", "neighbor 192.0.2.226 timers 60 360", "clear ip bgp 192.0.2.226"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:05:00Z", "neighbor": "192.0.2.10"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24429, "tx_updates": 45155, "rx_keepalives": 16611, "tx_keepalives": 15496}, {"name": "BRANCH-RTR1", "router_id": "1.4.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 49539, "tx_updates": 14115, "rx_keepalives": 2968, "tx_keepalives": 44846}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.10 update-source Loopback0", "neighbor 192.0.2.10 timers 60 180", "clear ip bgp 192.0.2.10"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:06:00Z", "neighbor": "192.0.2.128"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21502, "tx_updates": 12934, "rx_keepalives": 42114, "tx_keepalives": 45534}, {"name": "CORE-R1", "router_id": "3.1.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 957, "tx_updates": 19969, "rx_keepalives": 36537, "tx_keepalives": 9256}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.128 timers 30 90", "clear ip bgp 192.0.2.128"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:27:00Z", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 15450, "tx_updates": 47439, "rx_keepalives": 10898, "tx_keepalives": 23460}, {"name": "EDGE-RTR1", "router_id": "1.4.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.194", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 12284, "tx_updates": 21949, "rx_keepalives": 49130, "tx_keepalives": 26375}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.247 remote-as 65002", "neighbor 192.0.2.247 timers 60 180", "clear ip bgp 192.0.2.247"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:04:00Z", "neighbor": "192.0.2.32"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41921, "tx_updates": 3812, "rx_keepalives": 44412, "tx_keepalives": 9300}, {"name": "EDGE-RTR1", "router_id": "4.1.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 30660, "tx_updates": 9533, "rx_keepalives": 1479, "tx_keepalives": 22351}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.32 update-source Loopback0", "neighbor 192.0.2.32 timers 30 180", "clear ip bgp 192.0.2.32"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:28:00Z", "neighbor": "192.0.2.237"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 33114, "tx_updates": 34779, "rx_keepalives": 38956, "tx_keepalives": 14361}, {"name": "CORE-R1", "router_id": "5.4.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.153", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 57, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 24225, "tx_updates": 21579, "rx_keepalives": 7633, "tx_keepalives": 26299}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.237"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:34:00Z", "neighbor": "192.0.2.10"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24612, "tx_updates": 36196, "rx_keepalives": 41318, "tx_keepalives": 38046}, {"name": "DC-RTR1", "router_id": "1.4.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 55, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 3213, "tx_updates": 2721, "rx_keepalives": 8208, "tx_keepalives": 25921}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.10 shutdown", "neighbor 192.0.2.10 no shutdown", "clear ip bgp 192.0.2.10"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:46:00Z", "neighbor": "192.0.2.199"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.199", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 1201, "tx_updates": 46942, "rx_keepalives": 9224, "tx_keepalives": 26435}, {"name": "EDGE-RTR1", "router_id": "2.3.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.74", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 41913, "tx_updates": 47014, "rx_keepalives": 45370, "tx_keepalives": 48729}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.199 update-source Loopback0", "neighbor 192.0.2.199 timers 30 90", "clear ip bgp 192.0.2.199"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:32:00Z", "neighbor": "192.0.2.107"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 39010, "tx_updates": 14256, "rx_keepalives": 45803, "tx_keepalives": 19144}, {"name": "CORE-R1", "router_id": "1.5.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 1238, "tx_updates": 9122, "rx_keepalives": 37318, "tx_keepalives": 35188}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.107 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:57:00Z", "neighbor": "192.0.2.45"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.3.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 38947, "tx_updates": 40367, "rx_keepalives": 4290, "tx_keepalives": 1091}, {"name": "CORE-R1", "router_id": "1.4.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.195", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 1936, "tx_updates": 47089, "rx_keepalives": 36424, "tx_keepalives": 44867}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.45 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:02:00Z", "neighbor": "192.0.2.100"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.4.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.100", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 28152, "tx_updates": 9187, "rx_keepalives": 26952, "tx_keepalives": 35381}, {"name": "DC-RTR1", "router_id": "5.4.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.90", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 44116, "tx_updates": 42441, "rx_keepalives": 4519, "tx_keepalives": 46949}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.100"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:54:00Z", "neighbor": "192.0.2.96"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 11527, "tx_updates": 36044, "rx_keepalives": 26183, "tx_keepalives": 35838}, {"name": "DC-RTR1", "router_id": "2.1.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.40", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 37335, "tx_updates": 29525, "rx_keepalives": 14165, "tx_keepalives": 37591}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.96 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:27:00Z", "neighbor": "192.0.2.93"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.93", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 26093, "tx_updates": 11087, "rx_keepalives": 14223, "tx_keepalives": 20549}, {"name": "DC-RTR1", "router_id": "1.5.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 11884, "tx_updates": 42910, "rx_keepalives": 9737, "tx_keepalives": 1569}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.93 timers 30 180", "clear ip bgp 192.0.2.93"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:03:00Z", "neighbor": "192.0.2.224"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 21686, "tx_updates": 9207, "rx_keepalives": 16021, "tx_keepalives": 1986}, {"name": "CORE-R1", "router_id": "5.2.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 35875, "tx_updates": 48140, "rx_keepalives": 45551, "tx_keepalives": 24892}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.224"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:48:00Z", "neighbor": "192.0.2.220"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.220", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 42534, "tx_updates": 43265, "rx_keepalives": 21630, "tx_keepalives": 18394}, {"name": "DC-RTR1", "router_id": "1.3.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.187", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 13619, "tx_updates": 26315, "rx_keepalives": 4819, "tx_keepalives": 24779}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.220 timers 30 180", "clear ip bgp 192.0.2.220"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:54:00Z", "neighbor": "192.0.2.115"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.4.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 10024, "tx_updates": 25580, "rx_keepalives": 32981, "tx_keepalives": 8056}, {"name": "CORE-R1", "router_id": "4.3.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 16716, "tx_updates": 26551, "rx_keepalives": 48155, "tx_keepalives": 33382}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.115 timers 30 180", "clear ip bgp 192.0.2.115"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:08:00Z", "neighbor": "192.0.2.104"}, "devices": [{"name": "DC-RTR1", "router_id": "3.5.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 47750, "tx_updates": 30352, "rx_keepalives": 350, "tx_keepalives": 1317}, {"name": "CORE-R1", "router_id": "3.4.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 29742, "tx_updates": 48835, "rx_keepalives": 49864, "tx_keepalives": 46779}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:34:00Z", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.122", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 30336, "tx_updates": 15088, "rx_keepalives": 40255, "tx_keepalives": 48028}, {"name": "EDGE-RTR1", "router_id": "4.3.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.147", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 13031, "tx_updates": 46168, "rx_keepalives": 30003, "tx_keepalives": 37552}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.122 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:36:00Z", "neighbor": "192.0.2.14"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 42034, "tx_updates": 19426, "rx_keepalives": 3820, "tx_keepalives": 21922}, {"name": "EDGE-RTR1", "router_id": "3.2.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 36841, "tx_updates": 36514, "rx_keepalives": 18331, "tx_keepalives": 40365}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.14 timers 30 90", "clear ip bgp 192.0.2.14"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:03:00Z", "neighbor": "192.0.2.88"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.88", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 44405, "tx_updates": 47427, "rx_keepalives": 4982, "tx_keepalives": 1335}, {"name": "DC-RTR1", "router_id": "2.4.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 15, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 45114, "tx_updates": 1945, "rx_keepalives": 1860, "tx_keepalives": 20640}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.88 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:49:00Z", "neighbor": "192.0.2.209"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.209", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 18853, "tx_updates": 29622, "rx_keepalives": 22581, "tx_keepalives": 37611}, {"name": "BRANCH-RTR1", "router_id": "2.2.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.143", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 34713, "tx_updates": 15741, "rx_keepalives": 14320, "tx_keepalives": 24569}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.209"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:50:00Z", "neighbor": "192.0.2.41"}, "devices": [{"name": "DC-RTR1", "router_id": "1.3.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 4427, "tx_updates": 11791, "rx_keepalives": 17965, "tx_keepalives": 15758}, {"name": "EDGE-RTR1", "router_id": "5.5.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 28401, "tx_updates": 7146, "rx_keepalives": 41433, "tx_keepalives": 43746}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.41 update-source Loopback0", "neighbor 192.0.2.41 timers 60 180", "clear ip bgp 192.0.2.41"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:43:00Z", "neighbor": "192.0.2.190"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.3.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.190", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 18398, "tx_updates": 49504, "rx_keepalives": 27057, "tx_keepalives": 17115}, {"name": "CORE-R1", "router_id": "5.1.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.56", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21281, "tx_updates": 1482, "rx_keepalives": 39839, "tx_keepalives": 18410}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.190 timers 60 360", "clear ip bgp 192.0.2.190"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:43:00Z", "neighbor": "192.0.2.166"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 32, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 6326, "tx_updates": 49436, "rx_keepalives": 15198, "tx_keepalives": 803}, {"name": "DC-RTR1", "router_id": "2.2.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 52, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 28255, "tx_updates": 12994, "rx_keepalives": 441, "tx_keepalives": 4876}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.166 remote-as 65001", "neighbor 192.0.2.166 timers 60 360", "clear ip bgp 192.0.2.166"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:03:00Z", "neighbor": "192.0.2.218"}, "devices": [{"name": "CORE-R1", "router_id": "4.3.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.218", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 24707, "tx_updates": 9038, "rx_keepalives": 44456, "tx_keepalives": 30793}, {"name": "EDGE-RTR1", "router_id": "4.2.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.2", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43474, "tx_updates": 26940, "rx_keepalives": 37902, "tx_keepalives": 1840}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.218 timers 30 180", "clear ip bgp 192.0.2.218"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:42:00Z", "neighbor": "192.0.2.148"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.5.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 50, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 16945, "tx_updates": 35769, "rx_keepalives": 6685, "tx_keepalives": 41224}, {"name": "BRANCH-RTR1", "router_id": "3.5.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 41326, "tx_updates": 15472, "rx_keepalives": 21465, "tx_keepalives": 17035}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.148"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:24:00Z", "neighbor": "192.0.2.115"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24461, "tx_updates": 19150, "rx_keepalives": 42027, "tx_keepalives": 35864}, {"name": "EDGE-RTR1", "router_id": "4.2.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.109", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 36, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 7627, "tx_updates": 18927, "rx_keepalives": 4635, "tx_keepalives": 9272}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.115 shutdown", "neighbor 192.0.2.115 no shutdown", "clear ip bgp 192.0.2.115"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:20:00Z", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "router_id": "2.4.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 39349, "tx_updates": 16676, "rx_keepalives": 23456, "tx_keepalives": 33117}, {"name": "EDGE-RTR1", "router_id": "2.5.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 46062, "tx_updates": 5759, "rx_keepalives": 9727, "tx_keepalives": 8572}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "neighbor 192.0.2.24 timers 60 180", "clear ip bgp 192.0.2.24"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:24:00Z", "neighbor": "192.0.2.73"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 47523, "tx_updates": 46001, "rx_keepalives": 2023, "tx_keepalives": 14721}, {"name": "CORE-R1", "router_id": "2.5.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.193", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 28960, "tx_updates": 15274, "rx_keepalives": 41565, "tx_keepalives": 1299}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.73 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:26:00Z", "neighbor": "192.0.2.14"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.1.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44679, "tx_updates": 49445, "rx_keepalives": 40888, "tx_keepalives": 8482}, {"name": "DC-RTR1", "router_id": "3.1.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 2824, "tx_updates": 16037, "rx_keepalives": 43193, "tx_keepalives": 24978}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.14 shutdown", "neighbor 192.0.2.14 no shutdown", "clear ip bgp 192.0.2.14"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:13:00Z", "neighbor": "192.0.2.2"}, "devices": [{"name": "CORE-R1", "router_id": "1.2.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45770, "tx_updates": 13702, "rx_keepalives": 30025, "tx_keepalives": 26846}, {"name": "EDGE-RTR1", "router_id": "5.5.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.53", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 43881, "tx_updates": 28921, "rx_keepalives": 8495, "tx_keepalives": 40655}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.2 update-source Loopback0", "neighbor 192.0.2.2 timers 30 90", "clear ip bgp 192.0.2.2"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:58:00Z", "neighbor": "192.0.2.248"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.248", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 5, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 29940, "tx_updates": 48806, "rx_keepalives": 45864, "tx_keepalives": 4363}, {"name": "BRANCH-RTR1", "router_id": "4.3.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.16", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 40, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 49134, "tx_updates": 47779, "rx_keepalives": 23193, "tx_keepalives": 42377}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.248 remote-as 65002", "neighbor 192.0.2.248 timers 10 30", "clear ip bgp 192.0.2.248"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:28:00Z", "neighbor": "192.0.2.23"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 52, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 21440, "tx_updates": 36616, "rx_keepalives": 29796, "tx_keepalives": 19557}, {"name": "DC-RTR1", "router_id": "3.2.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.201", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 735, "tx_updates": 19998, "rx_keepalives": 7612, "tx_keepalives": 1776}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.23 shutdown", "neighbor 192.0.2.23 no shutdown", "clear ip bgp 192.0.2.23"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:31:00Z", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.2.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 50, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 38469, "tx_updates": 41720, "rx_keepalives": 39148, "tx_keepalives": 26495}, {"name": "DC-RTR1", "router_id": "3.3.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 53, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 46201, "tx_updates": 25065, "rx_keepalives": 21681, "tx_keepalives": 27956}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.178 shutdown", "neighbor 192.0.2.178 no shutdown", "clear ip bgp 192.0.2.178"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:39:00Z", "neighbor": "192.0.2.140"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 66, "tx_updates": 21097, "rx_keepalives": 43894, "tx_keepalives": 28267}, {"name": "EDGE-RTR1", "router_id": "3.2.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 15, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 7552, "tx_updates": 5609, "rx_keepalives": 27194, "tx_keepalives": 21726}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.140 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:16:00Z", "neighbor": "192.0.2.167"}, "devices": [{"name": "DC-RTR1", "router_id": "3.2.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24807, "tx_updates": 22130, "rx_keepalives": 47379, "tx_keepalives": 20254}, {"name": "BRANCH-RTR1", "router_id": "2.3.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 2499, "tx_updates": 41172, "rx_keepalives": 27345, "tx_keepalives": 28675}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "neighbor 192.0.2.167 timers 30 180", "clear ip bgp 192.0.2.167"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:04:00Z", "neighbor": "192.0.2.47"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.47", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 40, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 20966, "tx_updates": 45522, "rx_keepalives": 399, "tx_keepalives": 15519}, {"name": "DC-RTR1", "router_id": "4.2.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.111", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42522, "tx_updates": 21777, "rx_keepalives": 11958, "tx_keepalives": 5115}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:13:00Z", "neighbor": "192.0.2.116"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 46674, "tx_updates": 38745, "rx_keepalives": 13232, "tx_keepalives": 2717}, {"name": "EDGE-RTR1", "router_id": "1.4.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 42379, "tx_updates": 30126, "rx_keepalives": 1635, "tx_keepalives": 38479}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.116 timers 60 360", "clear ip bgp 192.0.2.116"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:37:00Z", "neighbor": "192.0.2.195"}, "devices": [{"name": "CORE-R1", "router_id": "4.3.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.195", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 39568, "tx_updates": 47726, "rx_keepalives": 23282, "tx_keepalives": 30822}, {"name": "EDGE-RTR1", "router_id": "5.3.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 18299, "tx_updates": 34340, "rx_keepalives": 13241, "tx_keepalives": 24626}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.195 timers 60 360", "clear ip bgp 192.0.2.195"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:59:00Z", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 36849, "tx_updates": 9387, "rx_keepalives": 17453, "tx_keepalives": 30587}, {"name": "BRANCH-RTR1", "router_id": "2.3.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 38952, "tx_updates": 41406, "rx_keepalives": 44472, "tx_keepalives": 12247}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.65 update-source Loopback0", "neighbor 192.0.2.65 timers 30 90", "clear ip bgp 192.0.2.65"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:32:00Z", "neighbor": "192.0.2.155"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.1.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 36264, "tx_updates": 6556, "rx_keepalives": 3017, "tx_keepalives": 48328}, {"name": "CORE-R1", "router_id": "2.5.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 7598, "tx_updates": 11003, "rx_keepalives": 46915, "tx_keepalives": 27483}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.155"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:09:00Z", "neighbor": "192.0.2.232"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.232", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42558, "tx_updates": 39891, "rx_keepalives": 40552, "tx_keepalives": 39247}, {"name": "CORE-R1", "router_id": "3.1.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 31674, "tx_updates": 40490, "rx_keepalives": 9653, "tx_keepalives": 6136}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.232 update-source Loopback0", "neighbor 192.0.2.232 timers 30 180", "clear ip bgp 192.0.2.232"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:47:00Z", "neighbor": "192.0.2.139"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 42369, "tx_updates": 4424, "rx_keepalives": 44424, "tx_keepalives": 22223}, {"name": "DC-RTR1", "router_id": "5.5.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 60, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 43113, "tx_updates": 15441, "rx_keepalives": 20067, "tx_keepalives": 31005}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.139 shutdown", "neighbor 192.0.2.139 no shutdown", "clear ip bgp 192.0.2.139"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:00:00Z", "neighbor": "192.0.2.121"}, "devices": [{"name": "CORE-R1", "router_id": "3.5.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 38087, "tx_updates": 39672, "rx_keepalives": 2200, "tx_keepalives": 2298}, {"name": "DC-RTR1", "router_id": "2.4.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 22046, "tx_updates": 3978, "rx_keepalives": 49574, "tx_keepalives": 16224}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.121 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:01:00Z", "neighbor": "192.0.2.119"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 49689, "tx_updates": 21489, "rx_keepalives": 26085, "tx_keepalives": 34851}, {"name": "CORE-R1", "router_id": "2.1.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 5405, "tx_updates": 16378, "rx_keepalives": 22850, "tx_keepalives": 13546}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.119 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:54:00Z", "neighbor": "192.0.2.98"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.2.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 175, "tx_updates": 37579, "rx_keepalives": 22103, "tx_keepalives": 16601}, {"name": "CORE-R1", "router_id": "4.4.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.139", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32764, "tx_updates": 19761, "rx_keepalives": 14253, "tx_keepalives": 6446}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.98 remote-as 65010", "neighbor 192.0.2.98 timers 30 90", "clear ip bgp 192.0.2.98"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:24:00Z", "neighbor": "192.0.2.118"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 21071, "tx_updates": 37788, "rx_keepalives": 26401, "tx_keepalives": 14177}, {"name": "BRANCH-RTR1", "router_id": "5.5.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.228", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 16514, "tx_updates": 43308, "rx_keepalives": 47121, "tx_keepalives": 21593}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.118 update-source Loopback0", "neighbor 192.0.2.118 timers 60 180", "clear ip bgp 192.0.2.118"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:06:00Z", "neighbor": "192.0.2.1"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.2.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 22952, "tx_updates": 5515, "rx_keepalives": 6203, "tx_keepalives": 31751}, {"name": "EDGE-RTR1", "router_id": "2.2.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.249", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2789, "tx_updates": 27339, "rx_keepalives": 23505, "tx_keepalives": 32583}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.1 update-source Loopback0", "neighbor 192.0.2.1 timers 60 180", "clear ip bgp 192.0.2.1"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:39:00Z", "neighbor": "192.0.2.70"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.4.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 58, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 48696, "tx_updates": 21348, "rx_keepalives": 10834, "tx_keepalives": 28512}, {"name": "BRANCH-RTR1", "router_id": "4.3.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.228", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 42, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32666, "tx_updates": 29981, "rx_keepalives": 4921, "tx_keepalives": 42935}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.70 shutdown", "neighbor 192.0.2.70 no shutdown", "clear ip bgp 192.0.2.70"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:16:00Z", "neighbor": "192.0.2.17"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.2.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 5363, "tx_updates": 43144, "rx_keepalives": 31731, "tx_keepalives": 39670}, {"name": "CORE-R1", "router_id": "5.5.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 4129, "tx_updates": 38339, "rx_keepalives": 7054, "tx_keepalives": 20394}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.17 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:15:00Z", "neighbor": "192.0.2.190"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.190", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 51, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 34240, "tx_updates": 37356, "rx_keepalives": 36897, "tx_keepalives": 38389}, {"name": "CORE-R1", "router_id": "1.5.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 30494, "tx_updates": 21936, "rx_keepalives": 49583, "tx_keepalives": 38101}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.190 remote-as 65010", "neighbor 192.0.2.190 timers 10 30", "clear ip bgp 192.0.2.190"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:25:00Z", "neighbor": "192.0.2.161"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.4.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 35750, "tx_updates": 15066, "rx_keepalives": 30328, "tx_keepalives": 20328}, {"name": "BRANCH-RTR1", "router_id": "2.4.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 17428, "tx_updates": 26942, "rx_keepalives": 21230, "tx_keepalives": 43816}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.161 remote-as 65010", "neighbor 192.0.2.161 timers 30 90", "clear ip bgp 192.0.2.161"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:03:00Z", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 16529, "tx_updates": 32267, "rx_keepalives": 17046, "tx_keepalives": 933}, {"name": "BRANCH-RTR1", "router_id": "1.5.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.253", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 1259, "tx_updates": 17503, "rx_keepalives": 29052, "tx_keepalives": 1932}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "neighbor 192.0.2.42 timers 30 180", "clear ip bgp 192.0.2.42"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:11:00Z", "neighbor": "192.0.2.63"}, "devices": [{"name": "CORE-R1", "router_id": "5.1.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 30712, "tx_updates": 23691, "rx_keepalives": 16941, "tx_keepalives": 23848}, {"name": "DC-RTR1", "router_id": "3.2.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 22866, "tx_updates": 33379, "rx_keepalives": 49754, "tx_keepalives": 32855}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.63 timers 30 180", "clear ip bgp 192.0.2.63"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:30:00Z", "neighbor": "192.0.2.201"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.201", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 1668, "tx_updates": 23991, "rx_keepalives": 4606, "tx_keepalives": 39410}, {"name": "CORE-R1", "router_id": "3.4.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 17153, "tx_updates": 32767, "rx_keepalives": 47244, "tx_keepalives": 44241}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.201"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:24:00Z", "neighbor": "192.0.2.30"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 23078, "tx_updates": 11191, "rx_keepalives": 12329, "tx_keepalives": 46666}, {"name": "BRANCH-RTR1", "router_id": "2.1.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 25582, "tx_updates": 17355, "rx_keepalives": 28037, "tx_keepalives": 838}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.30 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:33:00Z", "neighbor": "192.0.2.4"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 36, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 17848, "tx_updates": 35585, "rx_keepalives": 20895, "tx_keepalives": 42712}, {"name": "CORE-R1", "router_id": "4.3.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.157", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 54, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 17601, "tx_updates": 26847, "rx_keepalives": 20532, "tx_keepalives": 27513}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.4"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:25:00Z", "neighbor": "192.0.2.138"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 42057, "tx_updates": 28283, "rx_keepalives": 30862, "tx_keepalives": 32361}, {"name": "DC-RTR1", "router_id": "3.1.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.49", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 12189, "tx_updates": 16974, "rx_keepalives": 48518, "tx_keepalives": 38236}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.138 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:02:00Z", "neighbor": "192.0.2.191"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.191", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 42805, "tx_updates": 42307, "rx_keepalives": 24048, "tx_keepalives": 9563}, {"name": "CORE-R1", "router_id": "5.5.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 17948, "tx_updates": 47067, "rx_keepalives": 37479, "tx_keepalives": 43113}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.191 timers 30 180", "clear ip bgp 192.0.2.191"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:38:00Z", "neighbor": "192.0.2.85"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 10130, "tx_updates": 32814, "rx_keepalives": 6683, "tx_keepalives": 2320}, {"name": "CORE-R1", "router_id": "5.3.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.184", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 9582, "tx_updates": 39639, "rx_keepalives": 28304, "tx_keepalives": 18078}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.85"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:54:00Z", "neighbor": "192.0.2.80"}, "devices": [{"name": "DC-RTR1", "router_id": "4.5.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 1645, "tx_updates": 37756, "rx_keepalives": 47443, "tx_keepalives": 2380}, {"name": "BRANCH-RTR1", "router_id": "4.2.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 23509, "tx_updates": 12330, "rx_keepalives": 16185, "tx_keepalives": 47113}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.80"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:14:00Z", "neighbor": "192.0.2.124"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.124", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 36253, "tx_updates": 5621, "rx_keepalives": 42139, "tx_keepalives": 19023}, {"name": "CORE-R1", "router_id": "4.3.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29704, "tx_updates": 21501, "rx_keepalives": 5571, "tx_keepalives": 1339}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.124 timers 30 180", "clear ip bgp 192.0.2.124"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:28:00Z", "neighbor": "192.0.2.54"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.54", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27528, "tx_updates": 17363, "rx_keepalives": 13905, "tx_keepalives": 31362}, {"name": "EDGE-RTR1", "router_id": "2.3.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 45160, "tx_updates": 4269, "rx_keepalives": 31631, "tx_keepalives": 28687}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.54 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:24:00Z", "neighbor": "192.0.2.129"}, "devices": [{"name": "CORE-R1", "router_id": "2.2.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 34655, "tx_updates": 16924, "rx_keepalives": 9298, "tx_keepalives": 30704}, {"name": "EDGE-RTR1", "router_id": "4.4.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 3, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 21336, "tx_updates": 40519, "rx_keepalives": 36063, "tx_keepalives": 49928}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.129"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:07:00Z", "neighbor": "192.0.2.74"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.2.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 51, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 22862, "tx_updates": 24566, "rx_keepalives": 11708, "tx_keepalives": 1408}, {"name": "EDGE-RTR1", "router_id": "4.3.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 56, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 16427, "tx_updates": 6687, "rx_keepalives": 986, "tx_keepalives": 18405}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.74"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:08:00Z", "neighbor": "192.0.2.114"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 38354, "tx_updates": 8913, "rx_keepalives": 7025, "tx_keepalives": 41754}, {"name": "CORE-R1", "router_id": "5.2.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.13", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 14214, "tx_updates": 37241, "rx_keepalives": 46287, "tx_keepalives": 49026}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.114"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:18:00Z", "neighbor": "192.0.2.168"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 20520, "tx_updates": 27142, "rx_keepalives": 44855, "tx_keepalives": 29035}, {"name": "BRANCH-RTR1", "router_id": "4.3.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 34, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 249, "tx_updates": 19027, "rx_keepalives": 3425, "tx_keepalives": 6646}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.168"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:36:00Z", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.185", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 17, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 8539, "tx_updates": 15186, "rx_keepalives": 36455, "tx_keepalives": 11085}, {"name": "EDGE-RTR1", "router_id": "5.5.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 768, "tx_updates": 22166, "rx_keepalives": 10385, "tx_keepalives": 20604}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.185 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:12:00Z", "neighbor": "192.0.2.237"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.2.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 1188, "tx_updates": 36694, "rx_keepalives": 25590, "tx_keepalives": 3414}, {"name": "DC-RTR1", "router_id": "1.3.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.54", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 47, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 36989, "tx_updates": 12763, "rx_keepalives": 46611, "tx_keepalives": 32544}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.237 remote-as 65002", "neighbor 192.0.2.237 timers 60 360", "clear ip bgp 192.0.2.237"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:58:00Z", "neighbor": "192.0.2.244"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.5.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.244", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 58, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44758, "tx_updates": 17543, "rx_keepalives": 6397, "tx_keepalives": 42805}, {"name": "DC-RTR1", "router_id": "3.1.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.12", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 56, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 39841, "tx_updates": 22855, "rx_keepalives": 29414, "tx_keepalives": 20967}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.244"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:56:00Z", "neighbor": "192.0.2.65"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 41625, "tx_updates": 37304, "rx_keepalives": 13503, "tx_keepalives": 34155}, {"name": "CORE-R1", "router_id": "4.3.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.157", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 5, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 17408, "tx_updates": 46545, "rx_keepalives": 31680, "tx_keepalives": 35285}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.65"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:02:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.75", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 26196, "tx_updates": 44341, "rx_keepalives": 13489, "tx_keepalives": 46502}, {"name": "DC-RTR1", "router_id": "3.1.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25662, "tx_updates": 29220, "rx_keepalives": 30694, "tx_keepalives": 17737}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.75 timers 30 180", "clear ip bgp 192.0.2.75"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:03:00Z", "neighbor": "192.0.2.42"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42537, "tx_updates": 3719, "rx_keepalives": 5313, "tx_keepalives": 35420}, {"name": "EDGE-RTR1", "router_id": "1.1.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.71", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 3557, "tx_updates": 14909, "rx_keepalives": 43885, "tx_keepalives": 31223}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.42 timers 30 180", "clear ip bgp 192.0.2.42"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:05:00Z", "neighbor": "192.0.2.44"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.44", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 7478, "tx_updates": 16514, "rx_keepalives": 7429, "tx_keepalives": 44464}, {"name": "EDGE-RTR1", "router_id": "4.5.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.164", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 4588, "tx_updates": 43025, "rx_keepalives": 36672, "tx_keepalives": 3547}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.44"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:29:00Z", "neighbor": "192.0.2.158"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 49385, "tx_updates": 8624, "rx_keepalives": 26890, "tx_keepalives": 34096}, {"name": "CORE-R1", "router_id": "4.5.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.23", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 45342, "tx_updates": 15658, "rx_keepalives": 27546, "tx_keepalives": 13958}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.158"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:08:00Z", "neighbor": "192.0.2.214"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.214", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 3304, "tx_updates": 33518, "rx_keepalives": 25284, "tx_keepalives": 3354}, {"name": "BRANCH-RTR1", "router_id": "1.1.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 45872, "tx_updates": 21937, "rx_keepalives": 14933, "tx_keepalives": 7896}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.214 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:36:00Z", "neighbor": "192.0.2.119"}, "devices": [{"name": "CORE-R1", "router_id": "4.3.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 23117, "tx_updates": 18756, "rx_keepalives": 574, "tx_keepalives": 34362}, {"name": "DC-RTR1", "router_id": "3.5.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 25085, "tx_updates": 23200, "rx_keepalives": 23236, "tx_keepalives": 11002}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.119 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:06:00Z", "neighbor": "192.0.2.223"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.223", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 32666, "tx_updates": 22125, "rx_keepalives": 11973, "tx_keepalives": 15543}, {"name": "CORE-R1", "router_id": "1.5.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.234", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 35750, "tx_updates": 7051, "rx_keepalives": 35729, "tx_keepalives": 30478}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.223"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:27:00Z", "neighbor": "192.0.2.212"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.212", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47349, "tx_updates": 5436, "rx_keepalives": 33284, "tx_keepalives": 26911}, {"name": "BRANCH-RTR1", "router_id": "4.1.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 4846, "tx_updates": 33895, "rx_keepalives": 26795, "tx_keepalives": 45095}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.212 timers 30 180", "clear ip bgp 192.0.2.212"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:10:00Z", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 23307, "tx_updates": 28157, "rx_keepalives": 8935, "tx_keepalives": 10977}, {"name": "EDGE-RTR1", "router_id": "5.4.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 49, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 9391, "tx_updates": 138, "rx_keepalives": 5525, "tx_keepalives": 43690}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.87 shutdown", "neighbor 192.0.2.87 no shutdown", "clear ip bgp 192.0.2.87"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:50:00Z", "neighbor": "192.0.2.251"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 39745, "tx_updates": 24318, "rx_keepalives": 31508, "tx_keepalives": 6564}, {"name": "EDGE-RTR1", "router_id": "4.5.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 21786, "tx_updates": 18911, "rx_keepalives": 33978, "tx_keepalives": 27263}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.251 timers 30 180", "clear ip bgp 192.0.2.251"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:10:00Z", "neighbor": "192.0.2.8"}, "devices": [{"name": "DC-RTR1", "router_id": "2.3.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.8", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 36986, "tx_updates": 28315, "rx_keepalives": 17020, "tx_keepalives": 17992}, {"name": "BRANCH-RTR1", "router_id": "4.1.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 5351, "tx_updates": 32400, "rx_keepalives": 41722, "tx_keepalives": 48195}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.8 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:30:00Z", "neighbor": "192.0.2.174"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 24176, "tx_updates": 26409, "rx_keepalives": 1931, "tx_keepalives": 23318}, {"name": "CORE-R1", "router_id": "4.5.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 26448, "tx_updates": 46906, "rx_keepalives": 28638, "tx_keepalives": 18557}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.174 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:38:00Z", "neighbor": "192.0.2.134"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 49432, "tx_updates": 30679, "rx_keepalives": 31008, "tx_keepalives": 29273}, {"name": "EDGE-RTR1", "router_id": "5.5.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.241", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 22285, "tx_updates": 49012, "rx_keepalives": 20088, "tx_keepalives": 29046}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.134 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:31:00Z", "neighbor": "192.0.2.244"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.244", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 45, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 23454, "tx_updates": 14113, "rx_keepalives": 33585, "tx_keepalives": 2310}, {"name": "EDGE-RTR1", "router_id": "2.2.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.99", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 24076, "tx_updates": 2885, "rx_keepalives": 19638, "tx_keepalives": 30383}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.244 shutdown", "neighbor 192.0.2.244 no shutdown", "clear ip bgp 192.0.2.244"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:26:00Z", "neighbor": "192.0.2.138"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.5.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41159, "tx_updates": 19786, "rx_keepalives": 3325, "tx_keepalives": 13113}, {"name": "BRANCH-RTR1", "router_id": "3.4.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 43403, "tx_updates": 36846, "rx_keepalives": 30264, "tx_keepalives": 5426}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.138 update-source Loopback0", "neighbor 192.0.2.138 timers 60 180", "clear ip bgp 192.0.2.138"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:36:00Z", "neighbor": "192.0.2.234"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.234", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 17285, "tx_updates": 1524, "rx_keepalives": 11627, "tx_keepalives": 40656}, {"name": "DC-RTR1", "router_id": "3.4.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.66", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 57, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 39965, "tx_updates": 33251, "rx_keepalives": 37016, "tx_keepalives": 33505}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.234 shutdown", "neighbor 192.0.2.234 no shutdown", "clear ip bgp 192.0.2.234"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:52:00Z", "neighbor": "192.0.2.138"}, "devices": [{"name": "DC-RTR1", "router_id": "3.4.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8796, "tx_updates": 33928, "rx_keepalives": 4442, "tx_keepalives": 16285}, {"name": "BRANCH-RTR1", "router_id": "3.3.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.28", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 22805, "tx_updates": 46386, "rx_keepalives": 10727, "tx_keepalives": 23172}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.138 timers 30 180", "clear ip bgp 192.0.2.138"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:15:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 41452, "tx_updates": 43187, "rx_keepalives": 23707, "tx_keepalives": 43582}, {"name": "BRANCH-RTR1", "router_id": "3.5.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 20341, "tx_updates": 39048, "rx_keepalives": 10870, "tx_keepalives": 4507}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.81 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:16:00Z", "neighbor": "192.0.2.103"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.103", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 33094, "tx_updates": 9514, "rx_keepalives": 22054, "tx_keepalives": 39828}, {"name": "CORE-R1", "router_id": "5.1.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.71", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 40059, "tx_updates": 31265, "rx_keepalives": 17463, "tx_keepalives": 44775}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.103 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:41:00Z", "neighbor": "192.0.2.195"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.195", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 54, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 7026, "tx_updates": 48080, "rx_keepalives": 27495, "tx_keepalives": 34362}, {"name": "DC-RTR1", "router_id": "1.1.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.78", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 43, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 42860, "tx_updates": 23448, "rx_keepalives": 47122, "tx_keepalives": 2112}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.195"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:50:00Z", "neighbor": "192.0.2.165"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.165", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31333, "tx_updates": 44169, "rx_keepalives": 1903, "tx_keepalives": 13052}, {"name": "DC-RTR1", "router_id": "5.5.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.40", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 36, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 24592, "tx_updates": 7174, "rx_keepalives": 2512, "tx_keepalives": 46019}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.165"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:56:00Z", "neighbor": "192.0.2.191"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.5.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45296, "tx_updates": 3493, "rx_keepalives": 36874, "tx_keepalives": 36724}, {"name": "BRANCH-RTR1", "router_id": "4.2.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 19929, "tx_updates": 31728, "rx_keepalives": 20321, "tx_keepalives": 25822}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "neighbor 192.0.2.191 timers 30 90", "clear ip bgp 192.0.2.191"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:18:00Z", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 38815, "tx_updates": 17018, "rx_keepalives": 39088, "tx_keepalives": 25050}, {"name": "BRANCH-RTR1", "router_id": "1.1.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44450, "tx_updates": 21275, "rx_keepalives": 7676, "tx_keepalives": 2549}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.189 timers 30 180", "clear ip bgp 192.0.2.189"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:54:00Z", "neighbor": "192.0.2.68"}, "devices": [{"name": "DC-RTR1", "router_id": "5.3.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.68", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 21677, "tx_updates": 14091, "rx_keepalives": 33451, "tx_keepalives": 47279}, {"name": "CORE-R1", "router_id": "4.1.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 35576, "tx_updates": 49226, "rx_keepalives": 26987, "tx_keepalives": 26099}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.68 remote-as 65001", "neighbor 192.0.2.68 timers 10 60", "clear ip bgp 192.0.2.68"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:34:00Z", "neighbor": "192.0.2.145"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41418, "tx_updates": 15994, "rx_keepalives": 5393, "tx_keepalives": 8138}, {"name": "CORE-R1", "router_id": "2.3.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21735, "tx_updates": 36745, "rx_keepalives": 39070, "tx_keepalives": 37836}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.145 timers 60 360", "clear ip bgp 192.0.2.145"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:21:00Z", "neighbor": "192.0.2.252"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.2.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.252", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 29029, "tx_updates": 23432, "rx_keepalives": 17919, "tx_keepalives": 5902}, {"name": "BRANCH-RTR1", "router_id": "2.2.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 17310, "tx_updates": 35232, "rx_keepalives": 45737, "tx_keepalives": 9044}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.252"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:20:00Z", "neighbor": "192.0.2.84"}, "devices": [{"name": "DC-RTR1", "router_id": "3.5.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 12, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 6624, "tx_updates": 37032, "rx_keepalives": 32944, "tx_keepalives": 35939}, {"name": "EDGE-RTR1", "router_id": "5.4.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 15293, "tx_updates": 24157, "rx_keepalives": 14160, "tx_keepalives": 36909}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.84 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:24:00Z", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "router_id": "3.3.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 6928, "tx_updates": 41860, "rx_keepalives": 5051, "tx_keepalives": 7571}, {"name": "DC-RTR1", "router_id": "1.5.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 8969, "tx_updates": 24541, "rx_keepalives": 48597, "tx_keepalives": 27031}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.128"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:25:00Z", "neighbor": "192.0.2.169"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.1.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 35, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 35707, "tx_updates": 21849, "rx_keepalives": 21659, "tx_keepalives": 34243}, {"name": "DC-RTR1", "router_id": "4.3.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 5644, "tx_updates": 36755, "rx_keepalives": 43504, "tx_keepalives": 20187}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.169 remote-as 65100", "neighbor 192.0.2.169 timers 30 180", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:17:00Z", "neighbor": "192.0.2.172"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.172", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 3041, "tx_updates": 41314, "rx_keepalives": 8382, "tx_keepalives": 1593}, {"name": "CORE-R1", "router_id": "3.3.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 39479, "tx_updates": 38213, "rx_keepalives": 30249, "tx_keepalives": 40949}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.172 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:07:00Z", "neighbor": "192.0.2.25"}, "devices": [{"name": "DC-RTR1", "router_id": "3.4.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 7468, "tx_updates": 44302, "rx_keepalives": 28578, "tx_keepalives": 14473}, {"name": "EDGE-RTR1", "router_id": "2.3.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.232", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2801, "tx_updates": 30492, "rx_keepalives": 2619, "tx_keepalives": 20258}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.25 timers 30 180", "clear ip bgp 192.0.2.25"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:01:00Z", "neighbor": "192.0.2.234"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.234", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21318, "tx_updates": 28953, "rx_keepalives": 3132, "tx_keepalives": 8812}, {"name": "CORE-R1", "router_id": "1.2.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 39835, "tx_updates": 46391, "rx_keepalives": 21743, "tx_keepalives": 13743}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.234 timers 30 180", "clear ip bgp 192.0.2.234"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:06:00Z", "neighbor": "192.0.2.193"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 37165, "tx_updates": 9783, "rx_keepalives": 19153, "tx_keepalives": 25955}, {"name": "CORE-R1", "router_id": "4.5.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 10150, "tx_updates": 1638, "rx_keepalives": 30210, "tx_keepalives": 33768}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "neighbor 192.0.2.193 timers 30 180", "clear ip bgp 192.0.2.193"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:56:00Z", "neighbor": "192.0.2.174"}, "devices": [{"name": "DC-RTR1", "router_id": "1.5.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 8743, "tx_updates": 27487, "rx_keepalives": 33094, "tx_keepalives": 45961}, {"name": "CORE-R1", "router_id": "1.5.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.170", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 49464, "tx_updates": 12479, "rx_keepalives": 38269, "tx_keepalives": 40621}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.174 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:35:00Z", "neighbor": "192.0.2.210"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.3.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 6, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 24493, "tx_updates": 47589, "rx_keepalives": 30482, "tx_keepalives": 35866}, {"name": "DC-RTR1", "router_id": "4.2.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 11634, "tx_updates": 14228, "rx_keepalives": 42253, "tx_keepalives": 40365}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.210"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:25:00Z", "neighbor": "192.0.2.142"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.142", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 47, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 22066, "tx_updates": 15987, "rx_keepalives": 8554, "tx_keepalives": 2126}, {"name": "CORE-R1", "router_id": "3.1.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 49, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 2602, "tx_updates": 38623, "rx_keepalives": 40450, "tx_keepalives": 5011}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.142 remote-as 65002", "neighbor 192.0.2.142 timers 10 60", "clear ip bgp 192.0.2.142"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:39:00Z", "neighbor": "192.0.2.32"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.2.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 34688, "tx_updates": 23088, "rx_keepalives": 44724, "tx_keepalives": 36449}, {"name": "EDGE-RTR1", "router_id": "2.3.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 46173, "tx_updates": 15390, "rx_keepalives": 46871, "tx_keepalives": 19255}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.32 timers 30 180", "clear ip bgp 192.0.2.32"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:18:00Z", "neighbor": "192.0.2.235"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.235", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 22118, "tx_updates": 27852, "rx_keepalives": 47734, "tx_keepalives": 38904}, {"name": "BRANCH-RTR1", "router_id": "4.2.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 12458, "tx_updates": 36787, "rx_keepalives": 47354, "tx_keepalives": 38886}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.235 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:51:00Z", "neighbor": "192.0.2.129"}, "devices": [{"name": "CORE-R1", "router_id": "4.3.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2403, "tx_updates": 45332, "rx_keepalives": 42290, "tx_keepalives": 12154}, {"name": "DC-RTR1", "router_id": "3.3.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 49740, "tx_updates": 19794, "rx_keepalives": 6499, "tx_keepalives": 10545}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.129 timers 60 360", "clear ip bgp 192.0.2.129"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:19:00Z", "neighbor": "192.0.2.225"}, "devices": [{"name": "DC-RTR1", "router_id": "5.3.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.225", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 32736, "tx_updates": 49872, "rx_keepalives": 22423, "tx_keepalives": 17211}, {"name": "BRANCH-RTR1", "router_id": "1.5.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.239", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 35205, "tx_updates": 21921, "rx_keepalives": 3784, "tx_keepalives": 43921}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.225 timers 30 180", "clear ip bgp 192.0.2.225"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:05:00Z", "neighbor": "192.0.2.51"}, "devices": [{"name": "DC-RTR1", "router_id": "3.4.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.51", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 3163, "tx_updates": 103, "rx_keepalives": 37063, "tx_keepalives": 26215}, {"name": "CORE-R1", "router_id": "1.1.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.243", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 42286, "tx_updates": 1967, "rx_keepalives": 22737, "tx_keepalives": 43291}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.51 timers 30 180", "clear ip bgp 192.0.2.51"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:56:00Z", "neighbor": "192.0.2.169"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 43372, "tx_updates": 47491, "rx_keepalives": 19154, "tx_keepalives": 18631}, {"name": "EDGE-RTR1", "router_id": "2.3.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 59, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 3049, "tx_updates": 43325, "rx_keepalives": 42084, "tx_keepalives": 23494}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.169 shutdown", "neighbor 192.0.2.169 no shutdown", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:27:00Z", "neighbor": "192.0.2.118"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.1.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 42705, "tx_updates": 29703, "rx_keepalives": 35755, "tx_keepalives": 42609}, {"name": "CORE-R1", "router_id": "5.2.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 4002, "tx_updates": 24539, "rx_keepalives": 37281, "tx_keepalives": 33783}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.118 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:17:00Z", "neighbor": "192.0.2.194"}, "devices": [{"name": "CORE-R1", "router_id": "2.1.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.194", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 41739, "tx_updates": 15095, "rx_keepalives": 5945, "tx_keepalives": 32022}, {"name": "EDGE-RTR1", "router_id": "4.3.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 5055, "tx_updates": 47220, "rx_keepalives": 20203, "tx_keepalives": 21435}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.194 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:04:00Z", "neighbor": "192.0.2.12"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.3.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.12", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 53, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 5510, "tx_updates": 44290, "rx_keepalives": 33251, "tx_keepalives": 47017}, {"name": "EDGE-RTR1", "router_id": "5.4.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 31, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 25270, "tx_updates": 3770, "rx_keepalives": 19753, "tx_keepalives": 1390}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.12 shutdown", "neighbor 192.0.2.12 no shutdown", "clear ip bgp 192.0.2.12"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:52:00Z", "neighbor": "192.0.2.107"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.107", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 47, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 17799, "tx_updates": 8454, "rx_keepalives": 38538, "tx_keepalives": 26599}, {"name": "BRANCH-RTR1", "router_id": "4.1.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 7568, "tx_updates": 28268, "rx_keepalives": 33925, "tx_keepalives": 34263}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.107 remote-as 65100", "neighbor 192.0.2.107 timers 30 180", "clear ip bgp 192.0.2.107"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:13:00Z", "neighbor": "192.0.2.158"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.158", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 34871, "tx_updates": 43315, "rx_keepalives": 25648, "tx_keepalives": 1156}, {"name": "CORE-R1", "router_id": "5.4.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21283, "tx_updates": 42664, "rx_keepalives": 19283, "tx_keepalives": 21827}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.158 timers 30 180", "clear ip bgp 192.0.2.158"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:43:00Z", "neighbor": "192.0.2.203"}, "devices": [{"name": "DC-RTR1", "router_id": "1.5.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 23397, "tx_updates": 15814, "rx_keepalives": 20591, "tx_keepalives": 28941}, {"name": "CORE-R1", "router_id": "2.2.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 38, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 10664, "tx_updates": 4302, "rx_keepalives": 12556, "tx_keepalives": 12985}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.203 shutdown", "neighbor 192.0.2.203 no shutdown", "clear ip bgp 192.0.2.203"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:06:00Z", "neighbor": "192.0.2.10"}, "devices": [{"name": "CORE-R1", "router_id": "1.3.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.10", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 25399, "tx_updates": 44160, "rx_keepalives": 34206, "tx_keepalives": 25167}, {"name": "EDGE-RTR1", "router_id": "1.1.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 36225, "tx_updates": 2491, "rx_keepalives": 21582, "tx_keepalives": 3451}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "neighbor 192.0.2.10 timers 30 180", "clear ip bgp 192.0.2.10"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:01:00Z", "neighbor": "192.0.2.250"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41987, "tx_updates": 29522, "rx_keepalives": 29515, "tx_keepalives": 41910}, {"name": "EDGE-RTR1", "router_id": "1.1.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 15659, "tx_updates": 41821, "rx_keepalives": 36940, "tx_keepalives": 29375}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.250 timers 30 180", "clear ip bgp 192.0.2.250"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:43:00Z", "neighbor": "192.0.2.121"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 19133, "tx_updates": 23110, "rx_keepalives": 12854, "tx_keepalives": 7358}, {"name": "CORE-R1", "router_id": "5.1.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 621, "tx_updates": 16413, "rx_keepalives": 13221, "tx_keepalives": 31779}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.121 timers 60 180", "clear ip bgp 192.0.2.121"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:05:00Z", "neighbor": "192.0.2.166"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.4.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.166", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 43561, "tx_updates": 9355, "rx_keepalives": 3359, "tx_keepalives": 34391}, {"name": "DC-RTR1", "router_id": "2.4.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 538, "tx_updates": 10076, "rx_keepalives": 38007, "tx_keepalives": 46015}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.166"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:36:00Z", "neighbor": "192.0.2.95"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 14, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 28154, "tx_updates": 15345, "rx_keepalives": 28648, "tx_keepalives": 15153}, {"name": "DC-RTR1", "router_id": "4.2.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 21261, "tx_updates": 44039, "rx_keepalives": 36650, "tx_keepalives": 1453}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.95 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:47:00Z", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "router_id": "3.4.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 21604, "tx_updates": 31256, "rx_keepalives": 38177, "tx_keepalives": 24465}, {"name": "BRANCH-RTR1", "router_id": "3.2.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.225", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 34300, "tx_updates": 7087, "rx_keepalives": 40745, "tx_keepalives": 34104}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.185"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:31:00Z", "neighbor": "192.0.2.11"}, "devices": [{"name": "CORE-R1", "router_id": "3.5.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.11", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 4502, "tx_updates": 32824, "rx_keepalives": 38328, "tx_keepalives": 13677}, {"name": "DC-RTR1", "router_id": "2.1.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 30114, "tx_updates": 31398, "rx_keepalives": 34802, "tx_keepalives": 20292}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.11 update-source Loopback0", "neighbor 192.0.2.11 timers 60 360", "clear ip bgp 192.0.2.11"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:25:00Z", "neighbor": "192.0.2.41"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.4.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.41", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 37591, "tx_updates": 28362, "rx_keepalives": 35741, "tx_keepalives": 9549}, {"name": "DC-RTR1", "router_id": "3.5.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.165", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 6742, "tx_updates": 16631, "rx_keepalives": 241, "tx_keepalives": 13594}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.41"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:13:00Z", "neighbor": "192.0.2.176"}, "devices": [{"name": "CORE-R1", "router_id": "1.2.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.176", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 46757, "tx_updates": 12376, "rx_keepalives": 8085, "tx_keepalives": 23181}, {"name": "BRANCH-RTR1", "router_id": "4.3.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32331, "tx_updates": 40034, "rx_keepalives": 39113, "tx_keepalives": 25552}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.176 update-source Loopback0", "neighbor 192.0.2.176 timers 30 180", "clear ip bgp 192.0.2.176"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:49:00Z", "neighbor": "192.0.2.225"}, "devices": [{"name": "DC-RTR1", "router_id": "3.2.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.225", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 33, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 11106, "tx_updates": 4680, "rx_keepalives": 26823, "tx_keepalives": 20128}, {"name": "BRANCH-RTR1", "router_id": "4.4.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 49, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 48391, "tx_updates": 1520, "rx_keepalives": 717, "tx_keepalives": 3628}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.225"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:40:00Z", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "router_id": "2.5.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.197", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 30, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 36375, "tx_updates": 7359, "rx_keepalives": 42460, "tx_keepalives": 39586}, {"name": "BRANCH-RTR1", "router_id": "3.1.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.157", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 41570, "tx_updates": 4346, "rx_keepalives": 40002, "tx_keepalives": 157}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.197 remote-as 65002", "neighbor 192.0.2.197 timers 10 60", "clear ip bgp 192.0.2.197"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:15:00Z", "neighbor": "192.0.2.97"}, "devices": [{"name": "DC-RTR1", "router_id": "5.1.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 6238, "tx_updates": 9494, "rx_keepalives": 17318, "tx_keepalives": 37991}, {"name": "EDGE-RTR1", "router_id": "1.2.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 4528, "tx_updates": 41447, "rx_keepalives": 19181, "tx_keepalives": 3288}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.97 timers 30 90", "clear ip bgp 192.0.2.97"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:41:00Z", "neighbor": "192.0.2.223"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 56, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 12817, "tx_updates": 27471, "rx_keepalives": 48122, "tx_keepalives": 9696}, {"name": "EDGE-RTR1", "router_id": "4.5.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 33, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 38493, "tx_updates": 17417, "rx_keepalives": 192, "tx_keepalives": 20597}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.223 shutdown", "neighbor 192.0.2.223 no shutdown", "clear ip bgp 192.0.2.223"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:23:00Z", "neighbor": "192.0.2.162"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.162", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 49249, "tx_updates": 41851, "rx_keepalives": 3017, "tx_keepalives": 27291}, {"name": "DC-RTR1", "router_id": "5.2.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 6651, "tx_updates": 8397, "rx_keepalives": 26423, "tx_keepalives": 6963}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.162 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:58:00Z", "neighbor": "192.0.2.44"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.44", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45149, "tx_updates": 23589, "rx_keepalives": 19232, "tx_keepalives": 10013}, {"name": "EDGE-RTR1", "router_id": "1.5.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.186", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 43819, "tx_updates": 19303, "rx_keepalives": 39682, "tx_keepalives": 20850}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.44 timers 60 180", "clear ip bgp 192.0.2.44"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:50:00Z", "neighbor": "192.0.2.223"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.223", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 48, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 47503, "tx_updates": 16644, "rx_keepalives": 10296, "tx_keepalives": 44616}, {"name": "BRANCH-RTR1", "router_id": "5.3.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 44, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27434, "tx_updates": 11893, "rx_keepalives": 18332, "tx_keepalives": 48936}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.223 remote-as 65100", "neighbor 192.0.2.223 timers 30 180", "clear ip bgp 192.0.2.223"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:30:00Z", "neighbor": "192.0.2.167"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.4.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 33726, "tx_updates": 16475, "rx_keepalives": 18546, "tx_keepalives": 24389}, {"name": "EDGE-RTR1", "router_id": "2.1.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.204", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 6859, "tx_updates": 36775, "rx_keepalives": 21091, "tx_keepalives": 25076}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "neighbor 192.0.2.167 timers 30 180", "clear ip bgp 192.0.2.167"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:10:00Z", "neighbor": "192.0.2.32"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 3463, "tx_updates": 41017, "rx_keepalives": 43628, "tx_keepalives": 32440}, {"name": "EDGE-RTR1", "router_id": "5.2.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 27, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 4924, "tx_updates": 45744, "rx_keepalives": 31971, "tx_keepalives": 12433}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.32 shutdown", "neighbor 192.0.2.32 no shutdown", "clear ip bgp 192.0.2.32"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:41:00Z", "neighbor": "192.0.2.53"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 30889, "tx_updates": 3810, "rx_keepalives": 47457, "tx_keepalives": 15195}, {"name": "BRANCH-RTR1", "router_id": "4.2.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44515, "tx_updates": 31463, "rx_keepalives": 35673, "tx_keepalives": 2885}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "neighbor 192.0.2.53 timers 30 90", "clear ip bgp 192.0.2.53"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:09:00Z", "neighbor": "192.0.2.46"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.2.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 23392, "tx_updates": 15761, "rx_keepalives": 238, "tx_keepalives": 39937}, {"name": "BRANCH-RTR1", "router_id": "5.5.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 24554, "tx_updates": 7526, "rx_keepalives": 37764, "tx_keepalives": 16588}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.46 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:12:00Z", "neighbor": "192.0.2.245"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 9, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 82, "tx_updates": 29473, "rx_keepalives": 10508, "tx_keepalives": 45396}, {"name": "DC-RTR1", "router_id": "1.2.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 37996, "tx_updates": 45935, "rx_keepalives": 31873, "tx_keepalives": 2922}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.245"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:44:00Z", "neighbor": "192.0.2.45"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.3.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.45", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 46337, "tx_updates": 45170, "rx_keepalives": 31610, "tx_keepalives": 4962}, {"name": "DC-RTR1", "router_id": "4.3.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 15350, "tx_updates": 49364, "rx_keepalives": 40141, "tx_keepalives": 8036}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.45 timers 30 180", "clear ip bgp 192.0.2.45"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:14:00Z", "neighbor": "192.0.2.184"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.1.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 17233, "tx_updates": 35572, "rx_keepalives": 42482, "tx_keepalives": 22099}, {"name": "EDGE-RTR1", "router_id": "4.4.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.240", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 27676, "tx_updates": 48403, "rx_keepalives": 49377, "tx_keepalives": 6700}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.184 timers 60 360", "clear ip bgp 192.0.2.184"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:21:00Z", "neighbor": "192.0.2.104"}, "devices": [{"name": "DC-RTR1", "router_id": "3.3.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 2403, "tx_updates": 14722, "rx_keepalives": 43418, "tx_keepalives": 36445}, {"name": "BRANCH-RTR1", "router_id": "3.2.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.5", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 11650, "tx_updates": 49867, "rx_keepalives": 9083, "tx_keepalives": 16083}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.104 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:18:00Z", "neighbor": "192.0.2.202"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 43631, "tx_updates": 46754, "rx_keepalives": 36877, "tx_keepalives": 4236}, {"name": "CORE-R1", "router_id": "1.3.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.172", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 44664, "tx_updates": 34269, "rx_keepalives": 12311, "tx_keepalives": 32390}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.202 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:24:00Z", "neighbor": "192.0.2.222"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.222", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43575, "tx_updates": 8767, "rx_keepalives": 4568, "tx_keepalives": 41572}, {"name": "EDGE-RTR1", "router_id": "4.5.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.251", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 34166, "tx_updates": 3537, "rx_keepalives": 10113, "tx_keepalives": 22911}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.222 timers 30 90", "clear ip bgp 192.0.2.222"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:57:00Z", "neighbor": "192.0.2.179"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.2.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.179", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 37856, "tx_updates": 41114, "rx_keepalives": 12563, "tx_keepalives": 1971}, {"name": "CORE-R1", "router_id": "3.1.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.103", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42566, "tx_updates": 13720, "rx_keepalives": 24505, "tx_keepalives": 1648}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.179 update-source Loopback0", "neighbor 192.0.2.179 timers 30 180", "clear ip bgp 192.0.2.179"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:51:00Z", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 47, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 31979, "tx_updates": 44189, "rx_keepalives": 28644, "tx_keepalives": 28935}, {"name": "EDGE-RTR1", "router_id": "1.1.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 25, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 826, "tx_updates": 8747, "rx_keepalives": 13718, "tx_keepalives": 28142}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.247 shutdown", "neighbor 192.0.2.247 no shutdown", "clear ip bgp 192.0.2.247"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:15:00Z", "neighbor": "192.0.2.85"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 55, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 12425, "tx_updates": 23271, "rx_keepalives": 21799, "tx_keepalives": 22619}, {"name": "BRANCH-RTR1", "router_id": "2.1.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 24, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 33649, "tx_updates": 22972, "rx_keepalives": 30934, "tx_keepalives": 10191}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.85"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:06:00Z", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "router_id": "2.5.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.199", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 24, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 46356, "tx_updates": 45533, "rx_keepalives": 1727, "tx_keepalives": 30411}, {"name": "DC-RTR1", "router_id": "5.2.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 2055, "tx_updates": 47525, "rx_keepalives": 13040, "tx_keepalives": 22702}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.199 shutdown", "neighbor 192.0.2.199 no shutdown", "clear ip bgp 192.0.2.199"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:00:00Z", "neighbor": "192.0.2.154"}, "devices": [{"name": "CORE-R1", "router_id": "2.1.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 39876, "tx_updates": 20545, "rx_keepalives": 23870, "tx_keepalives": 30571}, {"name": "EDGE-RTR1", "router_id": "1.4.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 37264, "tx_updates": 49598, "rx_keepalives": 44207, "tx_keepalives": 12435}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.154 timers 60 360", "clear ip bgp 192.0.2.154"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:45:00Z", "neighbor": "192.0.2.101"}, "devices": [{"name": "DC-RTR1", "router_id": "3.2.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 15461, "tx_updates": 41164, "rx_keepalives": 21711, "tx_keepalives": 34263}, {"name": "CORE-R1", "router_id": "1.4.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29191, "tx_updates": 15634, "rx_keepalives": 1088, "tx_keepalives": 1508}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.101 timers 30 180", "clear ip bgp 192.0.2.101"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:11:00Z", "neighbor": "192.0.2.131"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27954, "tx_updates": 6715, "rx_keepalives": 24725, "tx_keepalives": 11260}, {"name": "DC-RTR1", "router_id": "4.2.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.205", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44810, "tx_updates": 26082, "rx_keepalives": 16182, "tx_keepalives": 21988}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65100", "neighbor 192.0.2.131 timers 30 180", "clear ip bgp 192.0.2.131"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:39:00Z", "neighbor": "192.0.2.150"}, "devices": [{"name": "DC-RTR1", "router_id": "4.3.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 8, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 38912, "tx_updates": 39766, "rx_keepalives": 33700, "tx_keepalives": 32542}, {"name": "CORE-R1", "router_id": "1.2.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 28620, "tx_updates": 21900, "rx_keepalives": 27339, "tx_keepalives": 24997}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.150 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:51:00Z", "neighbor": "192.0.2.24"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.1.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 22, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 30619, "tx_updates": 15204, "rx_keepalives": 2322, "tx_keepalives": 23708}, {"name": "CORE-R1", "router_id": "3.3.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 29, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 44036, "tx_updates": 26165, "rx_keepalives": 16895, "tx_keepalives": 27435}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.24"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:42:00Z", "neighbor": "192.0.2.107"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.2.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.107", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 58, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 16669, "tx_updates": 43361, "rx_keepalives": 49725, "tx_keepalives": 18541}, {"name": "CORE-R1", "router_id": "2.5.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.212", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 37, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 37612, "tx_updates": 29472, "rx_keepalives": 6371, "tx_keepalives": 1768}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.107 shutdown", "neighbor 192.0.2.107 no shutdown", "clear ip bgp 192.0.2.107"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:45:00Z", "neighbor": "192.0.2.15"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.4.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.15", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 27, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 36879, "tx_updates": 31509, "rx_keepalives": 46426, "tx_keepalives": 27607}, {"name": "CORE-R1", "router_id": "3.4.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.177", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 48280, "tx_updates": 22413, "rx_keepalives": 20942, "tx_keepalives": 26005}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.15 remote-as 65002", "neighbor 192.0.2.15 timers 10 30", "clear ip bgp 192.0.2.15"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:50:00Z", "neighbor": "192.0.2.144"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.5.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 28197, "tx_updates": 18029, "rx_keepalives": 11743, "tx_keepalives": 13887}, {"name": "BRANCH-RTR1", "router_id": "1.2.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9489, "tx_updates": 25559, "rx_keepalives": 40066, "tx_keepalives": 20622}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.144 update-source Loopback0", "neighbor 192.0.2.144 timers 30 180", "clear ip bgp 192.0.2.144"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:37:00Z", "neighbor": "192.0.2.238"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.238", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 53, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 15396, "tx_updates": 14911, "rx_keepalives": 16750, "tx_keepalives": 39572}, {"name": "BRANCH-RTR1", "router_id": "5.4.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 33139, "tx_updates": 39059, "rx_keepalives": 11395, "tx_keepalives": 3960}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.238 remote-as 65010", "neighbor 192.0.2.238 timers 30 90", "clear ip bgp 192.0.2.238"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:26:00Z", "neighbor": "192.0.2.159"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.159", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 52, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 9764, "tx_updates": 44633, "rx_keepalives": 20268, "tx_keepalives": 21515}, {"name": "CORE-R1", "router_id": "4.2.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 45768, "tx_updates": 19623, "rx_keepalives": 19135, "tx_keepalives": 36844}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.159 shutdown", "neighbor 192.0.2.159 no shutdown", "clear ip bgp 192.0.2.159"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:10:00Z", "neighbor": "192.0.2.245"}, "devices": [{"name": "DC-RTR1", "router_id": "5.1.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 35617, "tx_updates": 40803, "rx_keepalives": 42467, "tx_keepalives": 26599}, {"name": "EDGE-RTR1", "router_id": "1.1.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.182", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 12618, "tx_updates": 35195, "rx_keepalives": 29529, "tx_keepalives": 44576}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.245 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:00:00Z", "neighbor": "192.0.2.196"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 402, "tx_updates": 25232, "rx_keepalives": 43886, "tx_keepalives": 31280}, {"name": "EDGE-RTR1", "router_id": "3.4.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 13798, "tx_updates": 6291, "rx_keepalives": 36775, "tx_keepalives": 28308}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.196 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:33:00Z", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.5.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43778, "tx_updates": 24819, "rx_keepalives": 19683, "tx_keepalives": 12428}, {"name": "CORE-R1", "router_id": "4.3.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 38937, "tx_updates": 46418, "rx_keepalives": 33668, "tx_keepalives": 29786}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.15 timers 30 180", "clear ip bgp 192.0.2.15"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:21:00Z", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.169", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 6226, "tx_updates": 13185, "rx_keepalives": 36714, "tx_keepalives": 11189}, {"name": "BRANCH-RTR1", "router_id": "3.5.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.253", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 11004, "tx_updates": 46794, "rx_keepalives": 39768, "tx_keepalives": 21142}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.169 update-source Loopback0", "neighbor 192.0.2.169 timers 60 360", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:13:00Z", "neighbor": "192.0.2.102"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.4.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.102", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 17075, "tx_updates": 42328, "rx_keepalives": 15492, "tx_keepalives": 15549}, {"name": "DC-RTR1", "router_id": "2.4.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 7541, "tx_updates": 32329, "rx_keepalives": 38179, "tx_keepalives": 29819}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.102 timers 60 360", "clear ip bgp 192.0.2.102"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:16:00Z", "neighbor": "192.0.2.62"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 35178, "tx_updates": 33578, "rx_keepalives": 2381, "tx_keepalives": 41412}, {"name": "CORE-R1", "router_id": "3.2.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.87", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 13823, "tx_updates": 5373, "rx_keepalives": 23013, "tx_keepalives": 40006}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.62 remote-as 65001", "neighbor 192.0.2.62 timers 10 60", "clear ip bgp 192.0.2.62"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:37:00Z", "neighbor": "192.0.2.115"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.2.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 20787, "tx_updates": 39934, "rx_keepalives": 45859, "tx_keepalives": 16113}, {"name": "DC-RTR1", "router_id": "2.2.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.83", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 25220, "tx_updates": 4432, "rx_keepalives": 887, "tx_keepalives": 40876}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.115 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:28:00Z", "neighbor": "192.0.2.29"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 39118, "tx_updates": 39938, "rx_keepalives": 41965, "tx_keepalives": 24045}, {"name": "DC-RTR1", "router_id": "5.1.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.43", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 38571, "tx_updates": 19215, "rx_keepalives": 3521, "tx_keepalives": 30206}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.29"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:41:00Z", "neighbor": "192.0.2.242"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 36, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 44050, "tx_updates": 35740, "rx_keepalives": 33365, "tx_keepalives": 30045}, {"name": "EDGE-RTR1", "router_id": "5.3.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.208", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 54, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 14458, "tx_updates": 2173, "rx_keepalives": 27171, "tx_keepalives": 4233}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.242 shutdown", "neighbor 192.0.2.242 no shutdown", "clear ip bgp 192.0.2.242"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:43:00Z", "neighbor": "192.0.2.253"}, "devices": [{"name": "DC-RTR1", "router_id": "1.3.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 21754, "tx_updates": 176, "rx_keepalives": 12782, "tx_keepalives": 33843}, {"name": "EDGE-RTR1", "router_id": "3.2.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 25518, "tx_updates": 32055, "rx_keepalives": 7008, "tx_keepalives": 27537}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.253"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:47:00Z", "neighbor": "192.0.2.109"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.109", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 13255, "tx_updates": 45218, "rx_keepalives": 13033, "tx_keepalives": 7253}, {"name": "CORE-R1", "router_id": "1.1.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 1244, "tx_updates": 16852, "rx_keepalives": 37405, "tx_keepalives": 8160}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.109"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:42:00Z", "neighbor": "192.0.2.96"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.4.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 48046, "tx_updates": 21215, "rx_keepalives": 1875, "tx_keepalives": 33297}, {"name": "CORE-R1", "router_id": "5.5.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 28359, "tx_updates": 5342, "rx_keepalives": 25526, "tx_keepalives": 2995}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.96 remote-as 65100", "neighbor 192.0.2.96 timers 10 30", "clear ip bgp 192.0.2.96"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:35:00Z", "neighbor": "192.0.2.38"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 35309, "tx_updates": 49828, "rx_keepalives": 22185, "tx_keepalives": 12016}, {"name": "DC-RTR1", "router_id": "3.4.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 15989, "tx_updates": 16390, "rx_keepalives": 23746, "tx_keepalives": 3033}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.38 remote-as 65010", "neighbor 192.0.2.38 timers 30 180", "clear ip bgp 192.0.2.38"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:16:00Z", "neighbor": "192.0.2.237"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 36391, "tx_updates": 10288, "rx_keepalives": 4023, "tx_keepalives": 110}, {"name": "BRANCH-RTR1", "router_id": "1.4.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.100", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21520, "tx_updates": 22881, "rx_keepalives": 131, "tx_keepalives": 33016}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.237 timers 60 360", "clear ip bgp 192.0.2.237"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:43:00Z", "neighbor": "192.0.2.68"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.68", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 32487, "tx_updates": 38741, "rx_keepalives": 1283, "tx_keepalives": 2866}, {"name": "EDGE-RTR1", "router_id": "3.1.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 7987, "tx_updates": 46480, "rx_keepalives": 13719, "tx_keepalives": 35451}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "neighbor 192.0.2.68 timers 30 90", "clear ip bgp 192.0.2.68"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:38:00Z", "neighbor": "192.0.2.253"}, "devices": [{"name": "DC-RTR1", "router_id": "2.3.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.253", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 2342, "tx_updates": 25371, "rx_keepalives": 40804, "tx_keepalives": 20087}, {"name": "EDGE-RTR1", "router_id": "1.2.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 34319, "tx_updates": 13784, "rx_keepalives": 31246, "tx_keepalives": 6060}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.253 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:44:00Z", "neighbor": "192.0.2.234"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.234", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 28833, "tx_updates": 41061, "rx_keepalives": 44434, "tx_keepalives": 34266}, {"name": "DC-RTR1", "router_id": "1.5.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 16124, "tx_updates": 43725, "rx_keepalives": 41660, "tx_keepalives": 15575}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.234 timers 60 360", "clear ip bgp 192.0.2.234"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:44:00Z", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "router_id": "4.1.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.91", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 17442, "tx_updates": 48177, "rx_keepalives": 38393, "tx_keepalives": 42497}, {"name": "DC-RTR1", "router_id": "3.4.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 16469, "tx_updates": 31362, "rx_keepalives": 1993, "tx_keepalives": 24833}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.91 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:40:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.1.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 10121, "tx_updates": 13766, "rx_keepalives": 28011, "tx_keepalives": 19246}, {"name": "BRANCH-RTR1", "router_id": "3.3.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.13", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 49028, "tx_updates": 38797, "rx_keepalives": 41821, "tx_keepalives": 18281}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.75"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:47:00Z", "neighbor": "192.0.2.118"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.5.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 3, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 37587, "tx_updates": 49186, "rx_keepalives": 39903, "tx_keepalives": 32497}, {"name": "CORE-R1", "router_id": "5.1.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 14531, "tx_updates": 37274, "rx_keepalives": 11373, "tx_keepalives": 45806}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.118 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:25:00Z", "neighbor": "192.0.2.132"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.132", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 59, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 33202, "tx_updates": 16138, "rx_keepalives": 9773, "tx_keepalives": 32289}, {"name": "CORE-R1", "router_id": "2.4.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.143", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 50, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 2036, "tx_updates": 43074, "rx_keepalives": 24797, "tx_keepalives": 48435}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.132 remote-as 65100", "neighbor 192.0.2.132 timers 10 60", "clear ip bgp 192.0.2.132"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:46:00Z", "neighbor": "192.0.2.228"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.2.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27991, "tx_updates": 11949, "rx_keepalives": 44360, "tx_keepalives": 45794}, {"name": "CORE-R1", "router_id": "3.5.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.145", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 4704, "tx_updates": 2006, "rx_keepalives": 19038, "tx_keepalives": 30306}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.228 update-source Loopback0", "neighbor 192.0.2.228 timers 30 180", "clear ip bgp 192.0.2.228"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:28:00Z", "neighbor": "192.0.2.217"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.217", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 33375, "tx_updates": 46686, "rx_keepalives": 6166, "tx_keepalives": 24447}, {"name": "BRANCH-RTR1", "router_id": "3.5.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.145", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 2858, "tx_updates": 46396, "rx_keepalives": 26867, "tx_keepalives": 19502}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.217"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:45:00Z", "neighbor": "192.0.2.240"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 49525, "tx_updates": 36806, "rx_keepalives": 32241, "tx_keepalives": 21976}, {"name": "BRANCH-RTR1", "router_id": "5.2.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 6, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 3815, "tx_updates": 45786, "rx_keepalives": 11272, "tx_keepalives": 29375}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.240"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:31:00Z", "neighbor": "192.0.2.215"}, "devices": [{"name": "DC-RTR1", "router_id": "3.5.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8613, "tx_updates": 19050, "rx_keepalives": 15478, "tx_keepalives": 29894}, {"name": "CORE-R1", "router_id": "3.3.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 42, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29714, "tx_updates": 3340, "rx_keepalives": 11240, "tx_keepalives": 16505}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.215 remote-as 65100", "neighbor 192.0.2.215 timers 10 30", "clear ip bgp 192.0.2.215"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:10:00Z", "neighbor": "192.0.2.137"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.137", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 11722, "tx_updates": 21198, "rx_keepalives": 11582, "tx_keepalives": 33022}, {"name": "EDGE-RTR1", "router_id": "4.3.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 7825, "tx_updates": 28607, "rx_keepalives": 9357, "tx_keepalives": 32218}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.137 update-source Loopback0", "neighbor 192.0.2.137 timers 30 180", "clear ip bgp 192.0.2.137"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:01:00Z", "neighbor": "192.0.2.143"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.2.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.143", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 13635, "tx_updates": 29052, "rx_keepalives": 38321, "tx_keepalives": 27754}, {"name": "CORE-R1", "router_id": "4.5.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 40347, "tx_updates": 3108, "rx_keepalives": 18998, "tx_keepalives": 34279}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "neighbor 192.0.2.143 timers 60 180", "clear ip bgp 192.0.2.143"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:41:00Z", "neighbor": "192.0.2.8"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.3.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 19, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 34554, "tx_updates": 36127, "rx_keepalives": 18574, "tx_keepalives": 21804}, {"name": "EDGE-RTR1", "router_id": "2.5.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 49, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 2445, "tx_updates": 19185, "rx_keepalives": 13917, "tx_keepalives": 23755}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.8 remote-as 65001", "neighbor 192.0.2.8 timers 60 360", "clear ip bgp 192.0.2.8"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:43:00Z", "neighbor": "192.0.2.213"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 32031, "tx_updates": 39701, "rx_keepalives": 23804, "tx_keepalives": 48401}, {"name": "BRANCH-RTR1", "router_id": "1.5.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.165", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 24199, "tx_updates": 39143, "rx_keepalives": 10873, "tx_keepalives": 484}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.213"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:29:00Z", "neighbor": "192.0.2.210"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 49129, "tx_updates": 36240, "rx_keepalives": 11461, "tx_keepalives": 17321}, {"name": "DC-RTR1", "router_id": "4.5.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 3670, "tx_updates": 24149, "rx_keepalives": 10348, "tx_keepalives": 28743}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.210 update-source Loopback0", "neighbor 192.0.2.210 timers 60 360", "clear ip bgp 192.0.2.210"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:58:00Z", "neighbor": "192.0.2.203"}, "devices": [{"name": "CORE-R1", "router_id": "1.3.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 3272, "tx_updates": 7409, "rx_keepalives": 21791, "tx_keepalives": 7011}, {"name": "BRANCH-RTR1", "router_id": "2.3.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8635, "tx_updates": 23196, "rx_keepalives": 25643, "tx_keepalives": 14535}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.203 timers 30 90", "clear ip bgp 192.0.2.203"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:47:00Z", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.4.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.15", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 535, "tx_updates": 46616, "rx_keepalives": 49118, "tx_keepalives": 47209}, {"name": "DC-RTR1", "router_id": "5.5.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.82", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 16376, "tx_updates": 36835, "rx_keepalives": 32908, "tx_keepalives": 16876}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.15 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:52:00Z", "neighbor": "192.0.2.52"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 673, "tx_updates": 44066, "rx_keepalives": 28409, "tx_keepalives": 24554}, {"name": "DC-RTR1", "router_id": "4.5.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 3483, "tx_updates": 22178, "rx_keepalives": 310, "tx_keepalives": 29198}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.52 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:01:00Z", "neighbor": "192.0.2.163"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.163", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 54, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 34297, "tx_updates": 34116, "rx_keepalives": 22407, "tx_keepalives": 6838}, {"name": "EDGE-RTR1", "router_id": "5.3.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.249", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 43, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 41987, "tx_updates": 32938, "rx_keepalives": 27263, "tx_keepalives": 46138}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.163 shutdown", "neighbor 192.0.2.163 no shutdown", "clear ip bgp 192.0.2.163"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:37:00Z", "neighbor": "192.0.2.233"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 38442, "tx_updates": 32378, "rx_keepalives": 36823, "tx_keepalives": 28961}, {"name": "DC-RTR1", "router_id": "5.2.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.165", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 48960, "tx_updates": 3659, "rx_keepalives": 12842, "tx_keepalives": 31323}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.233"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:11:00Z", "neighbor": "192.0.2.162"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.162", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 59, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 10722, "tx_updates": 23484, "rx_keepalives": 7530, "tx_keepalives": 17818}, {"name": "CORE-R1", "router_id": "1.5.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.148", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 12, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 38732, "tx_updates": 35605, "rx_keepalives": 25292, "tx_keepalives": 34735}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.162"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:18:00Z", "neighbor": "192.0.2.1"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 18068, "tx_updates": 45053, "rx_keepalives": 17959, "tx_keepalives": 36357}, {"name": "DC-RTR1", "router_id": "4.5.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 34746, "tx_updates": 24545, "rx_keepalives": 35975, "tx_keepalives": 21982}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.1 update-source Loopback0", "neighbor 192.0.2.1 timers 30 180", "clear ip bgp 192.0.2.1"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:58:00Z", "neighbor": "192.0.2.142"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 28617, "tx_updates": 31744, "rx_keepalives": 12973, "tx_keepalives": 17436}, {"name": "DC-RTR1", "router_id": "5.3.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.192", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 28241, "tx_updates": 45457, "rx_keepalives": 38745, "tx_keepalives": 11635}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.142 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:01:00Z", "neighbor": "192.0.2.57"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 31, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 30652, "tx_updates": 25269, "rx_keepalives": 24838, "tx_keepalives": 41491}, {"name": "EDGE-RTR1", "router_id": "5.1.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 5250, "tx_updates": 38488, "rx_keepalives": 43934, "tx_keepalives": 40046}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.57 remote-as 65002", "neighbor 192.0.2.57 timers 10 60", "clear ip bgp 192.0.2.57"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:53:00Z", "neighbor": "192.0.2.47"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.4.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 10667, "tx_updates": 20508, "rx_keepalives": 47720, "tx_keepalives": 42327}, {"name": "DC-RTR1", "router_id": "4.1.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 6174, "tx_updates": 35272, "rx_keepalives": 27525, "tx_keepalives": 34126}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.47 update-source Loopback0", "neighbor 192.0.2.47 timers 30 180", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:44:00Z", "neighbor": "192.0.2.46"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.46", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 21876, "tx_updates": 9246, "rx_keepalives": 44645, "tx_keepalives": 2240}, {"name": "EDGE-RTR1", "router_id": "5.2.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 45020, "tx_updates": 29508, "rx_keepalives": 12743, "tx_keepalives": 40302}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.46 shutdown", "neighbor 192.0.2.46 no shutdown", "clear ip bgp 192.0.2.46"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:25:00Z", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 5512, "tx_updates": 31765, "rx_keepalives": 7441, "tx_keepalives": 18296}, {"name": "BRANCH-RTR1", "router_id": "3.3.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.243", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 33494, "tx_updates": 16821, "rx_keepalives": 24643, "tx_keepalives": 15795}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.116 timers 30 180", "clear ip bgp 192.0.2.116"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:58:00Z", "neighbor": "192.0.2.243"}, "devices": [{"name": "CORE-R1", "router_id": "4.3.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 36822, "tx_updates": 27757, "rx_keepalives": 30164, "tx_keepalives": 8922}, {"name": "BRANCH-RTR1", "router_id": "4.4.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.209", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 31843, "tx_updates": 44024, "rx_keepalives": 22757, "tx_keepalives": 12333}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.243 timers 30 180", "clear ip bgp 192.0.2.243"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:37:00Z", "neighbor": "192.0.2.228"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.2.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.228", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 45406, "tx_updates": 31570, "rx_keepalives": 44121, "tx_keepalives": 31670}, {"name": "EDGE-RTR1", "router_id": "5.2.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.50", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 36972, "tx_updates": 30702, "rx_keepalives": 11268, "tx_keepalives": 6697}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.228"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:02:00Z", "neighbor": "192.0.2.124"}, "devices": [{"name": "CORE-R1", "router_id": "5.1.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.124", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 46280, "tx_updates": 15684, "rx_keepalives": 17590, "tx_keepalives": 40212}, {"name": "DC-RTR1", "router_id": "3.3.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.231", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 46453, "tx_updates": 9738, "rx_keepalives": 309, "tx_keepalives": 26576}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.124 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:17:00Z", "neighbor": "192.0.2.132"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.3.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.132", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44693, "tx_updates": 41498, "rx_keepalives": 27927, "tx_keepalives": 17040}, {"name": "BRANCH-RTR1", "router_id": "4.3.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.253", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21205, "tx_updates": 5262, "rx_keepalives": 24791, "tx_keepalives": 3273}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.132 timers 30 180", "clear ip bgp 192.0.2.132"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:45:00Z", "neighbor": "192.0.2.144"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.1.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.144", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 16111, "tx_updates": 14895, "rx_keepalives": 8865, "tx_keepalives": 3202}, {"name": "DC-RTR1", "router_id": "2.2.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.5", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 17932, "tx_updates": 48614, "rx_keepalives": 490, "tx_keepalives": 21983}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.144 timers 60 360", "clear ip bgp 192.0.2.144"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:39:00Z", "neighbor": "192.0.2.18"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.5.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32619, "tx_updates": 28252, "rx_keepalives": 25855, "tx_keepalives": 13271}, {"name": "CORE-R1", "router_id": "1.3.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.244", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 30897, "tx_updates": 46360, "rx_keepalives": 14983, "tx_keepalives": 34462}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.18"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:53:00Z", "neighbor": "192.0.2.182"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.3.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.182", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 26, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 17813, "tx_updates": 5578, "rx_keepalives": 2998, "tx_keepalives": 18134}, {"name": "CORE-R1", "router_id": "1.4.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.165", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 29, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 35093, "tx_updates": 3343, "rx_keepalives": 19802, "tx_keepalives": 19193}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.182 remote-as 65010", "neighbor 192.0.2.182 timers 10 30", "clear ip bgp 192.0.2.182"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:01:00Z", "neighbor": "192.0.2.169"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.169", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 1010, "tx_updates": 20781, "rx_keepalives": 36821, "tx_keepalives": 11439}, {"name": "EDGE-RTR1", "router_id": "4.3.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 38776, "tx_updates": 16514, "rx_keepalives": 12612, "tx_keepalives": 46371}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.169 update-source Loopback0", "neighbor 192.0.2.169 timers 60 360", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:03:00Z", "neighbor": "192.0.2.100"}, "devices": [{"name": "DC-RTR1", "router_id": "4.3.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 38695, "tx_updates": 27259, "rx_keepalives": 44998, "tx_keepalives": 44772}, {"name": "EDGE-RTR1", "router_id": "2.5.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 43640, "tx_updates": 49752, "rx_keepalives": 413, "tx_keepalives": 23041}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.100 update-source Loopback0", "neighbor 192.0.2.100 timers 60 180", "clear ip bgp 192.0.2.100"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:49:00Z", "neighbor": "192.0.2.57"}, "devices": [{"name": "DC-RTR1", "router_id": "2.2.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.57", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 30, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 49634, "tx_updates": 42911, "rx_keepalives": 3378, "tx_keepalives": 41081}, {"name": "BRANCH-RTR1", "router_id": "5.1.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 47, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 45227, "tx_updates": 49552, "rx_keepalives": 37996, "tx_keepalives": 22402}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.57 remote-as 65010", "neighbor 192.0.2.57 timers 10 60", "clear ip bgp 192.0.2.57"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:30:00Z", "neighbor": "192.0.2.248"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 11130, "tx_updates": 31127, "rx_keepalives": 33953, "tx_keepalives": 39933}, {"name": "EDGE-RTR1", "router_id": "1.3.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 36418, "tx_updates": 24288, "rx_keepalives": 19084, "tx_keepalives": 14126}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.248 timers 30 90", "clear ip bgp 192.0.2.248"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:34:00Z", "neighbor": "192.0.2.84"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25328, "tx_updates": 7852, "rx_keepalives": 31576, "tx_keepalives": 44378}, {"name": "DC-RTR1", "router_id": "5.3.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 18066, "tx_updates": 33675, "rx_keepalives": 7895, "tx_keepalives": 47507}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "neighbor 192.0.2.84 timers 60 180", "clear ip bgp 192.0.2.84"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:41:00Z", "neighbor": "192.0.2.66"}, "devices": [{"name": "DC-RTR1", "router_id": "3.2.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.66", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 30667, "tx_updates": 45405, "rx_keepalives": 143, "tx_keepalives": 5902}, {"name": "CORE-R1", "router_id": "4.1.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 14186, "tx_updates": 45225, "rx_keepalives": 45448, "tx_keepalives": 9823}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.66"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:50:00Z", "neighbor": "192.0.2.230"}, "devices": [{"name": "DC-RTR1", "router_id": "2.4.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 30064, "tx_updates": 6228, "rx_keepalives": 2120, "tx_keepalives": 26693}, {"name": "BRANCH-RTR1", "router_id": "3.5.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.154", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 482, "tx_updates": 37719, "rx_keepalives": 18544, "tx_keepalives": 27456}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.230 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:35:00Z", "neighbor": "192.0.2.239"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.239", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 12, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 9845, "tx_updates": 5378, "rx_keepalives": 19777, "tx_keepalives": 3345}, {"name": "BRANCH-RTR1", "router_id": "4.4.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.112", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 35130, "tx_updates": 5474, "rx_keepalives": 43771, "tx_keepalives": 20875}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.239"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:32:00Z", "neighbor": "192.0.2.122"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 33522, "tx_updates": 47203, "rx_keepalives": 48061, "tx_keepalives": 20345}, {"name": "EDGE-RTR1", "router_id": "3.2.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 5365, "tx_updates": 31600, "rx_keepalives": 44607, "tx_keepalives": 20669}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.122"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:24:00Z", "neighbor": "192.0.2.158"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.158", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 26760, "tx_updates": 48337, "rx_keepalives": 17016, "tx_keepalives": 21990}, {"name": "CORE-R1", "router_id": "3.3.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.239", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 39581, "tx_updates": 19651, "rx_keepalives": 9197, "tx_keepalives": 25371}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.158 timers 30 90", "clear ip bgp 192.0.2.158"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:30:00Z", "neighbor": "192.0.2.169"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.2.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.169", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 14, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 48232, "tx_updates": 29906, "rx_keepalives": 11203, "tx_keepalives": 5327}, {"name": "BRANCH-RTR1", "router_id": "4.4.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 37457, "tx_updates": 31158, "rx_keepalives": 26080, "tx_keepalives": 19521}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.169 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:39:00Z", "neighbor": "192.0.2.98"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 793, "tx_updates": 34142, "rx_keepalives": 41046, "tx_keepalives": 27641}, {"name": "DC-RTR1", "router_id": "5.2.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 25530, "tx_updates": 16986, "rx_keepalives": 6621, "tx_keepalives": 29663}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.98 shutdown", "neighbor 192.0.2.98 no shutdown", "clear ip bgp 192.0.2.98"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:53:00Z", "neighbor": "192.0.2.189"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 45, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 42798, "tx_updates": 6911, "rx_keepalives": 8149, "tx_keepalives": 19261}, {"name": "DC-RTR1", "router_id": "1.3.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.195", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 8405, "tx_updates": 45490, "rx_keepalives": 22511, "tx_keepalives": 21784}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.189 shutdown", "neighbor 192.0.2.189 no shutdown", "clear ip bgp 192.0.2.189"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:00:00Z", "neighbor": "192.0.2.212"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.212", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 33769, "tx_updates": 2195, "rx_keepalives": 45127, "tx_keepalives": 7273}, {"name": "BRANCH-RTR1", "router_id": "2.5.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 31728, "tx_updates": 3027, "rx_keepalives": 31718, "tx_keepalives": 33571}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.212 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:56:00Z", "neighbor": "192.0.2.125"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.125", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 28792, "tx_updates": 35828, "rx_keepalives": 33125, "tx_keepalives": 46664}, {"name": "BRANCH-RTR1", "router_id": "1.5.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 12, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 10118, "tx_updates": 9205, "rx_keepalives": 15480, "tx_keepalives": 1795}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.125 shutdown", "neighbor 192.0.2.125 no shutdown", "clear ip bgp 192.0.2.125"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:03:00Z", "neighbor": "192.0.2.223"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.4.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 41, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 45320, "tx_updates": 1078, "rx_keepalives": 27287, "tx_keepalives": 29648}, {"name": "BRANCH-RTR1", "router_id": "4.2.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 33, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 43504, "tx_updates": 30962, "rx_keepalives": 22525, "tx_keepalives": 5518}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.223 shutdown", "neighbor 192.0.2.223 no shutdown", "clear ip bgp 192.0.2.223"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:44:00Z", "neighbor": "192.0.2.147"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.147", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 25561, "tx_updates": 14826, "rx_keepalives": 25362, "tx_keepalives": 31867}, {"name": "BRANCH-RTR1", "router_id": "4.5.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.125", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 35232, "tx_updates": 16004, "rx_keepalives": 16908, "tx_keepalives": 27194}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.147 timers 30 180", "clear ip bgp 192.0.2.147"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:53:00Z", "neighbor": "192.0.2.113"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 2100, "tx_updates": 28461, "rx_keepalives": 36968, "tx_keepalives": 34421}, {"name": "CORE-R1", "router_id": "4.5.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.200", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 48203, "tx_updates": 26020, "rx_keepalives": 27804, "tx_keepalives": 17615}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.113 timers 30 180", "clear ip bgp 192.0.2.113"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:22:00Z", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.113", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8613, "tx_updates": 33936, "rx_keepalives": 14696, "tx_keepalives": 35317}, {"name": "EDGE-RTR1", "router_id": "4.1.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.202", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25450, "tx_updates": 11722, "rx_keepalives": 33338, "tx_keepalives": 16768}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.113 timers 30 90", "clear ip bgp 192.0.2.113"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:40:00Z", "neighbor": "192.0.2.49"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.1.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.49", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 49023, "tx_updates": 10189, "rx_keepalives": 47791, "tx_keepalives": 46657}, {"name": "BRANCH-RTR1", "router_id": "1.3.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.218", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 379, "tx_updates": 13884, "rx_keepalives": 49834, "tx_keepalives": 43047}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "neighbor 192.0.2.49 timers 30 180", "clear ip bgp 192.0.2.49"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:48:00Z", "neighbor": "192.0.2.196"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 18639, "tx_updates": 37202, "rx_keepalives": 15040, "tx_keepalives": 29651}, {"name": "DC-RTR1", "router_id": "2.5.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.40", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 55, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 19873, "tx_updates": 47775, "rx_keepalives": 36705, "tx_keepalives": 13085}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.196 shutdown", "neighbor 192.0.2.196 no shutdown", "clear ip bgp 192.0.2.196"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:51:00Z", "neighbor": "192.0.2.192"}, "devices": [{"name": "CORE-R1", "router_id": "3.3.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.192", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 33287, "tx_updates": 18613, "rx_keepalives": 31843, "tx_keepalives": 32732}, {"name": "DC-RTR1", "router_id": "1.2.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.71", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 4685, "tx_updates": 18093, "rx_keepalives": 36305, "tx_keepalives": 45450}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.192 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:31:00Z", "neighbor": "192.0.2.232"}, "devices": [{"name": "DC-RTR1", "router_id": "4.3.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 58, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 38833, "tx_updates": 33111, "rx_keepalives": 41068, "tx_keepalives": 27363}, {"name": "CORE-R1", "router_id": "1.1.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.135", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 32751, "tx_updates": 5543, "rx_keepalives": 8120, "tx_keepalives": 11170}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.232 shutdown", "neighbor 192.0.2.232 no shutdown", "clear ip bgp 192.0.2.232"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:08:00Z", "neighbor": "192.0.2.246"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 45700, "tx_updates": 18883, "rx_keepalives": 39361, "tx_keepalives": 38017}, {"name": "EDGE-RTR1", "router_id": "1.2.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 16805, "tx_updates": 3698, "rx_keepalives": 16151, "tx_keepalives": 43624}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.246"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:40:00Z", "neighbor": "192.0.2.51"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.3.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 22688, "tx_updates": 25307, "rx_keepalives": 37331, "tx_keepalives": 1849}, {"name": "DC-RTR1", "router_id": "1.1.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 28721, "tx_updates": 27431, "rx_keepalives": 369, "tx_keepalives": 23953}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.51 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:31:00Z", "neighbor": "192.0.2.167"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 19923, "tx_updates": 40962, "rx_keepalives": 28164, "tx_keepalives": 20689}, {"name": "DC-RTR1", "router_id": "4.1.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8541, "tx_updates": 13670, "rx_keepalives": 20314, "tx_keepalives": 798}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.167 update-source Loopback0", "neighbor 192.0.2.167 timers 30 180", "clear ip bgp 192.0.2.167"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:13:00Z", "neighbor": "192.0.2.87"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 8179, "tx_updates": 32795, "rx_keepalives": 44847, "tx_keepalives": 48608}, {"name": "CORE-R1", "router_id": "5.5.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 13111, "tx_updates": 24197, "rx_keepalives": 11080, "tx_keepalives": 45104}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.87 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:13:00Z", "neighbor": "192.0.2.148"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.148", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 16, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27060, "tx_updates": 46719, "rx_keepalives": 42936, "tx_keepalives": 4858}, {"name": "EDGE-RTR1", "router_id": "5.5.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 49613, "tx_updates": 3021, "rx_keepalives": 22748, "tx_keepalives": 19563}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.148 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:08:00Z", "neighbor": "192.0.2.146"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 89, "tx_updates": 40219, "rx_keepalives": 30290, "tx_keepalives": 24311}, {"name": "BRANCH-RTR1", "router_id": "2.3.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31486, "tx_updates": 47504, "rx_keepalives": 9072, "tx_keepalives": 29119}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.146 timers 60 360", "clear ip bgp 192.0.2.146"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:51:00Z", "neighbor": "192.0.2.38"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 2768, "tx_updates": 48487, "rx_keepalives": 1875, "tx_keepalives": 41572}, {"name": "BRANCH-RTR1", "router_id": "2.2.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 6912, "tx_updates": 3226, "rx_keepalives": 46956, "tx_keepalives": 19254}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.38 update-source Loopback0", "neighbor 192.0.2.38 timers 60 180", "clear ip bgp 192.0.2.38"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:25:00Z", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.3.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 7965, "tx_updates": 46976, "rx_keepalives": 4813, "tx_keepalives": 4796}, {"name": "CORE-R1", "router_id": "3.2.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.139", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 10207, "tx_updates": 4950, "rx_keepalives": 41813, "tx_keepalives": 20497}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.15"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:00:00Z", "neighbor": "192.0.2.38"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 4375, "tx_updates": 31944, "rx_keepalives": 30510, "tx_keepalives": 4302}, {"name": "DC-RTR1", "router_id": "1.4.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.68", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 11989, "tx_updates": 22773, "rx_keepalives": 8016, "tx_keepalives": 27802}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.38 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:14:00Z", "neighbor": "192.0.2.165"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.165", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 56, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 40826, "tx_updates": 33732, "rx_keepalives": 5043, "tx_keepalives": 33676}, {"name": "BRANCH-RTR1", "router_id": "3.5.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.185", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 19126, "tx_updates": 38473, "rx_keepalives": 41011, "tx_keepalives": 49734}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.165"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:49:00Z", "neighbor": "192.0.2.154"}, "devices": [{"name": "DC-RTR1", "router_id": "1.5.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 29637, "tx_updates": 26111, "rx_keepalives": 4505, "tx_keepalives": 19080}, {"name": "EDGE-RTR1", "router_id": "5.3.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.148", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 1584, "tx_updates": 35125, "rx_keepalives": 27691, "tx_keepalives": 6490}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.154 timers 60 360", "clear ip bgp 192.0.2.154"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:04:00Z", "neighbor": "192.0.2.30"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 22, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 34223, "tx_updates": 13474, "rx_keepalives": 19351, "tx_keepalives": 289}, {"name": "DC-RTR1", "router_id": "1.3.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 58, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 48256, "tx_updates": 28788, "rx_keepalives": 6958, "tx_keepalives": 27299}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.30 remote-as 65100", "neighbor 192.0.2.30 timers 30 90", "clear ip bgp 192.0.2.30"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:45:00Z", "neighbor": "192.0.2.218"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.3.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.218", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 5168, "tx_updates": 2703, "rx_keepalives": 15620, "tx_keepalives": 11373}, {"name": "DC-RTR1", "router_id": "1.5.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 17223, "tx_updates": 39335, "rx_keepalives": 9767, "tx_keepalives": 474}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.218 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:10:00Z", "neighbor": "192.0.2.138"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.2.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 49820, "tx_updates": 12869, "rx_keepalives": 26476, "tx_keepalives": 23169}, {"name": "DC-RTR1", "router_id": "1.2.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.108", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 14468, "tx_updates": 39562, "rx_keepalives": 12819, "tx_keepalives": 13891}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "neighbor 192.0.2.138 timers 30 180", "clear ip bgp 192.0.2.138"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:27:00Z", "neighbor": "192.0.2.57"}, "devices": [{"name": "DC-RTR1", "router_id": "5.1.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.57", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 36, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 49876, "tx_updates": 33050, "rx_keepalives": 1252, "tx_keepalives": 15417}, {"name": "BRANCH-RTR1", "router_id": "4.3.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.73", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 56, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 41644, "tx_updates": 38364, "rx_keepalives": 8394, "tx_keepalives": 24086}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.57 remote-as 65001", "neighbor 192.0.2.57 timers 10 60", "clear ip bgp 192.0.2.57"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:24:00Z", "neighbor": "192.0.2.40"}, "devices": [{"name": "DC-RTR1", "router_id": "3.4.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.40", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 41624, "tx_updates": 44781, "rx_keepalives": 19577, "tx_keepalives": 1353}, {"name": "CORE-R1", "router_id": "3.4.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 14400, "tx_updates": 11596, "rx_keepalives": 34577, "tx_keepalives": 48919}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.40 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:19:00Z", "neighbor": "192.0.2.178"}, "devices": [{"name": "DC-RTR1", "router_id": "4.5.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 42176, "tx_updates": 33924, "rx_keepalives": 37879, "tx_keepalives": 9267}, {"name": "CORE-R1", "router_id": "1.4.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 21360, "tx_updates": 33048, "rx_keepalives": 2080, "tx_keepalives": 30728}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.178"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:54:00Z", "neighbor": "192.0.2.228"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.228", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 56, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 31460, "tx_updates": 9293, "rx_keepalives": 33194, "tx_keepalives": 43650}, {"name": "CORE-R1", "router_id": "3.4.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.177", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 47, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 42837, "tx_updates": 11603, "rx_keepalives": 33803, "tx_keepalives": 10974}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.228 remote-as 65100", "neighbor 192.0.2.228 timers 30 180", "clear ip bgp 192.0.2.228"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:34:00Z", "neighbor": "192.0.2.200"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.200", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 29532, "tx_updates": 36106, "rx_keepalives": 9838, "tx_keepalives": 14209}, {"name": "EDGE-RTR1", "router_id": "4.5.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 33451, "tx_updates": 21545, "rx_keepalives": 40010, "tx_keepalives": 22005}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.200"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:54:00Z", "neighbor": "192.0.2.93"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.2.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 26, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 23833, "tx_updates": 19433, "rx_keepalives": 40426, "tx_keepalives": 29014}, {"name": "BRANCH-RTR1", "router_id": "1.4.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.33", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 34, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 15008, "tx_updates": 9471, "rx_keepalives": 47248, "tx_keepalives": 46880}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.93 remote-as 65100", "neighbor 192.0.2.93 timers 10 60", "clear ip bgp 192.0.2.93"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:06:00Z", "neighbor": "192.0.2.198"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.2.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 3, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 42982, "tx_updates": 4512, "rx_keepalives": 32757, "tx_keepalives": 35746}, {"name": "CORE-R1", "router_id": "2.3.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 25845, "tx_updates": 18683, "rx_keepalives": 45777, "tx_keepalives": 46153}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.198 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:12:00Z", "neighbor": "192.0.2.29"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.4.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 14141, "tx_updates": 36341, "rx_keepalives": 30030, "tx_keepalives": 5463}, {"name": "CORE-R1", "router_id": "2.2.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 284, "tx_updates": 29284, "rx_keepalives": 5910, "tx_keepalives": 38301}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.29 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:23:00Z", "neighbor": "192.0.2.156"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 5, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 18827, "tx_updates": 4255, "rx_keepalives": 34270, "tx_keepalives": 44648}, {"name": "CORE-R1", "router_id": "2.5.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 51, "tx_updates": 39679, "rx_keepalives": 45671, "tx_keepalives": 21723}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.156 shutdown", "neighbor 192.0.2.156 no shutdown", "clear ip bgp 192.0.2.156"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:37:00Z", "neighbor": "192.0.2.249"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 49242, "tx_updates": 7811, "rx_keepalives": 35771, "tx_keepalives": 19508}, {"name": "EDGE-RTR1", "router_id": "5.1.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 1397, "tx_updates": 47122, "rx_keepalives": 31662, "tx_keepalives": 18704}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.249 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:44:00Z", "neighbor": "192.0.2.41"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.3.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 30266, "tx_updates": 43025, "rx_keepalives": 36448, "tx_keepalives": 22809}, {"name": "DC-RTR1", "router_id": "3.4.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.34", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 42, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41040, "tx_updates": 13816, "rx_keepalives": 48516, "tx_keepalives": 12508}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.41 shutdown", "neighbor 192.0.2.41 no shutdown", "clear ip bgp 192.0.2.41"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:31:00Z", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.247", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 33, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 26677, "tx_updates": 8578, "rx_keepalives": 28562, "tx_keepalives": 14912}, {"name": "DC-RTR1", "router_id": "1.2.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.55", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 20888, "tx_updates": 29865, "rx_keepalives": 32799, "tx_keepalives": 49543}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.247 shutdown", "neighbor 192.0.2.247 no shutdown", "clear ip bgp 192.0.2.247"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:52:00Z", "neighbor": "192.0.2.14"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.2.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 33383, "tx_updates": 40260, "rx_keepalives": 33885, "tx_keepalives": 9342}, {"name": "CORE-R1", "router_id": "5.1.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.31", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 43, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 8401, "tx_updates": 40033, "rx_keepalives": 44783, "tx_keepalives": 35463}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.14"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:16:00Z", "neighbor": "192.0.2.230"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 5722, "tx_updates": 27615, "rx_keepalives": 21200, "tx_keepalives": 45610}, {"name": "CORE-R1", "router_id": "3.2.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 28710, "tx_updates": 48687, "rx_keepalives": 23155, "tx_keepalives": 41126}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.230 timers 60 180", "clear ip bgp 192.0.2.230"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:13:00Z", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "router_id": "2.2.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.118", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 13126, "tx_updates": 7887, "rx_keepalives": 45889, "tx_keepalives": 41698}, {"name": "BRANCH-RTR1", "router_id": "5.5.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 22, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 36114, "tx_updates": 39202, "rx_keepalives": 7051, "tx_keepalives": 29239}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.118 remote-as 65001", "neighbor 192.0.2.118 timers 60 180", "clear ip bgp 192.0.2.118"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:49:00Z", "neighbor": "192.0.2.101"}, "devices": [{"name": "CORE-R1", "router_id": "4.5.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 26167, "tx_updates": 22875, "rx_keepalives": 40878, "tx_keepalives": 10493}, {"name": "BRANCH-RTR1", "router_id": "4.1.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.68", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 51, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 33620, "tx_updates": 25819, "rx_keepalives": 31035, "tx_keepalives": 13056}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.101 remote-as 65100", "neighbor 192.0.2.101 timers 10 60", "clear ip bgp 192.0.2.101"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:01:00Z", "neighbor": "192.0.2.239"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.239", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44873, "tx_updates": 17907, "rx_keepalives": 18717, "tx_keepalives": 23759}, {"name": "CORE-R1", "router_id": "3.3.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 23466, "tx_updates": 34214, "rx_keepalives": 41221, "tx_keepalives": 47580}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.239 timers 30 180", "clear ip bgp 192.0.2.239"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:36:00Z", "neighbor": "192.0.2.209"}, "devices": [{"name": "CORE-R1", "router_id": "2.5.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.209", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 23994, "tx_updates": 32067, "rx_keepalives": 26308, "tx_keepalives": 23614}, {"name": "EDGE-RTR1", "router_id": "1.4.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 24152, "tx_updates": 21581, "rx_keepalives": 32339, "tx_keepalives": 39865}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.209"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:58:00Z", "neighbor": "192.0.2.229"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.229", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 16573, "tx_updates": 10989, "rx_keepalives": 2557, "tx_keepalives": 4030}, {"name": "BRANCH-RTR1", "router_id": "3.1.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.67", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 47669, "tx_updates": 35800, "rx_keepalives": 846, "tx_keepalives": 30312}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.229 update-source Loopback0", "neighbor 192.0.2.229 timers 30 180", "clear ip bgp 192.0.2.229"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:08:00Z", "neighbor": "192.0.2.136"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31458, "tx_updates": 30348, "rx_keepalives": 24309, "tx_keepalives": 6691}, {"name": "BRANCH-RTR1", "router_id": "4.1.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.155", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 25206, "tx_updates": 17722, "rx_keepalives": 27295, "tx_keepalives": 42814}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.136 update-source Loopback0", "neighbor 192.0.2.136 timers 30 90", "clear ip bgp 192.0.2.136"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:02:00Z", "neighbor": "192.0.2.56"}, "devices": [{"name": "DC-RTR1", "router_id": "1.5.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.56", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8583, "tx_updates": 26670, "rx_keepalives": 46587, "tx_keepalives": 44368}, {"name": "BRANCH-RTR1", "router_id": "1.3.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 30117, "tx_updates": 34909, "rx_keepalives": 46136, "tx_keepalives": 17972}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.56 update-source Loopback0", "neighbor 192.0.2.56 timers 30 90", "clear ip bgp 192.0.2.56"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:59:00Z", "neighbor": "192.0.2.230"}, "devices": [{"name": "DC-RTR1", "router_id": "3.2.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.230", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 29193, "tx_updates": 24431, "rx_keepalives": 23684, "tx_keepalives": 38442}, {"name": "CORE-R1", "router_id": "3.3.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 13831, "tx_updates": 772, "rx_keepalives": 43137, "tx_keepalives": 2605}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.230 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:29:00Z", "neighbor": "192.0.2.220"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 49002, "tx_updates": 24704, "rx_keepalives": 20380, "tx_keepalives": 27093}, {"name": "EDGE-RTR1", "router_id": "4.4.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.239", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 11161, "tx_updates": 26300, "rx_keepalives": 8669, "tx_keepalives": 42241}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.220"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:54:00Z", "neighbor": "192.0.2.177"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.177", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 37688, "tx_updates": 25646, "rx_keepalives": 47973, "tx_keepalives": 39125}, {"name": "DC-RTR1", "router_id": "4.1.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.108", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 22906, "tx_updates": 29122, "rx_keepalives": 26511, "tx_keepalives": 43601}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.177 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:07:00Z", "neighbor": "192.0.2.148"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.148", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25020, "tx_updates": 36935, "rx_keepalives": 44833, "tx_keepalives": 32474}, {"name": "BRANCH-RTR1", "router_id": "3.1.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24627, "tx_updates": 34664, "rx_keepalives": 17755, "tx_keepalives": 46971}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "neighbor 192.0.2.148 timers 30 180", "clear ip bgp 192.0.2.148"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:56:00Z", "neighbor": "192.0.2.130"}, "devices": [{"name": "CORE-R1", "router_id": "4.3.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.130", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 11191, "tx_updates": 30159, "rx_keepalives": 40910, "tx_keepalives": 18990}, {"name": "DC-RTR1", "router_id": "3.4.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 6982, "tx_updates": 11743, "rx_keepalives": 29608, "tx_keepalives": 29821}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.130 update-source Loopback0", "neighbor 192.0.2.130 timers 30 180", "clear ip bgp 192.0.2.130"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:07:00Z", "neighbor": "192.0.2.207"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 20628, "tx_updates": 39724, "rx_keepalives": 41970, "tx_keepalives": 41311}, {"name": "BRANCH-RTR1", "router_id": "4.2.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 13989, "tx_updates": 32350, "rx_keepalives": 23211, "tx_keepalives": 40462}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.207 timers 30 180", "clear ip bgp 192.0.2.207"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:16:00Z", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 19710, "tx_updates": 44186, "rx_keepalives": 34242, "tx_keepalives": 48995}, {"name": "CORE-R1", "router_id": "5.5.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.222", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41617, "tx_updates": 30748, "rx_keepalives": 13494, "tx_keepalives": 3349}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "neighbor 192.0.2.129 timers 30 180", "clear ip bgp 192.0.2.129"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:58:00Z", "neighbor": "192.0.2.197"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 35942, "tx_updates": 15054, "rx_keepalives": 37634, "tx_keepalives": 10238}, {"name": "BRANCH-RTR1", "router_id": "2.3.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 47403, "tx_updates": 48462, "rx_keepalives": 27503, "tx_keepalives": 43631}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.197 timers 60 180", "clear ip bgp 192.0.2.197"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:58:00Z", "neighbor": "192.0.2.133"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.133", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47445, "tx_updates": 2523, "rx_keepalives": 17336, "tx_keepalives": 21366}, {"name": "EDGE-RTR1", "router_id": "4.3.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 25, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 40189, "tx_updates": 5092, "rx_keepalives": 21401, "tx_keepalives": 47957}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.133 shutdown", "neighbor 192.0.2.133 no shutdown", "clear ip bgp 192.0.2.133"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:16:00Z", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "router_id": "5.3.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.118", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29373, "tx_updates": 19677, "rx_keepalives": 23801, "tx_keepalives": 10916}, {"name": "EDGE-RTR1", "router_id": "2.5.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 143, "tx_updates": 14440, "rx_keepalives": 38246, "tx_keepalives": 2141}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.118 update-source Loopback0", "neighbor 192.0.2.118 timers 60 180", "clear ip bgp 192.0.2.118"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:50:00Z", "neighbor": "192.0.2.171"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.171", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 58, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9833, "tx_updates": 22858, "rx_keepalives": 35252, "tx_keepalives": 36072}, {"name": "EDGE-RTR1", "router_id": "4.4.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.142", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 41, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 39357, "tx_updates": 17180, "rx_keepalives": 41943, "tx_keepalives": 37396}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.171"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:27:00Z", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.2.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27454, "tx_updates": 43438, "rx_keepalives": 6724, "tx_keepalives": 25880}, {"name": "EDGE-RTR1", "router_id": "3.5.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 6, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 35756, "tx_updates": 43567, "rx_keepalives": 26085, "tx_keepalives": 36870}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.159 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:40:00Z", "neighbor": "192.0.2.52"}, "devices": [{"name": "DC-RTR1", "router_id": "5.3.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 52, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 8811, "tx_updates": 19796, "rx_keepalives": 11673, "tx_keepalives": 5817}, {"name": "CORE-R1", "router_id": "1.2.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 24507, "tx_updates": 27635, "rx_keepalives": 6705, "tx_keepalives": 6663}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.52"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:33:00Z", "neighbor": "192.0.2.160"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 48610, "tx_updates": 24356, "rx_keepalives": 12464, "tx_keepalives": 11122}, {"name": "EDGE-RTR1", "router_id": "3.5.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 20203, "tx_updates": 31174, "rx_keepalives": 24148, "tx_keepalives": 17717}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.160 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:07:00Z", "neighbor": "192.0.2.164"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.164", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 60, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 31409, "tx_updates": 39315, "rx_keepalives": 9927, "tx_keepalives": 49552}, {"name": "BRANCH-RTR1", "router_id": "5.1.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.25", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 14029, "tx_updates": 22844, "rx_keepalives": 29839, "tx_keepalives": 13520}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.164 remote-as 65001", "neighbor 192.0.2.164 timers 30 180", "clear ip bgp 192.0.2.164"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:11:00Z", "neighbor": "192.0.2.99"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 53, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 14541, "tx_updates": 4776, "rx_keepalives": 17556, "tx_keepalives": 48190}, {"name": "DC-RTR1", "router_id": "2.1.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 29, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 49830, "tx_updates": 44058, "rx_keepalives": 7546, "tx_keepalives": 37516}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.99 shutdown", "neighbor 192.0.2.99 no shutdown", "clear ip bgp 192.0.2.99"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:57:00Z", "neighbor": "192.0.2.156"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.156", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 41864, "tx_updates": 33267, "rx_keepalives": 38403, "tx_keepalives": 14668}, {"name": "EDGE-RTR1", "router_id": "1.4.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 14, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 1440, "tx_updates": 22178, "rx_keepalives": 24187, "tx_keepalives": 29831}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.156 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:51:00Z", "neighbor": "192.0.2.44"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.44", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 4895, "tx_updates": 6344, "rx_keepalives": 43475, "tx_keepalives": 39172}, {"name": "EDGE-RTR1", "router_id": "1.2.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 48, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 13911, "tx_updates": 25882, "rx_keepalives": 32352, "tx_keepalives": 30741}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.44 remote-as 65002", "neighbor 192.0.2.44 timers 60 360", "clear ip bgp 192.0.2.44"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:28:00Z", "neighbor": "192.0.2.160"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 29, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 26890, "tx_updates": 34166, "rx_keepalives": 34430, "tx_keepalives": 44995}, {"name": "BRANCH-RTR1", "router_id": "4.1.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 30065, "tx_updates": 12871, "rx_keepalives": 41518, "tx_keepalives": 44315}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.160"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:01:00Z", "neighbor": "192.0.2.117"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 38044, "tx_updates": 17361, "rx_keepalives": 41378, "tx_keepalives": 45708}, {"name": "BRANCH-RTR1", "router_id": "5.1.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.216", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 37248, "tx_updates": 33315, "rx_keepalives": 14331, "tx_keepalives": 14552}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.117 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:24:00Z", "neighbor": "192.0.2.135"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.135", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 49, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 4560, "tx_updates": 30380, "rx_keepalives": 1431, "tx_keepalives": 19470}, {"name": "CORE-R1", "router_id": "3.1.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 48, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 9772, "tx_updates": 2547, "rx_keepalives": 27063, "tx_keepalives": 650}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.135 shutdown", "neighbor 192.0.2.135 no shutdown", "clear ip bgp 192.0.2.135"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:32:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.75", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21562, "tx_updates": 48566, "rx_keepalives": 25908, "tx_keepalives": 18313}, {"name": "BRANCH-RTR1", "router_id": "4.5.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.200", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21013, "tx_updates": 39305, "rx_keepalives": 38422, "tx_keepalives": 23791}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.75 timers 60 360", "clear ip bgp 192.0.2.75"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:58:00Z", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.103", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 16148, "tx_updates": 25029, "rx_keepalives": 48266, "tx_keepalives": 10601}, {"name": "EDGE-RTR1", "router_id": "2.3.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.162", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 43758, "tx_updates": 21130, "rx_keepalives": 8204, "tx_keepalives": 16015}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.103"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:15:00Z", "neighbor": "192.0.2.188"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.5.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 33827, "tx_updates": 37723, "rx_keepalives": 26779, "tx_keepalives": 17780}, {"name": "CORE-R1", "router_id": "2.3.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.53", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41936, "tx_updates": 16748, "rx_keepalives": 3372, "tx_keepalives": 2744}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.188 update-source Loopback0", "neighbor 192.0.2.188 timers 30 180", "clear ip bgp 192.0.2.188"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:53:00Z", "neighbor": "192.0.2.61"}, "devices": [{"name": "DC-RTR1", "router_id": "1.3.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.61", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21092, "tx_updates": 39171, "rx_keepalives": 27735, "tx_keepalives": 23661}, {"name": "EDGE-RTR1", "router_id": "5.4.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 59, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 38927, "tx_updates": 39821, "rx_keepalives": 16778, "tx_keepalives": 9245}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.61 remote-as 65001", "neighbor 192.0.2.61 timers 60 180", "clear ip bgp 192.0.2.61"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:13:00Z", "neighbor": "192.0.2.198"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.198", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 3612, "tx_updates": 24098, "rx_keepalives": 6357, "tx_keepalives": 16516}, {"name": "DC-RTR1", "router_id": "4.2.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.75", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 30342, "tx_updates": 7112, "rx_keepalives": 23595, "tx_keepalives": 3913}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.198 update-source Loopback0", "neighbor 192.0.2.198 timers 30 180", "clear ip bgp 192.0.2.198"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:15:00Z", "neighbor": "192.0.2.120"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.120", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 38454, "tx_updates": 10124, "rx_keepalives": 24431, "tx_keepalives": 46965}, {"name": "DC-RTR1", "router_id": "2.3.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.41", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 39879, "tx_updates": 12396, "rx_keepalives": 23323, "tx_keepalives": 48912}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.120 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:34:00Z", "neighbor": "192.0.2.160"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.160", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8977, "tx_updates": 9724, "rx_keepalives": 30089, "tx_keepalives": 9105}, {"name": "CORE-R1", "router_id": "5.4.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.208", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 37070, "tx_updates": 35143, "rx_keepalives": 13646, "tx_keepalives": 14647}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.160 timers 30 180", "clear ip bgp 192.0.2.160"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:20:00Z", "neighbor": "192.0.2.12"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.12", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 37760, "tx_updates": 22417, "rx_keepalives": 24711, "tx_keepalives": 13028}, {"name": "EDGE-RTR1", "router_id": "2.4.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 31069, "tx_updates": 2202, "rx_keepalives": 28772, "tx_keepalives": 16902}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.12 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:37:00Z", "neighbor": "192.0.2.50"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 15626, "tx_updates": 48037, "rx_keepalives": 29300, "tx_keepalives": 24106}, {"name": "DC-RTR1", "router_id": "2.2.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 22909, "tx_updates": 12772, "rx_keepalives": 43106, "tx_keepalives": 37647}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.50 remote-as 65100", "neighbor 192.0.2.50 timers 30 180", "clear ip bgp 192.0.2.50"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:33:00Z", "neighbor": "192.0.2.39"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21530, "tx_updates": 24757, "rx_keepalives": 38866, "tx_keepalives": 45203}, {"name": "CORE-R1", "router_id": "2.1.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 12075, "tx_updates": 40027, "rx_keepalives": 15194, "tx_keepalives": 41588}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.39 update-source Loopback0", "neighbor 192.0.2.39 timers 60 180", "clear ip bgp 192.0.2.39"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:22:00Z", "neighbor": "192.0.2.199"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.199", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 48184, "tx_updates": 12501, "rx_keepalives": 29200, "tx_keepalives": 24417}, {"name": "BRANCH-RTR1", "router_id": "2.1.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 24, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 49690, "tx_updates": 30601, "rx_keepalives": 35653, "tx_keepalives": 1571}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.199"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:06:00Z", "neighbor": "192.0.2.70"}, "devices": [{"name": "CORE-R1", "router_id": "3.3.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 22624, "tx_updates": 46579, "rx_keepalives": 7809, "tx_keepalives": 39104}, {"name": "DC-RTR1", "router_id": "4.4.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.76", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 42646, "tx_updates": 4599, "rx_keepalives": 19156, "tx_keepalives": 7227}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.70 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:30:00Z", "neighbor": "192.0.2.198"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.198", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 6735, "tx_updates": 34445, "rx_keepalives": 39990, "tx_keepalives": 26645}, {"name": "BRANCH-RTR1", "router_id": "4.2.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 45, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24852, "tx_updates": 35384, "rx_keepalives": 19160, "tx_keepalives": 37569}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.198 remote-as 65010", "neighbor 192.0.2.198 timers 30 180", "clear ip bgp 192.0.2.198"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:01:00Z", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "router_id": "2.1.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.59", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 26975, "tx_updates": 1157, "rx_keepalives": 45013, "tx_keepalives": 47314}, {"name": "EDGE-RTR1", "router_id": "1.2.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.47", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 42439, "tx_updates": 28426, "rx_keepalives": 39649, "tx_keepalives": 20946}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.59 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:12:00Z", "neighbor": "192.0.2.232"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 55, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 31977, "tx_updates": 16761, "rx_keepalives": 40144, "tx_keepalives": 43135}, {"name": "EDGE-RTR1", "router_id": "5.3.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.247", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 33, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 25335, "tx_updates": 26365, "rx_keepalives": 47672, "tx_keepalives": 17701}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.232 shutdown", "neighbor 192.0.2.232 no shutdown", "clear ip bgp 192.0.2.232"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:57:00Z", "neighbor": "192.0.2.92"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.92", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 25773, "tx_updates": 17706, "rx_keepalives": 10012, "tx_keepalives": 44202}, {"name": "EDGE-RTR1", "router_id": "4.5.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 4398, "tx_updates": 37268, "rx_keepalives": 45193, "tx_keepalives": 31792}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.92"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:46:00Z", "neighbor": "192.0.2.69"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.69", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 56, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 9970, "tx_updates": 15869, "rx_keepalives": 31280, "tx_keepalives": 19876}, {"name": "EDGE-RTR1", "router_id": "1.4.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 53, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 47248, "tx_updates": 46631, "rx_keepalives": 4107, "tx_keepalives": 38269}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.69 remote-as 65001", "neighbor 192.0.2.69 timers 10 60", "clear ip bgp 192.0.2.69"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:29:00Z", "neighbor": "192.0.2.17"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 38998, "tx_updates": 32546, "rx_keepalives": 47934, "tx_keepalives": 41540}, {"name": "DC-RTR1", "router_id": "1.5.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.102", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 1211, "tx_updates": 38543, "rx_keepalives": 4866, "tx_keepalives": 44698}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.17 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:40:00Z", "neighbor": "192.0.2.4"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.4", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45646, "tx_updates": 45999, "rx_keepalives": 7388, "tx_keepalives": 21968}, {"name": "BRANCH-RTR1", "router_id": "3.1.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.199", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 10134, "tx_updates": 38849, "rx_keepalives": 17617, "tx_keepalives": 45509}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "neighbor 192.0.2.4 timers 30 180", "clear ip bgp 192.0.2.4"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:30:00Z", "neighbor": "192.0.2.193"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.193", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 48, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 12921, "tx_updates": 29463, "rx_keepalives": 11153, "tx_keepalives": 8772}, {"name": "DC-RTR1", "router_id": "1.5.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.190", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 51, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 47030, "tx_updates": 23953, "rx_keepalives": 45083, "tx_keepalives": 42104}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.193"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:00:00Z", "neighbor": "192.0.2.160"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.160", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 29777, "tx_updates": 2969, "rx_keepalives": 7177, "tx_keepalives": 18209}, {"name": "BRANCH-RTR1", "router_id": "1.4.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 13059, "tx_updates": 26931, "rx_keepalives": 14411, "tx_keepalives": 27829}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.160 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:59:00Z", "neighbor": "192.0.2.253"}, "devices": [{"name": "CORE-R1", "router_id": "3.1.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 17847, "tx_updates": 23751, "rx_keepalives": 5254, "tx_keepalives": 41616}, {"name": "BRANCH-RTR1", "router_id": "2.5.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.221", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 9042, "tx_updates": 8844, "rx_keepalives": 5293, "tx_keepalives": 16803}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.253"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:09:00Z", "neighbor": "192.0.2.40"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.4.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.40", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 3555, "tx_updates": 19947, "rx_keepalives": 48627, "tx_keepalives": 13643}, {"name": "DC-RTR1", "router_id": "3.3.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 28133, "tx_updates": 29064, "rx_keepalives": 5830, "tx_keepalives": 5651}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.40 update-source Loopback0", "neighbor 192.0.2.40 timers 30 180", "clear ip bgp 192.0.2.40"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:59:00Z", "neighbor": "192.0.2.87"}, "devices": [{"name": "DC-RTR1", "router_id": "4.5.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 53, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 43270, "tx_updates": 28625, "rx_keepalives": 7095, "tx_keepalives": 40116}, {"name": "CORE-R1", "router_id": "1.3.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.132", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 30349, "tx_updates": 19523, "rx_keepalives": 21556, "tx_keepalives": 11056}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.87 shutdown", "neighbor 192.0.2.87 no shutdown", "clear ip bgp 192.0.2.87"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:52:00Z", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "router_id": "4.5.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 32061, "tx_updates": 39826, "rx_keepalives": 19517, "tx_keepalives": 42162}, {"name": "EDGE-RTR1", "router_id": "5.5.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 31, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 10923, "tx_updates": 29316, "rx_keepalives": 49044, "tx_keepalives": 19899}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.169 remote-as 65100", "neighbor 192.0.2.169 timers 30 180", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:44:00Z", "neighbor": "192.0.2.64"}, "devices": [{"name": "DC-RTR1", "router_id": "2.2.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 42832, "tx_updates": 48102, "rx_keepalives": 25818, "tx_keepalives": 4519}, {"name": "EDGE-RTR1", "router_id": "5.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 8835, "tx_updates": 47773, "rx_keepalives": 20472, "tx_keepalives": 21949}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.64"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:10:00Z", "neighbor": "192.0.2.95"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.2.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 25910, "tx_updates": 32582, "rx_keepalives": 28087, "tx_keepalives": 23391}, {"name": "BRANCH-RTR1", "router_id": "1.4.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.2", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 27277, "tx_updates": 43391, "rx_keepalives": 1617, "tx_keepalives": 48517}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.95 update-source Loopback0", "neighbor 192.0.2.95 timers 30 180", "clear ip bgp 192.0.2.95"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:30:00Z", "neighbor": "192.0.2.193"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 21174, "tx_updates": 40901, "rx_keepalives": 23354, "tx_keepalives": 19462}, {"name": "BRANCH-RTR1", "router_id": "2.4.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 12653, "tx_updates": 3663, "rx_keepalives": 434, "tx_keepalives": 11618}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.193 timers 30 180", "clear ip bgp 192.0.2.193"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:38:00Z", "neighbor": "192.0.2.110"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 36713, "tx_updates": 6130, "rx_keepalives": 10414, "tx_keepalives": 10281}, {"name": "DC-RTR1", "router_id": "3.2.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 7270, "tx_updates": 6513, "rx_keepalives": 48167, "tx_keepalives": 22423}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:53:00Z", "neighbor": "192.0.2.215"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 30168, "tx_updates": 28890, "rx_keepalives": 42827, "tx_keepalives": 11559}, {"name": "DC-RTR1", "router_id": "1.4.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 37952, "tx_updates": 29063, "rx_keepalives": 48685, "tx_keepalives": 16712}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.215 shutdown", "neighbor 192.0.2.215 no shutdown", "clear ip bgp 192.0.2.215"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:13:00Z", "neighbor": "192.0.2.4"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 25067, "tx_updates": 9576, "rx_keepalives": 6188, "tx_keepalives": 4193}, {"name": "EDGE-RTR1", "router_id": "3.5.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 25829, "tx_updates": 20134, "rx_keepalives": 33550, "tx_keepalives": 43802}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.4 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:34:00Z", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "router_id": "3.5.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 17132, "tx_updates": 45580, "rx_keepalives": 40319, "tx_keepalives": 42369}, {"name": "EDGE-RTR1", "router_id": "5.2.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.234", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 24281, "tx_updates": 47184, "rx_keepalives": 47402, "tx_keepalives": 26167}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.91 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:28:00Z", "neighbor": "192.0.2.222"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.222", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 38404, "tx_updates": 5330, "rx_keepalives": 5594, "tx_keepalives": 2991}, {"name": "DC-RTR1", "router_id": "2.4.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 16955, "tx_updates": 43731, "rx_keepalives": 19170, "tx_keepalives": 25545}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.222 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:44:00Z", "neighbor": "192.0.2.45"}, "devices": [{"name": "CORE-R1", "router_id": "2.2.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 45705, "tx_updates": 23340, "rx_keepalives": 24471, "tx_keepalives": 10236}, {"name": "EDGE-RTR1", "router_id": "4.3.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.219", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 9659, "tx_updates": 47935, "rx_keepalives": 2479, "tx_keepalives": 5844}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.45"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:32:00Z", "neighbor": "192.0.2.3"}, "devices": [{"name": "CORE-R1", "router_id": "3.4.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.3", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 46721, "tx_updates": 39248, "rx_keepalives": 46944, "tx_keepalives": 60}, {"name": "BRANCH-RTR1", "router_id": "3.5.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.13", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 46, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 20699, "tx_updates": 36772, "rx_keepalives": 234, "tx_keepalives": 24003}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.3"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:06:00Z", "neighbor": "192.0.2.40"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.40", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 3926, "tx_updates": 45816, "rx_keepalives": 11107, "tx_keepalives": 10452}, {"name": "CORE-R1", "router_id": "1.2.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44731, "tx_updates": 19228, "rx_keepalives": 28925, "tx_keepalives": 29714}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.40 timers 30 180", "clear ip bgp 192.0.2.40"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:13:00Z", "neighbor": "192.0.2.244"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.244", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 36165, "tx_updates": 2583, "rx_keepalives": 15502, "tx_keepalives": 12494}, {"name": "DC-RTR1", "router_id": "2.4.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 45, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 18110, "tx_updates": 13093, "rx_keepalives": 36851, "tx_keepalives": 40853}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.244"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:44:00Z", "neighbor": "192.0.2.230"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.230", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 33, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 34634, "tx_updates": 42497, "rx_keepalives": 7312, "tx_keepalives": 6044}, {"name": "EDGE-RTR1", "router_id": "1.5.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 31, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 23159, "tx_updates": 13209, "rx_keepalives": 41830, "tx_keepalives": 35359}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.230"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:42:00Z", "neighbor": "192.0.2.6"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.4.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.6", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 60, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 37676, "tx_updates": 45060, "rx_keepalives": 18733, "tx_keepalives": 45252}, {"name": "BRANCH-RTR1", "router_id": "4.1.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 24217, "tx_updates": 41806, "rx_keepalives": 30992, "tx_keepalives": 35354}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.6 shutdown", "neighbor 192.0.2.6 no shutdown", "clear ip bgp 192.0.2.6"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:47:00Z", "neighbor": "192.0.2.236"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 43, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 25338, "tx_updates": 549, "rx_keepalives": 46710, "tx_keepalives": 41912}, {"name": "DC-RTR1", "router_id": "2.1.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 2454, "tx_updates": 15151, "rx_keepalives": 29605, "tx_keepalives": 1355}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.236"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:22:00Z", "neighbor": "192.0.2.131"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 44, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 29857, "tx_updates": 11472, "rx_keepalives": 10285, "tx_keepalives": 39114}, {"name": "DC-RTR1", "router_id": "5.3.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.59", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 31, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 119, "tx_updates": 15522, "rx_keepalives": 28068, "tx_keepalives": 7092}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.131 remote-as 65010", "neighbor 192.0.2.131 timers 30 90", "clear ip bgp 192.0.2.131"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:38:00Z", "neighbor": "192.0.2.216"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 38688, "tx_updates": 44477, "rx_keepalives": 11642, "tx_keepalives": 9967}, {"name": "EDGE-RTR1", "router_id": "2.4.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 36855, "tx_updates": 5833, "rx_keepalives": 459, "tx_keepalives": 15462}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.216 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:13:00Z", "neighbor": "192.0.2.60"}, "devices": [{"name": "DC-RTR1", "router_id": "1.3.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 35507, "tx_updates": 19656, "rx_keepalives": 6308, "tx_keepalives": 6425}, {"name": "CORE-R1", "router_id": "1.4.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.84", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 719, "tx_updates": 35046, "rx_keepalives": 17961, "tx_keepalives": 42047}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.60 timers 30 180", "clear ip bgp 192.0.2.60"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:36:00Z", "neighbor": "192.0.2.99"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 11780, "tx_updates": 1953, "rx_keepalives": 3094, "tx_keepalives": 9616}, {"name": "CORE-R1", "router_id": "3.4.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 14114, "tx_updates": 34277, "rx_keepalives": 21188, "tx_keepalives": 16128}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65100", "neighbor 192.0.2.99 timers 60 360", "clear ip bgp 192.0.2.99"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:38:00Z", "neighbor": "192.0.2.155"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 17660, "tx_updates": 7317, "rx_keepalives": 12361, "tx_keepalives": 14796}, {"name": "EDGE-RTR1", "router_id": "1.5.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.34", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27338, "tx_updates": 1169, "rx_keepalives": 30713, "tx_keepalives": 44472}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.155 update-source Loopback0", "neighbor 192.0.2.155 timers 30 180", "clear ip bgp 192.0.2.155"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:27:00Z", "neighbor": "192.0.2.38"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 30172, "tx_updates": 15824, "rx_keepalives": 9932, "tx_keepalives": 28652}, {"name": "BRANCH-RTR1", "router_id": "4.2.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.203", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 15, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 37291, "tx_updates": 24879, "rx_keepalives": 41984, "tx_keepalives": 46022}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.38 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:13:00Z", "neighbor": "192.0.2.48"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.2.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.48", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 4417, "tx_updates": 44334, "rx_keepalives": 31889, "tx_keepalives": 32327}, {"name": "EDGE-RTR1", "router_id": "1.2.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.107", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 31076, "tx_updates": 32223, "rx_keepalives": 24222, "tx_keepalives": 16722}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.48"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:04:00Z", "neighbor": "192.0.2.238"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.3.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.238", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 27, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 42143, "tx_updates": 38157, "rx_keepalives": 14214, "tx_keepalives": 48403}, {"name": "DC-RTR1", "router_id": "3.3.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 17478, "tx_updates": 18787, "rx_keepalives": 45506, "tx_keepalives": 17512}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.238 shutdown", "neighbor 192.0.2.238 no shutdown", "clear ip bgp 192.0.2.238"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:08:00Z", "neighbor": "192.0.2.73"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.2.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 41008, "tx_updates": 31933, "rx_keepalives": 48336, "tx_keepalives": 5675}, {"name": "BRANCH-RTR1", "router_id": "5.1.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.252", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31913, "tx_updates": 14586, "rx_keepalives": 17955, "tx_keepalives": 13170}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.73 timers 60 180", "clear ip bgp 192.0.2.73"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:15:00Z", "neighbor": "192.0.2.17"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.17", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 8875, "tx_updates": 16881, "rx_keepalives": 35663, "tx_keepalives": 33638}, {"name": "EDGE-RTR1", "router_id": "2.4.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.13", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 38037, "tx_updates": 14875, "rx_keepalives": 32864, "tx_keepalives": 33848}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.17 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:37:00Z", "neighbor": "192.0.2.74"}, "devices": [{"name": "CORE-R1", "router_id": "3.3.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 8920, "tx_updates": 39797, "rx_keepalives": 34033, "tx_keepalives": 29524}, {"name": "EDGE-RTR1", "router_id": "1.4.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 874, "tx_updates": 24662, "rx_keepalives": 26271, "tx_keepalives": 32336}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.74 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:46:00Z", "neighbor": "192.0.2.185"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 37691, "tx_updates": 30230, "rx_keepalives": 3490, "tx_keepalives": 27279}, {"name": "CORE-R1", "router_id": "4.1.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.185", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 41505, "tx_updates": 29546, "rx_keepalives": 34953, "tx_keepalives": 20010}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.185 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:46:00Z", "neighbor": "192.0.2.205"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.205", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 41548, "tx_updates": 972, "rx_keepalives": 24087, "tx_keepalives": 10799}, {"name": "EDGE-RTR1", "router_id": "2.3.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 49004, "tx_updates": 47438, "rx_keepalives": 13557, "tx_keepalives": 49833}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.205"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:33:00Z", "neighbor": "192.0.2.143"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.1.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 29852, "tx_updates": 20482, "rx_keepalives": 12357, "tx_keepalives": 44637}, {"name": "EDGE-RTR1", "router_id": "5.5.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.95", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 2254, "tx_updates": 11875, "rx_keepalives": 39591, "tx_keepalives": 1487}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.143 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:31:00Z", "neighbor": "192.0.2.173"}, "devices": [{"name": "DC-RTR1", "router_id": "2.3.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 16864, "tx_updates": 1038, "rx_keepalives": 4435, "tx_keepalives": 11610}, {"name": "EDGE-RTR1", "router_id": "2.5.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 8665, "tx_updates": 3328, "rx_keepalives": 27173, "tx_keepalives": 26494}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.173 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:52:00Z", "neighbor": "192.0.2.100"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 974, "tx_updates": 11338, "rx_keepalives": 8299, "tx_keepalives": 14347}, {"name": "BRANCH-RTR1", "router_id": "4.4.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.39", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47364, "tx_updates": 2809, "rx_keepalives": 13365, "tx_keepalives": 47442}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.100 timers 30 180", "clear ip bgp 192.0.2.100"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:42:00Z", "neighbor": "192.0.2.3"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.3", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45471, "tx_updates": 12863, "rx_keepalives": 21399, "tx_keepalives": 23623}, {"name": "DC-RTR1", "router_id": "4.5.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8037, "tx_updates": 21040, "rx_keepalives": 8019, "tx_keepalives": 25330}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.3 update-source Loopback0", "neighbor 192.0.2.3 timers 60 360", "clear ip bgp 192.0.2.3"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:53:00Z", "neighbor": "192.0.2.250"}, "devices": [{"name": "DC-RTR1", "router_id": "1.3.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2375, "tx_updates": 29187, "rx_keepalives": 44649, "tx_keepalives": 17683}, {"name": "BRANCH-RTR1", "router_id": "5.2.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.139", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31290, "tx_updates": 39676, "rx_keepalives": 30054, "tx_keepalives": 16496}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.250 timers 30 180", "clear ip bgp 192.0.2.250"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:45:00Z", "neighbor": "192.0.2.94"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.4.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 14893, "tx_updates": 36241, "rx_keepalives": 35217, "tx_keepalives": 14068}, {"name": "DC-RTR1", "router_id": "3.2.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.164", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 29002, "tx_updates": 43695, "rx_keepalives": 37354, "tx_keepalives": 6968}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.94 timers 30 90", "clear ip bgp 192.0.2.94"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:20:00Z", "neighbor": "192.0.2.11"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.3.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 10801, "tx_updates": 18578, "rx_keepalives": 31852, "tx_keepalives": 31958}, {"name": "EDGE-RTR1", "router_id": "1.2.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.206", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 1116, "tx_updates": 41399, "rx_keepalives": 41676, "tx_keepalives": 41061}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.11 update-source Loopback0", "neighbor 192.0.2.11 timers 30 90", "clear ip bgp 192.0.2.11"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:51:00Z", "neighbor": "192.0.2.47"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 29203, "tx_updates": 17906, "rx_keepalives": 49061, "tx_keepalives": 48276}, {"name": "BRANCH-RTR1", "router_id": "5.3.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44390, "tx_updates": 9805, "rx_keepalives": 34666, "tx_keepalives": 39175}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.47 update-source Loopback0", "neighbor 192.0.2.47 timers 60 180", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:56:00Z", "neighbor": "192.0.2.98"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 6223, "tx_updates": 28454, "rx_keepalives": 27269, "tx_keepalives": 48853}, {"name": "CORE-R1", "router_id": "4.4.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43364, "tx_updates": 2876, "rx_keepalives": 22938, "tx_keepalives": 20483}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.98 timers 30 180", "clear ip bgp 192.0.2.98"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:14:00Z", "neighbor": "192.0.2.60"}, "devices": [{"name": "CORE-R1", "router_id": "5.1.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 5946, "tx_updates": 32228, "rx_keepalives": 36125, "tx_keepalives": 42367}, {"name": "DC-RTR1", "router_id": "3.3.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.193", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 48, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 10489, "tx_updates": 23913, "rx_keepalives": 39682, "tx_keepalives": 24563}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.60"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:49:00Z", "neighbor": "192.0.2.49"}, "devices": [{"name": "CORE-R1", "router_id": "4.5.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 2712, "tx_updates": 24662, "rx_keepalives": 40780, "tx_keepalives": 1686}, {"name": "BRANCH-RTR1", "router_id": "4.5.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 24090, "tx_updates": 11000, "rx_keepalives": 262, "tx_keepalives": 49826}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.49 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:53:00Z", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.199", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 23072, "tx_updates": 47747, "rx_keepalives": 49745, "tx_keepalives": 19387}, {"name": "DC-RTR1", "router_id": "2.5.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 31, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 37753, "tx_updates": 49783, "rx_keepalives": 7264, "tx_keepalives": 27349}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.199 remote-as 65100", "neighbor 192.0.2.199 timers 10 60", "clear ip bgp 192.0.2.199"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:33:00Z", "neighbor": "192.0.2.168"}, "devices": [{"name": "CORE-R1", "router_id": "2.5.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 28184, "tx_updates": 39874, "rx_keepalives": 44382, "tx_keepalives": 6044}, {"name": "EDGE-RTR1", "router_id": "1.3.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.156", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 15098, "tx_updates": 15229, "rx_keepalives": 21746, "tx_keepalives": 12962}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.168 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:39:00Z", "neighbor": "192.0.2.112"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 19526, "tx_updates": 30789, "rx_keepalives": 23112, "tx_keepalives": 44064}, {"name": "EDGE-RTR1", "router_id": "4.4.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8590, "tx_updates": 34122, "rx_keepalives": 33359, "tx_keepalives": 16573}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.112 timers 30 180", "clear ip bgp 192.0.2.112"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:44:00Z", "neighbor": "192.0.2.64"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 45762, "tx_updates": 46401, "rx_keepalives": 21271, "tx_keepalives": 41507}, {"name": "DC-RTR1", "router_id": "4.5.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 34131, "tx_updates": 19492, "rx_keepalives": 22748, "tx_keepalives": 44020}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.64 timers 30 180", "clear ip bgp 192.0.2.64"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:20:00Z", "neighbor": "192.0.2.20"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.4.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 25, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 7338, "tx_updates": 46466, "rx_keepalives": 16046, "tx_keepalives": 25760}, {"name": "CORE-R1", "router_id": "5.3.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 41307, "tx_updates": 5663, "rx_keepalives": 7440, "tx_keepalives": 25339}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.20 shutdown", "neighbor 192.0.2.20 no shutdown", "clear ip bgp 192.0.2.20"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:29:00Z", "neighbor": "192.0.2.44"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.44", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 47, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 48187, "tx_updates": 15607, "rx_keepalives": 1466, "tx_keepalives": 13186}, {"name": "BRANCH-RTR1", "router_id": "2.1.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 50, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 36174, "tx_updates": 12197, "rx_keepalives": 33605, "tx_keepalives": 7018}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.44"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:55:00Z", "neighbor": "192.0.2.160"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.2.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 39147, "tx_updates": 14822, "rx_keepalives": 44632, "tx_keepalives": 39852}, {"name": "CORE-R1", "router_id": "3.5.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 7450, "tx_updates": 14707, "rx_keepalives": 40274, "tx_keepalives": 35157}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.160 timers 30 180", "clear ip bgp 192.0.2.160"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:10:00Z", "neighbor": "192.0.2.3"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.4.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 25, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 48698, "tx_updates": 15962, "rx_keepalives": 44979, "tx_keepalives": 42687}, {"name": "DC-RTR1", "router_id": "4.1.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.233", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27880, "tx_updates": 13636, "rx_keepalives": 16705, "tx_keepalives": 25533}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.3 shutdown", "neighbor 192.0.2.3 no shutdown", "clear ip bgp 192.0.2.3"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:49:00Z", "neighbor": "192.0.2.224"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 7844, "tx_updates": 523, "rx_keepalives": 3841, "tx_keepalives": 11932}, {"name": "BRANCH-RTR1", "router_id": "4.5.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 34377, "tx_updates": 6635, "rx_keepalives": 25407, "tx_keepalives": 25621}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.224"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:34:00Z", "neighbor": "192.0.2.220"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 3, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 28629, "tx_updates": 45171, "rx_keepalives": 923, "tx_keepalives": 33038}, {"name": "DC-RTR1", "router_id": "4.5.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.141", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 15024, "tx_updates": 8466, "rx_keepalives": 8441, "tx_keepalives": 31322}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.220 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:42:00Z", "neighbor": "192.0.2.49"}, "devices": [{"name": "CORE-R1", "router_id": "2.2.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.49", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 45071, "tx_updates": 39319, "rx_keepalives": 5674, "tx_keepalives": 49018}, {"name": "BRANCH-RTR1", "router_id": "2.4.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.67", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 33086, "tx_updates": 18639, "rx_keepalives": 44592, "tx_keepalives": 10589}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.49 remote-as 65010", "neighbor 192.0.2.49 timers 10 30", "clear ip bgp 192.0.2.49"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:11:00Z", "neighbor": "192.0.2.253"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 28, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 31363, "tx_updates": 18949, "rx_keepalives": 9837, "tx_keepalives": 26769}, {"name": "CORE-R1", "router_id": "3.5.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.195", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 12685, "tx_updates": 3134, "rx_keepalives": 49539, "tx_keepalives": 33535}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.253 shutdown", "neighbor 192.0.2.253 no shutdown", "clear ip bgp 192.0.2.253"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:56:00Z", "neighbor": "192.0.2.52"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 30617, "tx_updates": 49442, "rx_keepalives": 49601, "tx_keepalives": 47781}, {"name": "DC-RTR1", "router_id": "4.2.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21931, "tx_updates": 19245, "rx_keepalives": 46656, "tx_keepalives": 44643}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "neighbor 192.0.2.52 timers 60 180", "clear ip bgp 192.0.2.52"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:03:00Z", "neighbor": "192.0.2.90"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 12998, "tx_updates": 857, "rx_keepalives": 37902, "tx_keepalives": 10238}, {"name": "BRANCH-RTR1", "router_id": "1.3.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 34334, "tx_updates": 23468, "rx_keepalives": 43301, "tx_keepalives": 32917}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.90"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:59:00Z", "neighbor": "192.0.2.71"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.71", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 33859, "tx_updates": 31621, "rx_keepalives": 0, "tx_keepalives": 20753}, {"name": "BRANCH-RTR1", "router_id": "2.3.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.1", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 27347, "tx_updates": 37305, "rx_keepalives": 45954, "tx_keepalives": 18562}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.71"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:58:00Z", "neighbor": "192.0.2.102"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.102", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 2400, "tx_updates": 25457, "rx_keepalives": 38935, "tx_keepalives": 2641}, {"name": "DC-RTR1", "router_id": "3.4.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 35, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 9246, "tx_updates": 25106, "rx_keepalives": 13528, "tx_keepalives": 28738}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.102 timers 30 180", "clear ip bgp 192.0.2.102"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:34:00Z", "neighbor": "192.0.2.56"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.56", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 12, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 46021, "tx_updates": 43805, "rx_keepalives": 34808, "tx_keepalives": 8747}, {"name": "CORE-R1", "router_id": "3.3.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 25384, "tx_updates": 37760, "rx_keepalives": 40640, "tx_keepalives": 2571}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.56 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:01:00Z", "neighbor": "192.0.2.95"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.95", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 7995, "tx_updates": 44910, "rx_keepalives": 48293, "tx_keepalives": 28598}, {"name": "EDGE-RTR1", "router_id": "3.3.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.97", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 4491, "tx_updates": 15719, "rx_keepalives": 39211, "tx_keepalives": 36874}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.95 timers 30 180", "clear ip bgp 192.0.2.95"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:09:00Z", "neighbor": "192.0.2.3"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.4.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 14, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 25770, "tx_updates": 31500, "rx_keepalives": 16972, "tx_keepalives": 30374}, {"name": "CORE-R1", "router_id": "1.2.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.135", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 3506, "tx_updates": 49548, "rx_keepalives": 49997, "tx_keepalives": 47337}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.3 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:54:00Z", "neighbor": "192.0.2.225"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.4.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.225", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 18, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 27375, "tx_updates": 6648, "rx_keepalives": 22876, "tx_keepalives": 43501}, {"name": "DC-RTR1", "router_id": "2.4.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.147", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 46, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 9412, "tx_updates": 46678, "rx_keepalives": 15290, "tx_keepalives": 48434}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.225"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:31:00Z", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "router_id": "4.5.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 14362, "tx_updates": 34572, "rx_keepalives": 38090, "tx_keepalives": 19426}, {"name": "DC-RTR1", "router_id": "2.3.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 40158, "tx_updates": 13577, "rx_keepalives": 12340, "tx_keepalives": 21062}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.87 timers 30 90", "clear ip bgp 192.0.2.87"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:53:00Z", "neighbor": "192.0.2.9"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.9", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 38993, "tx_updates": 14976, "rx_keepalives": 6591, "tx_keepalives": 45075}, {"name": "CORE-R1", "router_id": "4.4.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.110", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 3325, "tx_updates": 1169, "rx_keepalives": 10566, "tx_keepalives": 23360}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "neighbor 192.0.2.9 timers 60 180", "clear ip bgp 192.0.2.9"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:42:00Z", "neighbor": "192.0.2.55"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 55, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 2268, "tx_updates": 8043, "rx_keepalives": 38906, "tx_keepalives": 1115}, {"name": "EDGE-RTR1", "router_id": "3.3.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 34, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 34671, "tx_updates": 5164, "rx_keepalives": 41899, "tx_keepalives": 49583}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.55"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:45:00Z", "neighbor": "192.0.2.118"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.5.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 26, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 47337, "tx_updates": 18310, "rx_keepalives": 48656, "tx_keepalives": 17704}, {"name": "DC-RTR1", "router_id": "4.5.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 34608, "tx_updates": 2433, "rx_keepalives": 6358, "tx_keepalives": 15488}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.118"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:17:00Z", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 26646, "tx_updates": 12686, "rx_keepalives": 14729, "tx_keepalives": 36221}, {"name": "CORE-R1", "router_id": "2.3.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 23728, "tx_updates": 24205, "rx_keepalives": 24722, "tx_keepalives": 31803}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.65 timers 30 180", "clear ip bgp 192.0.2.65"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:28:00Z", "neighbor": "192.0.2.77"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.77", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 28, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 5165, "tx_updates": 37606, "rx_keepalives": 36776, "tx_keepalives": 19812}, {"name": "CORE-R1", "router_id": "4.1.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 43, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 28967, "tx_updates": 25736, "rx_keepalives": 36181, "tx_keepalives": 34003}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.77 shutdown", "neighbor 192.0.2.77 no shutdown", "clear ip bgp 192.0.2.77"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:57:00Z", "neighbor": "192.0.2.77"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 7257, "tx_updates": 35894, "rx_keepalives": 26558, "tx_keepalives": 38653}, {"name": "CORE-R1", "router_id": "4.3.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.123", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 40951, "tx_updates": 19841, "rx_keepalives": 37438, "tx_keepalives": 14442}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.77 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:17:00Z", "neighbor": "192.0.2.221"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.221", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 18324, "tx_updates": 32129, "rx_keepalives": 20461, "tx_keepalives": 42742}, {"name": "DC-RTR1", "router_id": "1.3.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 555, "tx_updates": 4374, "rx_keepalives": 7584, "tx_keepalives": 15186}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.221 timers 30 90", "clear ip bgp 192.0.2.221"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:33:00Z", "neighbor": "192.0.2.74"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 17768, "tx_updates": 41761, "rx_keepalives": 19320, "tx_keepalives": 15275}, {"name": "DC-RTR1", "router_id": "3.1.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 1996, "tx_updates": 5369, "rx_keepalives": 27219, "tx_keepalives": 31995}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.74 update-source Loopback0", "neighbor 192.0.2.74 timers 30 90", "clear ip bgp 192.0.2.74"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:34:00Z", "neighbor": "192.0.2.236"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 22245, "tx_updates": 20792, "rx_keepalives": 10720, "tx_keepalives": 11321}, {"name": "CORE-R1", "router_id": "2.2.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43185, "tx_updates": 22062, "rx_keepalives": 47281, "tx_keepalives": 9861}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "neighbor 192.0.2.236 timers 30 180", "clear ip bgp 192.0.2.236"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:23:00Z", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.7", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 14563, "tx_updates": 2508, "rx_keepalives": 18572, "tx_keepalives": 46054}, {"name": "EDGE-RTR1", "router_id": "4.2.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.211", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 35194, "tx_updates": 18470, "rx_keepalives": 45867, "tx_keepalives": 7411}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.7"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:57:00Z", "neighbor": "192.0.2.217"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 17348, "tx_updates": 8723, "rx_keepalives": 46179, "tx_keepalives": 1836}, {"name": "BRANCH-RTR1", "router_id": "5.3.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 634, "tx_updates": 27396, "rx_keepalives": 39434, "tx_keepalives": 5239}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "neighbor 192.0.2.217 timers 60 180", "clear ip bgp 192.0.2.217"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:05:00Z", "neighbor": "192.0.2.241"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 33289, "tx_updates": 29673, "rx_keepalives": 13324, "tx_keepalives": 28652}, {"name": "CORE-R1", "router_id": "2.3.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.186", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 13329, "tx_updates": 20451, "rx_keepalives": 17281, "tx_keepalives": 271}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.241"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:03:00Z", "neighbor": "192.0.2.23"}, "devices": [{"name": "DC-RTR1", "router_id": "4.3.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 49624, "tx_updates": 27376, "rx_keepalives": 9492, "tx_keepalives": 47092}, {"name": "EDGE-RTR1", "router_id": "2.5.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 11180, "tx_updates": 28619, "rx_keepalives": 29896, "tx_keepalives": 31564}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.23"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:46:00Z", "neighbor": "192.0.2.214"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.214", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 12096, "tx_updates": 4386, "rx_keepalives": 28091, "tx_keepalives": 27715}, {"name": "DC-RTR1", "router_id": "2.4.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 23176, "tx_updates": 44454, "rx_keepalives": 31813, "tx_keepalives": 23000}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.214 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:49:00Z", "neighbor": "192.0.2.192"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.4.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.192", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 56, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42516, "tx_updates": 44671, "rx_keepalives": 127, "tx_keepalives": 32288}, {"name": "CORE-R1", "router_id": "1.4.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.81", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 49488, "tx_updates": 34991, "rx_keepalives": 800, "tx_keepalives": 604}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.192"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:31:00Z", "neighbor": "192.0.2.205"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.2.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45516, "tx_updates": 28696, "rx_keepalives": 7095, "tx_keepalives": 25841}, {"name": "CORE-R1", "router_id": "5.1.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 34341, "tx_updates": 21116, "rx_keepalives": 33120, "tx_keepalives": 1856}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.205 timers 30 180", "clear ip bgp 192.0.2.205"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:35:00Z", "neighbor": "192.0.2.58"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.58", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 5132, "tx_updates": 42335, "rx_keepalives": 44808, "tx_keepalives": 25313}, {"name": "CORE-R1", "router_id": "5.2.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 28276, "tx_updates": 34138, "rx_keepalives": 233, "tx_keepalives": 36819}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.58 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:54:00Z", "neighbor": "192.0.2.96"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 40653, "tx_updates": 39931, "rx_keepalives": 42836, "tx_keepalives": 22921}, {"name": "BRANCH-RTR1", "router_id": "3.2.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 15663, "tx_updates": 24092, "rx_keepalives": 37600, "tx_keepalives": 10875}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.96 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:53:00Z", "neighbor": "192.0.2.97"}, "devices": [{"name": "CORE-R1", "router_id": "1.2.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.97", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 35, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9404, "tx_updates": 9554, "rx_keepalives": 37956, "tx_keepalives": 31289}, {"name": "BRANCH-RTR1", "router_id": "2.5.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 29, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 16276, "tx_updates": 46610, "rx_keepalives": 20007, "tx_keepalives": 394}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.97 remote-as 65002", "neighbor 192.0.2.97 timers 30 180", "clear ip bgp 192.0.2.97"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:55:00Z", "neighbor": "192.0.2.49"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 37544, "tx_updates": 25075, "rx_keepalives": 45150, "tx_keepalives": 39206}, {"name": "BRANCH-RTR1", "router_id": "2.2.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24957, "tx_updates": 19800, "rx_keepalives": 1095, "tx_keepalives": 22349}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.49 timers 30 180", "clear ip bgp 192.0.2.49"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:10:00Z", "neighbor": "192.0.2.120"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.120", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 17065, "tx_updates": 40237, "rx_keepalives": 26969, "tx_keepalives": 35549}, {"name": "DC-RTR1", "router_id": "2.3.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.114", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8740, "tx_updates": 44549, "rx_keepalives": 37061, "tx_keepalives": 1571}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.120 update-source Loopback0", "neighbor 192.0.2.120 timers 30 180", "clear ip bgp 192.0.2.120"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:07:00Z", "neighbor": "192.0.2.210"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 37517, "tx_updates": 48837, "rx_keepalives": 32976, "tx_keepalives": 10436}, {"name": "DC-RTR1", "router_id": "5.3.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27970, "tx_updates": 17920, "rx_keepalives": 10799, "tx_keepalives": 31060}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.210"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:17:00Z", "neighbor": "192.0.2.174"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.1.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.174", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 16, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 11167, "tx_updates": 2747, "rx_keepalives": 12742, "tx_keepalives": 22098}, {"name": "DC-RTR1", "router_id": "2.3.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.223", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 5, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 26613, "tx_updates": 23243, "rx_keepalives": 4456, "tx_keepalives": 9469}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.174 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:43:00Z", "neighbor": "192.0.2.206"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 17491, "tx_updates": 19622, "rx_keepalives": 21852, "tx_keepalives": 19782}, {"name": "CORE-R1", "router_id": "1.4.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.103", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 44056, "tx_updates": 4396, "rx_keepalives": 17883, "tx_keepalives": 30422}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.206"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:33:00Z", "neighbor": "192.0.2.36"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 28, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 48160, "tx_updates": 20727, "rx_keepalives": 2262, "tx_keepalives": 36262}, {"name": "BRANCH-RTR1", "router_id": "2.4.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.120", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 36, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 42704, "tx_updates": 45667, "rx_keepalives": 20538, "tx_keepalives": 38280}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.36 shutdown", "neighbor 192.0.2.36 no shutdown", "clear ip bgp 192.0.2.36"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:58:00Z", "neighbor": "192.0.2.210"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.4.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 12778, "tx_updates": 19704, "rx_keepalives": 43178, "tx_keepalives": 47540}, {"name": "EDGE-RTR1", "router_id": "5.3.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.101", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 37, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 35564, "tx_updates": 48017, "rx_keepalives": 9650, "tx_keepalives": 43598}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.210 shutdown", "neighbor 192.0.2.210 no shutdown", "clear ip bgp 192.0.2.210"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:21:00Z", "neighbor": "192.0.2.150"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 29, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 5905, "tx_updates": 6653, "rx_keepalives": 5591, "tx_keepalives": 32868}, {"name": "DC-RTR1", "router_id": "4.3.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 46, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 41458, "tx_updates": 32414, "rx_keepalives": 22387, "tx_keepalives": 49837}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.150 remote-as 65100", "neighbor 192.0.2.150 timers 60 360", "clear ip bgp 192.0.2.150"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:02:00Z", "neighbor": "192.0.2.47"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 15948, "tx_updates": 15986, "rx_keepalives": 21594, "tx_keepalives": 45768}, {"name": "CORE-R1", "router_id": "5.1.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 31815, "tx_updates": 46273, "rx_keepalives": 39524, "tx_keepalives": 14633}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:22:00Z", "neighbor": "192.0.2.215"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 35907, "tx_updates": 38652, "rx_keepalives": 49989, "tx_keepalives": 8601}, {"name": "BRANCH-RTR1", "router_id": "4.5.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 45588, "tx_updates": 43892, "rx_keepalives": 27788, "tx_keepalives": 18082}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.215 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:18:00Z", "neighbor": "192.0.2.232"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.232", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 5518, "tx_updates": 37603, "rx_keepalives": 42841, "tx_keepalives": 39318}, {"name": "CORE-R1", "router_id": "3.1.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.44", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 22570, "tx_updates": 9840, "rx_keepalives": 3042, "tx_keepalives": 32795}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.232 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:37:00Z", "neighbor": "192.0.2.1"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 48205, "tx_updates": 3801, "rx_keepalives": 2116, "tx_keepalives": 18996}, {"name": "BRANCH-RTR1", "router_id": "1.4.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 16547, "tx_updates": 41936, "rx_keepalives": 23976, "tx_keepalives": 12232}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.1 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:11:00Z", "neighbor": "192.0.2.119"}, "devices": [{"name": "CORE-R1", "router_id": "1.3.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.119", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 47173, "tx_updates": 45007, "rx_keepalives": 24299, "tx_keepalives": 45272}, {"name": "DC-RTR1", "router_id": "2.4.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.113", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 48617, "tx_updates": 8604, "rx_keepalives": 39009, "tx_keepalives": 39218}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.119"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:15:00Z", "neighbor": "192.0.2.110"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.4.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 5855, "tx_updates": 20293, "rx_keepalives": 27518, "tx_keepalives": 34380}, {"name": "CORE-R1", "router_id": "2.2.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 24400, "tx_updates": 20591, "rx_keepalives": 16965, "tx_keepalives": 1704}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.110 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:04:00Z", "neighbor": "192.0.2.152"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.5.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.152", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44610, "tx_updates": 39108, "rx_keepalives": 49567, "tx_keepalives": 12246}, {"name": "BRANCH-RTR1", "router_id": "5.3.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 6765, "tx_updates": 46104, "rx_keepalives": 14884, "tx_keepalives": 2339}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.152 update-source Loopback0", "neighbor 192.0.2.152 timers 30 180", "clear ip bgp 192.0.2.152"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:58:00Z", "neighbor": "192.0.2.30"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.5.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 24414, "tx_updates": 49820, "rx_keepalives": 47907, "tx_keepalives": 15865}, {"name": "DC-RTR1", "router_id": "4.3.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.224", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 47623, "tx_updates": 33680, "rx_keepalives": 14794, "tx_keepalives": 37018}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.30 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:54:00Z", "neighbor": "192.0.2.229"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.5.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.229", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32188, "tx_updates": 7417, "rx_keepalives": 11097, "tx_keepalives": 41384}, {"name": "DC-RTR1", "router_id": "5.2.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.157", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8310, "tx_updates": 14918, "rx_keepalives": 41320, "tx_keepalives": 32125}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.229 update-source Loopback0", "neighbor 192.0.2.229 timers 30 90", "clear ip bgp 192.0.2.229"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:49:00Z", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.120", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 18788, "tx_updates": 35161, "rx_keepalives": 10696, "tx_keepalives": 46342}, {"name": "DC-RTR1", "router_id": "5.4.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 36632, "tx_updates": 3947, "rx_keepalives": 22381, "tx_keepalives": 15281}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.120"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:29:00Z", "neighbor": "192.0.2.43"}, "devices": [{"name": "DC-RTR1", "router_id": "1.5.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 16275, "tx_updates": 32816, "rx_keepalives": 6720, "tx_keepalives": 29218}, {"name": "EDGE-RTR1", "router_id": "4.5.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 37, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 48184, "tx_updates": 49064, "rx_keepalives": 35838, "tx_keepalives": 40343}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.43 shutdown", "neighbor 192.0.2.43 no shutdown", "clear ip bgp 192.0.2.43"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:41:00Z", "neighbor": "192.0.2.37"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27885, "tx_updates": 4055, "rx_keepalives": 49242, "tx_keepalives": 40749}, {"name": "EDGE-RTR1", "router_id": "2.1.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.137", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 37654, "tx_updates": 21392, "rx_keepalives": 17676, "tx_keepalives": 4310}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65100", "neighbor 192.0.2.37 timers 30 180", "clear ip bgp 192.0.2.37"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:21:00Z", "neighbor": "192.0.2.47"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 26432, "tx_updates": 9419, "rx_keepalives": 31496, "tx_keepalives": 48155}, {"name": "BRANCH-RTR1", "router_id": "5.5.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 3368, "tx_updates": 26639, "rx_keepalives": 48468, "tx_keepalives": 40232}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.47 timers 60 360", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:12:00Z", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "router_id": "1.3.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.104", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 48021, "tx_updates": 39182, "rx_keepalives": 37966, "tx_keepalives": 47317}, {"name": "DC-RTR1", "router_id": "5.5.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 39021, "tx_updates": 20185, "rx_keepalives": 38639, "tx_keepalives": 12949}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "neighbor 192.0.2.104 timers 30 180", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:33:00Z", "neighbor": "192.0.2.160"}, "devices": [{"name": "CORE-R1", "router_id": "2.5.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.160", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 59, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 41983, "tx_updates": 44787, "rx_keepalives": 7878, "tx_keepalives": 26354}, {"name": "DC-RTR1", "router_id": "4.3.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.195", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 19054, "tx_updates": 43766, "rx_keepalives": 36248, "tx_keepalives": 20247}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.160 remote-as 65100", "neighbor 192.0.2.160 timers 30 90", "clear ip bgp 192.0.2.160"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:07:00Z", "neighbor": "192.0.2.85"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 24, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 16284, "tx_updates": 31605, "rx_keepalives": 47647, "tx_keepalives": 23732}, {"name": "BRANCH-RTR1", "router_id": "5.3.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 54, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 26898, "tx_updates": 45128, "rx_keepalives": 12162, "tx_keepalives": 26538}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.85 remote-as 65002", "neighbor 192.0.2.85 timers 60 360", "clear ip bgp 192.0.2.85"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:04:00Z", "neighbor": "192.0.2.172"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.172", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 13487, "tx_updates": 21422, "rx_keepalives": 20945, "tx_keepalives": 19976}, {"name": "CORE-R1", "router_id": "3.4.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.201", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 11791, "tx_updates": 19126, "rx_keepalives": 49371, "tx_keepalives": 2251}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.172 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:14:00Z", "neighbor": "192.0.2.71"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.71", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 24387, "tx_updates": 14902, "rx_keepalives": 35104, "tx_keepalives": 14860}, {"name": "DC-RTR1", "router_id": "5.3.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 3152, "tx_updates": 22925, "rx_keepalives": 34289, "tx_keepalives": 45927}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.71 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:12:00Z", "neighbor": "192.0.2.62"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 4887, "tx_updates": 28779, "rx_keepalives": 36156, "tx_keepalives": 33425}, {"name": "DC-RTR1", "router_id": "4.1.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 25058, "tx_updates": 17807, "rx_keepalives": 18620, "tx_keepalives": 29271}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.62"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:40:00Z", "neighbor": "192.0.2.176"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.176", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 46464, "tx_updates": 41657, "rx_keepalives": 46458, "tx_keepalives": 8635}, {"name": "CORE-R1", "router_id": "3.4.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 1910, "tx_updates": 15744, "rx_keepalives": 4593, "tx_keepalives": 48767}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.176 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:33:00Z", "neighbor": "192.0.2.3"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 10098, "tx_updates": 43089, "rx_keepalives": 3727, "tx_keepalives": 15855}, {"name": "EDGE-RTR1", "router_id": "3.4.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 2, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 14870, "tx_updates": 18139, "rx_keepalives": 41302, "tx_keepalives": 15074}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.3 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:13:00Z", "neighbor": "192.0.2.126"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.2.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.126", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 16370, "tx_updates": 37267, "rx_keepalives": 41044, "tx_keepalives": 36942}, {"name": "BRANCH-RTR1", "router_id": "1.5.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.181", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 34829, "tx_updates": 3338, "rx_keepalives": 48124, "tx_keepalives": 35325}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.126 timers 30 180", "clear ip bgp 192.0.2.126"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:56:00Z", "neighbor": "192.0.2.74"}, "devices": [{"name": "DC-RTR1", "router_id": "5.3.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 14, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 23557, "tx_updates": 41679, "rx_keepalives": 4421, "tx_keepalives": 17904}, {"name": "BRANCH-RTR1", "router_id": "1.4.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.37", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 40, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 29389, "tx_updates": 42411, "rx_keepalives": 27273, "tx_keepalives": 10893}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.74 remote-as 65002", "neighbor 192.0.2.74 timers 30 180", "clear ip bgp 192.0.2.74"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:48:00Z", "neighbor": "192.0.2.139"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 44, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 3610, "tx_updates": 25194, "rx_keepalives": 38177, "tx_keepalives": 41314}, {"name": "CORE-R1", "router_id": "1.4.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.76", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 18, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 452, "tx_updates": 8824, "rx_keepalives": 534, "tx_keepalives": 25286}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.139 shutdown", "neighbor 192.0.2.139 no shutdown", "clear ip bgp 192.0.2.139"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:24:00Z", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.4.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 16706, "tx_updates": 18787, "rx_keepalives": 33410, "tx_keepalives": 29913}, {"name": "BRANCH-RTR1", "router_id": "5.4.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.221", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 43840, "tx_updates": 29392, "rx_keepalives": 40109, "tx_keepalives": 11929}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.178 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:59:00Z", "neighbor": "192.0.2.206"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.206", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 46613, "tx_updates": 4295, "rx_keepalives": 43541, "tx_keepalives": 6563}, {"name": "DC-RTR1", "router_id": "5.5.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 8605, "tx_updates": 5279, "rx_keepalives": 19390, "tx_keepalives": 38768}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.206 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:35:00Z", "neighbor": "192.0.2.42"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.4.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45271, "tx_updates": 23682, "rx_keepalives": 39603, "tx_keepalives": 46843}, {"name": "DC-RTR1", "router_id": "3.3.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45473, "tx_updates": 30227, "rx_keepalives": 9044, "tx_keepalives": 10215}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "neighbor 192.0.2.42 timers 60 180", "clear ip bgp 192.0.2.42"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:05:00Z", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.62", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 37351, "tx_updates": 43082, "rx_keepalives": 13032, "tx_keepalives": 36096}, {"name": "BRANCH-RTR1", "router_id": "3.1.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 34452, "tx_updates": 10603, "rx_keepalives": 48499, "tx_keepalives": 33420}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "neighbor 192.0.2.62 timers 30 90", "clear ip bgp 192.0.2.62"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:34:00Z", "neighbor": "192.0.2.194"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.194", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 943, "tx_updates": 48409, "rx_keepalives": 33249, "tx_keepalives": 41935}, {"name": "DC-RTR1", "router_id": "3.5.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 4719, "tx_updates": 22462, "rx_keepalives": 29049, "tx_keepalives": 39245}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "neighbor 192.0.2.194 timers 30 90", "clear ip bgp 192.0.2.194"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:37:00Z", "neighbor": "192.0.2.147"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.3.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 25, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 19986, "tx_updates": 21918, "rx_keepalives": 32124, "tx_keepalives": 47368}, {"name": "DC-RTR1", "router_id": "4.1.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 35816, "tx_updates": 40531, "rx_keepalives": 28393, "tx_keepalives": 8094}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.147"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:43:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 48584, "tx_updates": 9750, "rx_keepalives": 49497, "tx_keepalives": 43053}, {"name": "BRANCH-RTR1", "router_id": "5.2.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 39005, "tx_updates": 45294, "rx_keepalives": 48775, "tx_keepalives": 5461}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.75 timers 30 180", "clear ip bgp 192.0.2.75"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:10:00Z", "neighbor": "192.0.2.138"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 37019, "tx_updates": 35742, "rx_keepalives": 27091, "tx_keepalives": 46248}, {"name": "DC-RTR1", "router_id": "5.3.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.69", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 33930, "tx_updates": 2649, "rx_keepalives": 47194, "tx_keepalives": 24241}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.138 update-source Loopback0", "neighbor 192.0.2.138 timers 30 180", "clear ip bgp 192.0.2.138"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:35:00Z", "neighbor": "192.0.2.173"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.3.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 5575, "tx_updates": 41361, "rx_keepalives": 11307, "tx_keepalives": 13593}, {"name": "CORE-R1", "router_id": "5.3.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 16413, "tx_updates": 44768, "rx_keepalives": 4349, "tx_keepalives": 35201}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.173 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:31:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "router_id": "5.1.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.75", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 28578, "tx_updates": 45281, "rx_keepalives": 19927, "tx_keepalives": 6688}, {"name": "EDGE-RTR1", "router_id": "4.1.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8917, "tx_updates": 6180, "rx_keepalives": 7511, "tx_keepalives": 44720}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.75 timers 30 90", "clear ip bgp 192.0.2.75"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:50:00Z", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.2.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 5486, "tx_updates": 44990, "rx_keepalives": 37898, "tx_keepalives": 8882}, {"name": "BRANCH-RTR1", "router_id": "4.4.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 12, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 8554, "tx_updates": 7802, "rx_keepalives": 3837, "tx_keepalives": 22043}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.55 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:12:00Z", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "router_id": "3.5.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 15583, "tx_updates": 43662, "rx_keepalives": 25218, "tx_keepalives": 47909}, {"name": "BRANCH-RTR1", "router_id": "3.5.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.142", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 2, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 8068, "tx_updates": 42524, "rx_keepalives": 12536, "tx_keepalives": 9999}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.116 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:07:00Z", "neighbor": "192.0.2.153"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.153", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 53, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 25460, "tx_updates": 2145, "rx_keepalives": 16906, "tx_keepalives": 49520}, {"name": "DC-RTR1", "router_id": "5.4.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.5", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 26, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 2916, "tx_updates": 48523, "rx_keepalives": 43048, "tx_keepalives": 8114}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.153"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:39:00Z", "neighbor": "192.0.2.87"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 56, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29227, "tx_updates": 2142, "rx_keepalives": 5838, "tx_keepalives": 10104}, {"name": "BRANCH-RTR1", "router_id": "5.4.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 8502, "tx_updates": 38686, "rx_keepalives": 11988, "tx_keepalives": 39003}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.87"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:27:00Z", "neighbor": "192.0.2.169"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.169", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 36552, "tx_updates": 42620, "rx_keepalives": 15043, "tx_keepalives": 43781}, {"name": "BRANCH-RTR1", "router_id": "3.2.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.149", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 39853, "tx_updates": 12397, "rx_keepalives": 47382, "tx_keepalives": 9756}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:50:00Z", "neighbor": "192.0.2.139"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.139", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 16416, "tx_updates": 37927, "rx_keepalives": 45087, "tx_keepalives": 21312}, {"name": "DC-RTR1", "router_id": "1.4.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41575, "tx_updates": 4848, "rx_keepalives": 30073, "tx_keepalives": 27852}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "neighbor 192.0.2.139 timers 60 180", "clear ip bgp 192.0.2.139"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:52:00Z", "neighbor": "192.0.2.58"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.58", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29044, "tx_updates": 41101, "rx_keepalives": 32887, "tx_keepalives": 9424}, {"name": "CORE-R1", "router_id": "5.1.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.236", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27804, "tx_updates": 13037, "rx_keepalives": 15862, "tx_keepalives": 3007}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.58 timers 30 180", "clear ip bgp 192.0.2.58"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:51:00Z", "neighbor": "192.0.2.59"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.59", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 20769, "tx_updates": 23393, "rx_keepalives": 45297, "tx_keepalives": 32301}, {"name": "DC-RTR1", "router_id": "2.2.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 3038, "tx_updates": 5539, "rx_keepalives": 30261, "tx_keepalives": 49853}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.59 update-source Loopback0", "neighbor 192.0.2.59 timers 30 90", "clear ip bgp 192.0.2.59"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:27:00Z", "neighbor": "192.0.2.161"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.5.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 19, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 39884, "tx_updates": 31933, "rx_keepalives": 9847, "tx_keepalives": 48930}, {"name": "DC-RTR1", "router_id": "1.4.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 27, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 7992, "tx_updates": 26170, "rx_keepalives": 2096, "tx_keepalives": 13519}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.161"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:46:00Z", "neighbor": "192.0.2.111"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.2.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 1309, "tx_updates": 31111, "rx_keepalives": 26230, "tx_keepalives": 2933}, {"name": "DC-RTR1", "router_id": "2.1.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 7495, "tx_updates": 2442, "rx_keepalives": 18243, "tx_keepalives": 33204}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.111 update-source Loopback0", "neighbor 192.0.2.111 timers 30 180", "clear ip bgp 192.0.2.111"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:29:00Z", "neighbor": "192.0.2.110"}, "devices": [{"name": "DC-RTR1", "router_id": "3.5.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.110", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 33395, "tx_updates": 23900, "rx_keepalives": 39467, "tx_keepalives": 18248}, {"name": "EDGE-RTR1", "router_id": "4.1.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 29020, "tx_updates": 4641, "rx_keepalives": 24997, "tx_keepalives": 26259}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "neighbor 192.0.2.110 timers 30 180", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:13:00Z", "neighbor": "192.0.2.53"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.4.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.53", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 18560, "tx_updates": 47520, "rx_keepalives": 1434, "tx_keepalives": 48766}, {"name": "CORE-R1", "router_id": "2.4.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 31673, "tx_updates": 3546, "rx_keepalives": 25177, "tx_keepalives": 49825}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.53 remote-as 65100", "neighbor 192.0.2.53 timers 60 360", "clear ip bgp 192.0.2.53"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:40:00Z", "neighbor": "192.0.2.184"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.2.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 48868, "tx_updates": 37502, "rx_keepalives": 19081, "tx_keepalives": 19063}, {"name": "CORE-R1", "router_id": "1.2.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.238", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 3, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 5238, "tx_updates": 28002, "rx_keepalives": 47614, "tx_keepalives": 18494}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.184 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:55:00Z", "neighbor": "192.0.2.145"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.4.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 40725, "tx_updates": 8756, "rx_keepalives": 15175, "tx_keepalives": 13054}, {"name": "DC-RTR1", "router_id": "2.1.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 48449, "tx_updates": 31418, "rx_keepalives": 5080, "tx_keepalives": 38181}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.145 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:39:00Z", "neighbor": "192.0.2.32"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 43, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 11906, "tx_updates": 10568, "rx_keepalives": 22163, "tx_keepalives": 37564}, {"name": "BRANCH-RTR1", "router_id": "2.4.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 15798, "tx_updates": 47792, "rx_keepalives": 36223, "tx_keepalives": 41637}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.32"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:44:00Z", "neighbor": "192.0.2.244"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.244", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 21586, "tx_updates": 5482, "rx_keepalives": 36597, "tx_keepalives": 21746}, {"name": "DC-RTR1", "router_id": "5.1.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 41017, "tx_updates": 39512, "rx_keepalives": 24328, "tx_keepalives": 21166}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.244 shutdown", "neighbor 192.0.2.244 no shutdown", "clear ip bgp 192.0.2.244"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:11:00Z", "neighbor": "192.0.2.147"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.147", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 24568, "tx_updates": 46416, "rx_keepalives": 45858, "tx_keepalives": 2975}, {"name": "DC-RTR1", "router_id": "4.1.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 39961, "tx_updates": 44571, "rx_keepalives": 37311, "tx_keepalives": 49480}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.147 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:05:00Z", "neighbor": "192.0.2.115"}, "devices": [{"name": "CORE-R1", "router_id": "4.5.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 12973, "tx_updates": 46039, "rx_keepalives": 3148, "tx_keepalives": 25002}, {"name": "BRANCH-RTR1", "router_id": "3.2.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.250", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 2, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 29593, "tx_updates": 34877, "rx_keepalives": 33028, "tx_keepalives": 6396}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.115 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:59:00Z", "neighbor": "192.0.2.192"}, "devices": [{"name": "CORE-R1", "router_id": "2.5.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.192", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 10225, "tx_updates": 4253, "rx_keepalives": 49641, "tx_keepalives": 7774}, {"name": "EDGE-RTR1", "router_id": "2.2.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.250", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 11110, "tx_updates": 8890, "rx_keepalives": 35815, "tx_keepalives": 38985}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.192"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:41:00Z", "neighbor": "192.0.2.225"}, "devices": [{"name": "DC-RTR1", "router_id": "2.1.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.225", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 20257, "tx_updates": 31220, "rx_keepalives": 32269, "tx_keepalives": 41149}, {"name": "CORE-R1", "router_id": "3.5.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 18334, "tx_updates": 4278, "rx_keepalives": 45111, "tx_keepalives": 43418}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.225 update-source Loopback0", "neighbor 192.0.2.225 timers 30 180", "clear ip bgp 192.0.2.225"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:36:00Z", "neighbor": "192.0.2.43"}, "devices": [{"name": "DC-RTR1", "router_id": "2.3.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 18794, "tx_updates": 47310, "rx_keepalives": 25840, "tx_keepalives": 38432}, {"name": "EDGE-RTR1", "router_id": "5.4.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.31", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2121, "tx_updates": 910, "rx_keepalives": 37428, "tx_keepalives": 11697}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.43 update-source Loopback0", "neighbor 192.0.2.43 timers 30 180", "clear ip bgp 192.0.2.43"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:35:00Z", "neighbor": "192.0.2.89"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 19069, "tx_updates": 23234, "rx_keepalives": 48767, "tx_keepalives": 31922}, {"name": "BRANCH-RTR1", "router_id": "1.5.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 9561, "tx_updates": 48492, "rx_keepalives": 49902, "tx_keepalives": 21878}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.89 update-source Loopback0", "neighbor 192.0.2.89 timers 30 180", "clear ip bgp 192.0.2.89"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:23:00Z", "neighbor": "192.0.2.50"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.5.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.50", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 9466, "tx_updates": 28640, "rx_keepalives": 42887, "tx_keepalives": 39098}, {"name": "DC-RTR1", "router_id": "1.3.1.2", "local_as": 65001, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 16278, "tx_updates": 36830, "rx_keepalives": 11291, "tx_keepalives": 44676}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.50"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:26:00Z", "neighbor": "192.0.2.5"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.5", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 1369, "tx_updates": 43183, "rx_keepalives": 7011, "tx_keepalives": 3815}, {"name": "DC-RTR1", "router_id": "3.5.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8992, "tx_updates": 46324, "rx_keepalives": 122, "tx_keepalives": 17514}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.5 update-source Loopback0", "neighbor 192.0.2.5 timers 60 180", "clear ip bgp 192.0.2.5"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:11:00Z", "neighbor": "192.0.2.32"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.32", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 47, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 19411, "tx_updates": 49408, "rx_keepalives": 23091, "tx_keepalives": 1898}, {"name": "BRANCH-RTR1", "router_id": "1.4.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 36, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 37126, "tx_updates": 2167, "rx_keepalives": 32682, "tx_keepalives": 292}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.32"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:20:00Z", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.58", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47714, "tx_updates": 28854, "rx_keepalives": 47586, "tx_keepalives": 13891}, {"name": "BRANCH-RTR1", "router_id": "4.1.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.136", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 15826, "tx_updates": 46261, "rx_keepalives": 11226, "tx_keepalives": 16071}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "neighbor 192.0.2.58 timers 60 180", "clear ip bgp 192.0.2.58"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:46:00Z", "neighbor": "192.0.2.144"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 27897, "tx_updates": 15044, "rx_keepalives": 35748, "tx_keepalives": 1420}, {"name": "BRANCH-RTR1", "router_id": "4.3.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.152", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 33404, "tx_updates": 34904, "rx_keepalives": 34410, "tx_keepalives": 30748}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.144"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:28:00Z", "neighbor": "192.0.2.74"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.74", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 35379, "tx_updates": 10221, "rx_keepalives": 12412, "tx_keepalives": 11583}, {"name": "EDGE-RTR1", "router_id": "4.4.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 42636, "tx_updates": 41749, "rx_keepalives": 17295, "tx_keepalives": 17741}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.74"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:57:00Z", "neighbor": "192.0.2.213"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.213", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 40023, "tx_updates": 28450, "rx_keepalives": 38911, "tx_keepalives": 13954}, {"name": "BRANCH-RTR1", "router_id": "4.3.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25638, "tx_updates": 49915, "rx_keepalives": 38985, "tx_keepalives": 45539}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.213 update-source Loopback0", "neighbor 192.0.2.213 timers 30 180", "clear ip bgp 192.0.2.213"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:03:00Z", "neighbor": "192.0.2.73"}, "devices": [{"name": "CORE-R1", "router_id": "2.2.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 47244, "tx_updates": 34390, "rx_keepalives": 17084, "tx_keepalives": 48743}, {"name": "BRANCH-RTR1", "router_id": "3.3.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 17656, "tx_updates": 43687, "rx_keepalives": 24909, "tx_keepalives": 13733}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.73"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:09:00Z", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 30067, "tx_updates": 11650, "rx_keepalives": 47777, "tx_keepalives": 30542}, {"name": "DC-RTR1", "router_id": "1.3.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 30917, "tx_updates": 38402, "rx_keepalives": 28149, "tx_keepalives": 79}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:12:00Z", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "router_id": "2.2.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 23865, "tx_updates": 18329, "rx_keepalives": 22214, "tx_keepalives": 24109}, {"name": "EDGE-RTR1", "router_id": "3.4.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 49148, "tx_updates": 4540, "rx_keepalives": 4598, "tx_keepalives": 2113}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.189 timers 60 180", "clear ip bgp 192.0.2.189"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:33:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.2.4.5", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 39555, "tx_updates": 38093, "rx_keepalives": 45120, "tx_keepalives": 27099}, {"name": "CORE-R1", "router_id": "5.2.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 16445, "tx_updates": 7485, "rx_keepalives": 42796, "tx_keepalives": 16095}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "neighbor 192.0.2.81 timers 30 180", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:21:00Z", "neighbor": "192.0.2.17"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.17", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 29, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 19365, "tx_updates": 3805, "rx_keepalives": 30315, "tx_keepalives": 41340}, {"name": "DC-RTR1", "router_id": "4.4.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.106", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 45, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 27456, "tx_updates": 5867, "rx_keepalives": 17270, "tx_keepalives": 26286}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.17"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:26:00Z", "neighbor": "192.0.2.153"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.153", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 37685, "tx_updates": 32320, "rx_keepalives": 17568, "tx_keepalives": 19367}, {"name": "BRANCH-RTR1", "router_id": "4.3.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.155", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 3289, "tx_updates": 44639, "rx_keepalives": 22935, "tx_keepalives": 43573}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.153"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:19:00Z", "neighbor": "192.0.2.107"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.5.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 35717, "tx_updates": 37417, "rx_keepalives": 17410, "tx_keepalives": 21086}, {"name": "BRANCH-RTR1", "router_id": "3.4.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.156", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 44985, "tx_updates": 19636, "rx_keepalives": 18742, "tx_keepalives": 22788}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.107"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:26:00Z", "neighbor": "192.0.2.241"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 50, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 35621, "tx_updates": 19205, "rx_keepalives": 1813, "tx_keepalives": 44526}, {"name": "DC-RTR1", "router_id": "4.5.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 10608, "tx_updates": 2066, "rx_keepalives": 20561, "tx_keepalives": 40665}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.241 remote-as 65010", "neighbor 192.0.2.241 timers 60 180", "clear ip bgp 192.0.2.241"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:45:00Z", "neighbor": "192.0.2.60"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 43952, "tx_updates": 36292, "rx_keepalives": 15018, "tx_keepalives": 29578}, {"name": "CORE-R1", "router_id": "4.4.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 32, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27575, "tx_updates": 43633, "rx_keepalives": 41515, "tx_keepalives": 8034}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.60 remote-as 65002", "neighbor 192.0.2.60 timers 60 180", "clear ip bgp 192.0.2.60"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:14:00Z", "neighbor": "192.0.2.202"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 45119, "tx_updates": 14609, "rx_keepalives": 37869, "tx_keepalives": 8225}, {"name": "BRANCH-RTR1", "router_id": "4.5.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.165", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 14676, "tx_updates": 6947, "rx_keepalives": 34304, "tx_keepalives": 26319}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.202 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:58:00Z", "neighbor": "192.0.2.146"}, "devices": [{"name": "DC-RTR1", "router_id": "2.4.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 4800, "tx_updates": 18923, "rx_keepalives": 34879, "tx_keepalives": 41765}, {"name": "BRANCH-RTR1", "router_id": "2.3.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 16587, "tx_updates": 14455, "rx_keepalives": 36308, "tx_keepalives": 21374}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.146 shutdown", "neighbor 192.0.2.146 no shutdown", "clear ip bgp 192.0.2.146"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:12:00Z", "neighbor": "192.0.2.82"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.2.5", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 44716, "tx_updates": 16580, "rx_keepalives": 569, "tx_keepalives": 10959}, {"name": "DC-RTR1", "router_id": "5.1.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.132", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 24017, "tx_updates": 7899, "rx_keepalives": 29410, "tx_keepalives": 31094}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.82"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:19:00Z", "neighbor": "192.0.2.55"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 17691, "tx_updates": 4154, "rx_keepalives": 14802, "tx_keepalives": 43092}, {"name": "CORE-R1", "router_id": "5.4.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 25, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 32252, "tx_updates": 13155, "rx_keepalives": 46616, "tx_keepalives": 8747}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.55"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:34:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.75", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 18984, "tx_updates": 33721, "rx_keepalives": 35074, "tx_keepalives": 21478}, {"name": "BRANCH-RTR1", "router_id": "4.3.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.73", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 47432, "tx_updates": 31619, "rx_keepalives": 23226, "tx_keepalives": 10165}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.75 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:21:00Z", "neighbor": "192.0.2.156"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.156", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 22024, "tx_updates": 29047, "rx_keepalives": 44238, "tx_keepalives": 13893}, {"name": "DC-RTR1", "router_id": "3.1.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.121", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 15680, "tx_updates": 17551, "rx_keepalives": 20692, "tx_keepalives": 48214}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.156"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:45:00Z", "neighbor": "192.0.2.254"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.254", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 24933, "tx_updates": 2147, "rx_keepalives": 36158, "tx_keepalives": 41417}, {"name": "EDGE-RTR1", "router_id": "5.2.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 6202, "tx_updates": 41226, "rx_keepalives": 30316, "tx_keepalives": 6883}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.254 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:24:00Z", "neighbor": "192.0.2.96"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 33352, "tx_updates": 1656, "rx_keepalives": 42401, "tx_keepalives": 45989}, {"name": "EDGE-RTR1", "router_id": "4.1.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 35, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21679, "tx_updates": 46370, "rx_keepalives": 3950, "tx_keepalives": 31809}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.96 timers 60 360", "clear ip bgp 192.0.2.96"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:20:00Z", "neighbor": "192.0.2.99"}, "devices": [{"name": "CORE-R1", "router_id": "5.1.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 47574, "tx_updates": 32246, "rx_keepalives": 48582, "tx_keepalives": 43468}, {"name": "BRANCH-RTR1", "router_id": "3.4.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43650, "tx_updates": 42574, "rx_keepalives": 49963, "tx_keepalives": 43756}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.99 update-source Loopback0", "neighbor 192.0.2.99 timers 30 90", "clear ip bgp 192.0.2.99"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:36:00Z", "neighbor": "192.0.2.242"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.5.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.242", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 34307, "tx_updates": 8454, "rx_keepalives": 6712, "tx_keepalives": 44156}, {"name": "BRANCH-RTR1", "router_id": "4.4.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 22985, "tx_updates": 28166, "rx_keepalives": 4595, "tx_keepalives": 40388}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.242"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:15:00Z", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.18", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 32, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 13296, "tx_updates": 28237, "rx_keepalives": 27288, "tx_keepalives": 45193}, {"name": "DC-RTR1", "router_id": "5.2.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.254", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24416, "tx_updates": 5191, "rx_keepalives": 39589, "tx_keepalives": 12982}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.18 remote-as 65010", "neighbor 192.0.2.18 timers 60 180", "clear ip bgp 192.0.2.18"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:31:00Z", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.3.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 3, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 27478, "tx_updates": 9712, "rx_keepalives": 35503, "tx_keepalives": 2213}, {"name": "BRANCH-RTR1", "router_id": "2.1.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 6080, "tx_updates": 45708, "rx_keepalives": 23452, "tx_keepalives": 33650}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.181 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:04:00Z", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.1.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 24033, "tx_updates": 20801, "rx_keepalives": 35460, "tx_keepalives": 10041}, {"name": "DC-RTR1", "router_id": "2.5.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 2085, "tx_updates": 22673, "rx_keepalives": 44016, "tx_keepalives": 10201}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.18 timers 30 180", "clear ip bgp 192.0.2.18"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:40:00Z", "neighbor": "192.0.2.3"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 24102, "tx_updates": 34389, "rx_keepalives": 26043, "tx_keepalives": 44223}, {"name": "CORE-R1", "router_id": "5.1.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 37, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 21779, "tx_updates": 30232, "rx_keepalives": 45414, "tx_keepalives": 37277}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.3"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:48:00Z", "neighbor": "192.0.2.246"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 55, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 38450, "tx_updates": 286, "rx_keepalives": 40679, "tx_keepalives": 38872}, {"name": "BRANCH-RTR1", "router_id": "1.5.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 59, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 18406, "tx_updates": 15509, "rx_keepalives": 26687, "tx_keepalives": 14927}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.246 remote-as 65002", "neighbor 192.0.2.246 timers 30 90", "clear ip bgp 192.0.2.246"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:35:00Z", "neighbor": "192.0.2.247"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.247", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 29, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 30127, "tx_updates": 19602, "rx_keepalives": 25416, "tx_keepalives": 22872}, {"name": "CORE-R1", "router_id": "1.3.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.162", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 27, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 46179, "tx_updates": 12805, "rx_keepalives": 45204, "tx_keepalives": 29317}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.247 shutdown", "neighbor 192.0.2.247 no shutdown", "clear ip bgp 192.0.2.247"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:09:00Z", "neighbor": "192.0.2.117"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.4.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.117", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 14, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 19645, "tx_updates": 28987, "rx_keepalives": 158, "tx_keepalives": 32800}, {"name": "CORE-R1", "router_id": "1.5.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 56, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 28139, "tx_updates": 33492, "rx_keepalives": 14543, "tx_keepalives": 6030}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.117 remote-as 65002", "neighbor 192.0.2.117 timers 10 60", "clear ip bgp 192.0.2.117"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:59:00Z", "neighbor": "192.0.2.19"}, "devices": [{"name": "DC-RTR1", "router_id": "5.1.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 3526, "tx_updates": 6403, "rx_keepalives": 1406, "tx_keepalives": 27040}, {"name": "CORE-R1", "router_id": "2.1.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 28809, "tx_updates": 40927, "rx_keepalives": 35517, "tx_keepalives": 44880}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.19 update-source Loopback0", "neighbor 192.0.2.19 timers 30 90", "clear ip bgp 192.0.2.19"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:29:00Z", "neighbor": "192.0.2.213"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.2.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 36096, "tx_updates": 7051, "rx_keepalives": 25853, "tx_keepalives": 43376}, {"name": "BRANCH-RTR1", "router_id": "4.1.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.214", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 10845, "tx_updates": 48633, "rx_keepalives": 45671, "tx_keepalives": 46067}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.213 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:00:00Z", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "router_id": "2.2.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.185", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 31184, "tx_updates": 33206, "rx_keepalives": 24471, "tx_keepalives": 47012}, {"name": "BRANCH-RTR1", "router_id": "1.3.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 33722, "tx_updates": 49531, "rx_keepalives": 46180, "tx_keepalives": 24020}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.185"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:58:00Z", "neighbor": "192.0.2.109"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 37084, "tx_updates": 6395, "rx_keepalives": 8381, "tx_keepalives": 2969}, {"name": "CORE-R1", "router_id": "4.2.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 46839, "tx_updates": 29476, "rx_keepalives": 42144, "tx_keepalives": 30995}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.109 timers 30 180", "clear ip bgp 192.0.2.109"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:01:00Z", "neighbor": "192.0.2.83"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 22340, "tx_updates": 19734, "rx_keepalives": 28903, "tx_keepalives": 45448}, {"name": "CORE-R1", "router_id": "1.3.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.229", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 4986, "tx_updates": 13852, "rx_keepalives": 13305, "tx_keepalives": 36956}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.83 update-source Loopback0", "neighbor 192.0.2.83 timers 60 360", "clear ip bgp 192.0.2.83"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:15:00Z", "neighbor": "192.0.2.63"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.4.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 21834, "tx_updates": 13064, "rx_keepalives": 17208, "tx_keepalives": 14187}, {"name": "EDGE-RTR1", "router_id": "2.2.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.187", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44995, "tx_updates": 49823, "rx_keepalives": 15650, "tx_keepalives": 11915}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.63 shutdown", "neighbor 192.0.2.63 no shutdown", "clear ip bgp 192.0.2.63"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:41:00Z", "neighbor": "192.0.2.102"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.102", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32763, "tx_updates": 10173, "rx_keepalives": 47574, "tx_keepalives": 47241}, {"name": "CORE-R1", "router_id": "3.4.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.124", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21182, "tx_updates": 26279, "rx_keepalives": 8119, "tx_keepalives": 27792}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.102 timers 30 180", "clear ip bgp 192.0.2.102"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:57:00Z", "neighbor": "192.0.2.174"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.2.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 33, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 10585, "tx_updates": 39252, "rx_keepalives": 6389, "tx_keepalives": 43681}, {"name": "BRANCH-RTR1", "router_id": "5.1.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31522, "tx_updates": 11186, "rx_keepalives": 33058, "tx_keepalives": 18997}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.174 remote-as 65010", "neighbor 192.0.2.174 timers 60 360", "clear ip bgp 192.0.2.174"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:11:00Z", "neighbor": "192.0.2.190"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9163, "tx_updates": 23978, "rx_keepalives": 43925, "tx_keepalives": 13934}, {"name": "BRANCH-RTR1", "router_id": "1.4.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 17361, "tx_updates": 27703, "rx_keepalives": 40423, "tx_keepalives": 49496}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.190 timers 30 180", "clear ip bgp 192.0.2.190"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:44:00Z", "neighbor": "192.0.2.26"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44507, "tx_updates": 5007, "rx_keepalives": 32437, "tx_keepalives": 43200}, {"name": "EDGE-RTR1", "router_id": "5.5.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.222", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 45, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 31527, "tx_updates": 18944, "rx_keepalives": 11843, "tx_keepalives": 18541}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.26 shutdown", "neighbor 192.0.2.26 no shutdown", "clear ip bgp 192.0.2.26"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:01:00Z", "neighbor": "192.0.2.16"}, "devices": [{"name": "DC-RTR1", "router_id": "4.3.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 21582, "tx_updates": 41637, "rx_keepalives": 12189, "tx_keepalives": 22159}, {"name": "BRANCH-RTR1", "router_id": "3.5.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.107", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 16879, "tx_updates": 6790, "rx_keepalives": 1557, "tx_keepalives": 30181}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.16 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:14:00Z", "neighbor": "192.0.2.202"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 6594, "tx_updates": 21330, "rx_keepalives": 28487, "tx_keepalives": 49160}, {"name": "EDGE-RTR1", "router_id": "4.4.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 25, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 49588, "tx_updates": 7190, "rx_keepalives": 20768, "tx_keepalives": 24616}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.202 timers 60 180", "clear ip bgp 192.0.2.202"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:48:00Z", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 41790, "tx_updates": 48940, "rx_keepalives": 11517, "tx_keepalives": 39497}, {"name": "BRANCH-RTR1", "router_id": "5.3.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 49599, "tx_updates": 18554, "rx_keepalives": 32063, "tx_keepalives": 25138}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.35 timers 60 360", "clear ip bgp 192.0.2.35"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:14:00Z", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.169", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 28003, "tx_updates": 43953, "rx_keepalives": 1008, "tx_keepalives": 37084}, {"name": "DC-RTR1", "router_id": "3.1.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.97", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 49751, "tx_updates": 40354, "rx_keepalives": 35395, "tx_keepalives": 20028}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:20:00Z", "neighbor": "192.0.2.231"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.5.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 47308, "tx_updates": 43338, "rx_keepalives": 12209, "tx_keepalives": 31240}, {"name": "CORE-R1", "router_id": "5.3.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 5400, "tx_updates": 48741, "rx_keepalives": 47847, "tx_keepalives": 31368}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.231"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:27:00Z", "neighbor": "192.0.2.10"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 46254, "tx_updates": 48740, "rx_keepalives": 18008, "tx_keepalives": 17189}, {"name": "EDGE-RTR1", "router_id": "4.2.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 44323, "tx_updates": 27442, "rx_keepalives": 13822, "tx_keepalives": 9439}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.10 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:50:00Z", "neighbor": "192.0.2.221"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.5.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.221", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 16921, "tx_updates": 35277, "rx_keepalives": 34931, "tx_keepalives": 22298}, {"name": "EDGE-RTR1", "router_id": "3.1.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 5737, "tx_updates": 28334, "rx_keepalives": 49918, "tx_keepalives": 9227}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "neighbor 192.0.2.221 timers 30 90", "clear ip bgp 192.0.2.221"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:26:00Z", "neighbor": "192.0.2.92"}, "devices": [{"name": "CORE-R1", "router_id": "3.4.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 46904, "tx_updates": 25475, "rx_keepalives": 20033, "tx_keepalives": 7693}, {"name": "DC-RTR1", "router_id": "3.5.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.134", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 4315, "tx_updates": 32575, "rx_keepalives": 15310, "tx_keepalives": 46582}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.92 timers 30 180", "clear ip bgp 192.0.2.92"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:08:00Z", "neighbor": "192.0.2.63"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.4.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 5, "tx_updates": 22275, "rx_keepalives": 27148, "tx_keepalives": 20745}, {"name": "EDGE-RTR1", "router_id": "2.4.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 40054, "tx_updates": 15603, "rx_keepalives": 19281, "tx_keepalives": 13759}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.63 timers 60 180", "clear ip bgp 192.0.2.63"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:14:00Z", "neighbor": "192.0.2.209"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.209", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 33644, "tx_updates": 8659, "rx_keepalives": 49435, "tx_keepalives": 36485}, {"name": "BRANCH-RTR1", "router_id": "4.2.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 20773, "tx_updates": 41955, "rx_keepalives": 20565, "tx_keepalives": 25710}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.209 shutdown", "neighbor 192.0.2.209 no shutdown", "clear ip bgp 192.0.2.209"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:22:00Z", "neighbor": "192.0.2.51"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.4.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 21030, "tx_updates": 23006, "rx_keepalives": 40418, "tx_keepalives": 37082}, {"name": "DC-RTR1", "router_id": "4.4.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 30, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 35604, "tx_updates": 35037, "rx_keepalives": 35079, "tx_keepalives": 13498}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.51 shutdown", "neighbor 192.0.2.51 no shutdown", "clear ip bgp 192.0.2.51"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:50:00Z", "neighbor": "192.0.2.32"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.2.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.32", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 20589, "tx_updates": 6336, "rx_keepalives": 2295, "tx_keepalives": 6647}, {"name": "EDGE-RTR1", "router_id": "4.2.5.5", "local_as": 65001, "neighbor_ip": "192.0.2.28", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 41156, "tx_updates": 12893, "rx_keepalives": 43494, "tx_keepalives": 5178}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.32 update-source Loopback0", "neighbor 192.0.2.32 timers 60 360", "clear ip bgp 192.0.2.32"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:47:00Z", "neighbor": "192.0.2.123"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.123", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 35, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 35836, "tx_updates": 46066, "rx_keepalives": 25225, "tx_keepalives": 2938}, {"name": "EDGE-RTR1", "router_id": "2.2.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 41, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 47078, "tx_updates": 25758, "rx_keepalives": 20293, "tx_keepalives": 13767}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.123 shutdown", "neighbor 192.0.2.123 no shutdown", "clear ip bgp 192.0.2.123"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:39:00Z", "neighbor": "192.0.2.145"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 13263, "tx_updates": 24540, "rx_keepalives": 37907, "tx_keepalives": 25769}, {"name": "BRANCH-RTR1", "router_id": "2.4.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.87", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25303, "tx_updates": 16159, "rx_keepalives": 32921, "tx_keepalives": 43122}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.145 timers 60 360", "clear ip bgp 192.0.2.145"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:02:00Z", "neighbor": "192.0.2.68"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.68", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 31, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 46950, "tx_updates": 17021, "rx_keepalives": 22075, "tx_keepalives": 6720}, {"name": "DC-RTR1", "router_id": "3.2.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.163", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44146, "tx_updates": 37700, "rx_keepalives": 20580, "tx_keepalives": 9264}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.68"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:07:00Z", "neighbor": "192.0.2.245"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.4.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 26770, "tx_updates": 32293, "rx_keepalives": 46082, "tx_keepalives": 32581}, {"name": "BRANCH-RTR1", "router_id": "2.2.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.210", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 23295, "tx_updates": 3473, "rx_keepalives": 13738, "tx_keepalives": 49909}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.245 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:11:00Z", "neighbor": "192.0.2.233"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.233", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 33553, "tx_updates": 31875, "rx_keepalives": 9870, "tx_keepalives": 32750}, {"name": "BRANCH-RTR1", "router_id": "2.3.3.1", "local_as": 65100, "neighbor_ip": "192.0.2.66", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 6777, "tx_updates": 521, "rx_keepalives": 38800, "tx_keepalives": 343}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.233"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:54:00Z", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "router_id": "3.4.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.199", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 46702, "tx_updates": 18845, "rx_keepalives": 36556, "tx_keepalives": 44803}, {"name": "DC-RTR1", "router_id": "4.1.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 47432, "tx_updates": 41060, "rx_keepalives": 34506, "tx_keepalives": 47861}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.199 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:14:00Z", "neighbor": "192.0.2.77"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.3.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.77", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 5710, "tx_updates": 12675, "rx_keepalives": 4634, "tx_keepalives": 39027}, {"name": "CORE-R1", "router_id": "3.3.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.249", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 33349, "tx_updates": 20294, "rx_keepalives": 48716, "tx_keepalives": 7736}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.77"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:34:00Z", "neighbor": "192.0.2.126"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 54, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 15665, "tx_updates": 5764, "rx_keepalives": 37963, "tx_keepalives": 13454}, {"name": "CORE-R1", "router_id": "5.3.2.2", "local_as": 65001, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 34, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 46326, "tx_updates": 47367, "rx_keepalives": 25489, "tx_keepalives": 46531}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.126"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:45:00Z", "neighbor": "192.0.2.58"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.2.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.58", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 35990, "tx_updates": 5677, "rx_keepalives": 13964, "tx_keepalives": 30369}, {"name": "BRANCH-RTR1", "router_id": "4.5.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.72", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44537, "tx_updates": 13565, "rx_keepalives": 43970, "tx_keepalives": 3456}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.58 update-source Loopback0", "neighbor 192.0.2.58 timers 30 180", "clear ip bgp 192.0.2.58"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:01:00Z", "neighbor": "192.0.2.49"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.5.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 37387, "tx_updates": 9953, "rx_keepalives": 15860, "tx_keepalives": 14678}, {"name": "CORE-R1", "router_id": "5.5.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.236", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 29036, "tx_updates": 26534, "rx_keepalives": 32017, "tx_keepalives": 19643}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.49 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:58:00Z", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.5.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 8944, "tx_updates": 4171, "rx_keepalives": 33, "tx_keepalives": 4644}, {"name": "CORE-R1", "router_id": "1.2.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 32830, "tx_updates": 13947, "rx_keepalives": 37019, "tx_keepalives": 48475}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.178 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:19:00Z", "neighbor": "192.0.2.173"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 32725, "tx_updates": 4409, "rx_keepalives": 28539, "tx_keepalives": 40518}, {"name": "CORE-R1", "router_id": "1.1.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 15684, "tx_updates": 15093, "rx_keepalives": 13181, "tx_keepalives": 46866}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.173 shutdown", "neighbor 192.0.2.173 no shutdown", "clear ip bgp 192.0.2.173"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:07:00Z", "neighbor": "192.0.2.103"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.103", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 48508, "tx_updates": 18734, "rx_keepalives": 2906, "tx_keepalives": 47839}, {"name": "EDGE-RTR1", "router_id": "4.1.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 7701, "tx_updates": 28277, "rx_keepalives": 18257, "tx_keepalives": 23162}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.103 update-source Loopback0", "neighbor 192.0.2.103 timers 60 360", "clear ip bgp 192.0.2.103"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:56:00Z", "neighbor": "192.0.2.143"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.143", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 28276, "tx_updates": 42389, "rx_keepalives": 39438, "tx_keepalives": 1809}, {"name": "EDGE-RTR1", "router_id": "5.5.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 11841, "tx_updates": 38669, "rx_keepalives": 39677, "tx_keepalives": 49505}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.143 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:32:00Z", "neighbor": "192.0.2.33"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.33", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31788, "tx_updates": 11263, "rx_keepalives": 34149, "tx_keepalives": 1643}, {"name": "EDGE-RTR1", "router_id": "5.4.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44191, "tx_updates": 10412, "rx_keepalives": 13675, "tx_keepalives": 30615}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.33 timers 30 180", "clear ip bgp 192.0.2.33"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:41:00Z", "neighbor": "192.0.2.243"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.243", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 15082, "tx_updates": 10458, "rx_keepalives": 26792, "tx_keepalives": 39132}, {"name": "DC-RTR1", "router_id": "4.4.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 33910, "tx_updates": 6381, "rx_keepalives": 33538, "tx_keepalives": 29851}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.243 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:20:00Z", "neighbor": "192.0.2.150"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.4.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.150", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 14835, "tx_updates": 29674, "rx_keepalives": 23645, "tx_keepalives": 35580}, {"name": "DC-RTR1", "router_id": "1.1.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 26767, "tx_updates": 28513, "rx_keepalives": 34076, "tx_keepalives": 30981}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "neighbor 192.0.2.150 timers 60 180", "clear ip bgp 192.0.2.150"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:17:00Z", "neighbor": "192.0.2.212"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.3.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.212", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9817, "tx_updates": 45100, "rx_keepalives": 48297, "tx_keepalives": 44515}, {"name": "CORE-R1", "router_id": "1.1.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.132", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 33566, "tx_updates": 41329, "rx_keepalives": 34783, "tx_keepalives": 47223}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.212 update-source Loopback0", "neighbor 192.0.2.212 timers 60 360", "clear ip bgp 192.0.2.212"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:44:00Z", "neighbor": "192.0.2.75"}, "devices": [{"name": "DC-RTR1", "router_id": "1.5.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 51, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 19917, "tx_updates": 41029, "rx_keepalives": 39086, "tx_keepalives": 47295}, {"name": "CORE-R1", "router_id": "5.1.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 54, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 22830, "tx_updates": 252, "rx_keepalives": 10783, "tx_keepalives": 45013}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.75"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:33:00Z", "neighbor": "192.0.2.191"}, "devices": [{"name": "DC-RTR1", "router_id": "3.3.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.191", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 6044, "tx_updates": 45185, "rx_keepalives": 20291, "tx_keepalives": 3593}, {"name": "CORE-R1", "router_id": "3.1.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 237, "tx_updates": 5367, "rx_keepalives": 4500, "tx_keepalives": 32472}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.191 timers 30 90", "clear ip bgp 192.0.2.191"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:00:00Z", "neighbor": "192.0.2.242"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.5.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 8658, "tx_updates": 40266, "rx_keepalives": 36041, "tx_keepalives": 9051}, {"name": "CORE-R1", "router_id": "2.3.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 40184, "tx_updates": 12496, "rx_keepalives": 33803, "tx_keepalives": 14383}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "neighbor 192.0.2.242 timers 60 180", "clear ip bgp 192.0.2.242"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:20:00Z", "neighbor": "192.0.2.52"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.2.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 15615, "tx_updates": 20626, "rx_keepalives": 18952, "tx_keepalives": 10894}, {"name": "DC-RTR1", "router_id": "3.1.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 43, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 16142, "tx_updates": 1251, "rx_keepalives": 26232, "tx_keepalives": 21103}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.52"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:07:00Z", "neighbor": "192.0.2.112"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 60, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 4144, "tx_updates": 34456, "rx_keepalives": 15047, "tx_keepalives": 3761}, {"name": "CORE-R1", "router_id": "2.3.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.59", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 21, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 36017, "tx_updates": 16367, "rx_keepalives": 18474, "tx_keepalives": 21928}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.112"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:34:00Z", "neighbor": "192.0.2.218"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.218", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 40808, "tx_updates": 23229, "rx_keepalives": 32013, "tx_keepalives": 43237}, {"name": "DC-RTR1", "router_id": "3.4.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.109", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 31594, "tx_updates": 11358, "rx_keepalives": 12563, "tx_keepalives": 29424}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.218"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:17:00Z", "neighbor": "192.0.2.226"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 35604, "tx_updates": 8439, "rx_keepalives": 6339, "tx_keepalives": 5470}, {"name": "CORE-R1", "router_id": "1.1.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.107", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 401, "tx_updates": 751, "rx_keepalives": 42968, "tx_keepalives": 35554}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.226 timers 30 90", "clear ip bgp 192.0.2.226"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:17:00Z", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43344, "tx_updates": 24486, "rx_keepalives": 14377, "tx_keepalives": 2745}, {"name": "BRANCH-RTR1", "router_id": "1.5.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.11", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 46383, "tx_updates": 5571, "rx_keepalives": 5949, "tx_keepalives": 2503}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "neighbor 192.0.2.20 timers 30 180", "clear ip bgp 192.0.2.20"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:11:00Z", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.185", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 10032, "tx_updates": 17566, "rx_keepalives": 42608, "tx_keepalives": 40116}, {"name": "DC-RTR1", "router_id": "4.5.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.162", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 36898, "tx_updates": 16816, "rx_keepalives": 44867, "tx_keepalives": 5077}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.185 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:21:00Z", "neighbor": "192.0.2.117"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.117", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 42, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 1338, "tx_updates": 41472, "rx_keepalives": 33326, "tx_keepalives": 454}, {"name": "DC-RTR1", "router_id": "3.4.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 49, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 35919, "tx_updates": 30474, "rx_keepalives": 11647, "tx_keepalives": 36282}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.117 remote-as 65100", "neighbor 192.0.2.117 timers 10 30", "clear ip bgp 192.0.2.117"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:01:00Z", "neighbor": "192.0.2.154"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43479, "tx_updates": 39358, "rx_keepalives": 18180, "tx_keepalives": 15308}, {"name": "DC-RTR1", "router_id": "4.4.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25713, "tx_updates": 47353, "rx_keepalives": 44659, "tx_keepalives": 25253}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.154 timers 30 180", "clear ip bgp 192.0.2.154"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:13:00Z", "neighbor": "192.0.2.83"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.4.1.3", "local_as": 65010, "neighbor_ip": "192.0.2.83", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 35040, "tx_updates": 7175, "rx_keepalives": 19882, "tx_keepalives": 43981}, {"name": "EDGE-RTR1", "router_id": "2.1.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 24558, "tx_updates": 47679, "rx_keepalives": 48227, "tx_keepalives": 11882}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.83 remote-as 65001", "neighbor 192.0.2.83 timers 60 180", "clear ip bgp 192.0.2.83"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:58:00Z", "neighbor": "192.0.2.186"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 2935, "tx_updates": 1239, "rx_keepalives": 44028, "tx_keepalives": 31489}, {"name": "DC-RTR1", "router_id": "4.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.180", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 26121, "tx_updates": 23310, "rx_keepalives": 39625, "tx_keepalives": 8577}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.186 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:44:00Z", "neighbor": "192.0.2.203"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 28722, "tx_updates": 37463, "rx_keepalives": 9068, "tx_keepalives": 49193}, {"name": "CORE-R1", "router_id": "2.2.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.4", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9044, "tx_updates": 6228, "rx_keepalives": 1952, "tx_keepalives": 37749}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.203 update-source Loopback0", "neighbor 192.0.2.203 timers 60 360", "clear ip bgp 192.0.2.203"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:14:00Z", "neighbor": "192.0.2.143"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 9147, "tx_updates": 48257, "rx_keepalives": 28962, "tx_keepalives": 49431}, {"name": "BRANCH-RTR1", "router_id": "2.1.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.232", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 22481, "tx_updates": 35845, "rx_keepalives": 10011, "tx_keepalives": 12473}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "neighbor 192.0.2.143 timers 30 180", "clear ip bgp 192.0.2.143"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:32:00Z", "neighbor": "192.0.2.225"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.1.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.225", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 59, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 23701, "tx_updates": 19510, "rx_keepalives": 9262, "tx_keepalives": 29785}, {"name": "EDGE-RTR1", "router_id": "1.2.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 36, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 49812, "tx_updates": 41067, "rx_keepalives": 42547, "tx_keepalives": 42899}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.225"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:15:00Z", "neighbor": "192.0.2.33"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 18967, "tx_updates": 21385, "rx_keepalives": 14181, "tx_keepalives": 28896}, {"name": "DC-RTR1", "router_id": "3.2.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.162", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 56, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45171, "tx_updates": 46025, "rx_keepalives": 40898, "tx_keepalives": 37415}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.33 remote-as 65002", "neighbor 192.0.2.33 timers 10 30", "clear ip bgp 192.0.2.33"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:24:00Z", "neighbor": "192.0.2.16"}, "devices": [{"name": "DC-RTR1", "router_id": "3.3.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.16", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44602, "tx_updates": 46237, "rx_keepalives": 4004, "tx_keepalives": 36721}, {"name": "BRANCH-RTR1", "router_id": "1.4.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 26, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 2777, "tx_updates": 17000, "rx_keepalives": 10435, "tx_keepalives": 13328}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.16 remote-as 65010", "neighbor 192.0.2.16 timers 10 30", "clear ip bgp 192.0.2.16"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:21:00Z", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "router_id": "3.5.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 33, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 21079, "tx_updates": 13069, "rx_keepalives": 44383, "tx_keepalives": 6521}, {"name": "EDGE-RTR1", "router_id": "2.3.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 51, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 2637, "tx_updates": 38780, "rx_keepalives": 12833, "tx_keepalives": 3235}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.216 shutdown", "neighbor 192.0.2.216 no shutdown", "clear ip bgp 192.0.2.216"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:43:00Z", "neighbor": "192.0.2.82"}, "devices": [{"name": "CORE-R1", "router_id": "1.1.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.82", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 43621, "tx_updates": 43520, "rx_keepalives": 29709, "tx_keepalives": 14468}, {"name": "EDGE-RTR1", "router_id": "5.5.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.163", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 50, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 2467, "tx_updates": 48568, "rx_keepalives": 47331, "tx_keepalives": 21285}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.82"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:43:00Z", "neighbor": "192.0.2.235"}, "devices": [{"name": "DC-RTR1", "router_id": "3.4.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 34632, "tx_updates": 31173, "rx_keepalives": 32268, "tx_keepalives": 16865}, {"name": "CORE-R1", "router_id": "3.2.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 32029, "tx_updates": 31252, "rx_keepalives": 21057, "tx_keepalives": 48902}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.235 shutdown", "neighbor 192.0.2.235 no shutdown", "clear ip bgp 192.0.2.235"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:23:00Z", "neighbor": "192.0.2.76"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.5.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 17193, "tx_updates": 8213, "rx_keepalives": 11612, "tx_keepalives": 26416}, {"name": "CORE-R1", "router_id": "2.2.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 23, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 49833, "tx_updates": 25536, "rx_keepalives": 33357, "tx_keepalives": 33240}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.76 shutdown", "neighbor 192.0.2.76 no shutdown", "clear ip bgp 192.0.2.76"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:42:00Z", "neighbor": "192.0.2.152"}, "devices": [{"name": "CORE-R1", "router_id": "1.2.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.152", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 42, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 46552, "tx_updates": 16250, "rx_keepalives": 1531, "tx_keepalives": 13334}, {"name": "EDGE-RTR1", "router_id": "2.1.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.252", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 31, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 2980, "tx_updates": 9187, "rx_keepalives": 38739, "tx_keepalives": 39705}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.152 shutdown", "neighbor 192.0.2.152 no shutdown", "clear ip bgp 192.0.2.152"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:04:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.1.2", "local_as": 65010, "neighbor_ip": "192.0.2.81", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 30, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 105, "tx_updates": 42660, "rx_keepalives": 12562, "tx_keepalives": 40108}, {"name": "CORE-R1", "router_id": "5.2.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.5", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47308, "tx_updates": 3745, "rx_keepalives": 45353, "tx_keepalives": 13119}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:12:00Z", "neighbor": "192.0.2.57"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.5.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 19100, "tx_updates": 3304, "rx_keepalives": 28965, "tx_keepalives": 22041}, {"name": "BRANCH-RTR1", "router_id": "1.3.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.108", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 47, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 49779, "tx_updates": 48307, "rx_keepalives": 3465, "tx_keepalives": 5441}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.57"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:13:00Z", "neighbor": "192.0.2.164"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.164", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 6162, "tx_updates": 5995, "rx_keepalives": 5210, "tx_keepalives": 31375}, {"name": "EDGE-RTR1", "router_id": "2.3.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.137", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 30040, "tx_updates": 47568, "rx_keepalives": 48007, "tx_keepalives": 24645}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.164 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:57:00Z", "neighbor": "192.0.2.57"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.3.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.57", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 36370, "tx_updates": 22236, "rx_keepalives": 4019, "tx_keepalives": 37474}, {"name": "BRANCH-RTR1", "router_id": "3.1.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.249", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 32001, "tx_updates": 32825, "rx_keepalives": 27895, "tx_keepalives": 2425}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.57"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:26:00Z", "neighbor": "192.0.2.177"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.177", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 51, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 40577, "tx_updates": 24095, "rx_keepalives": 15282, "tx_keepalives": 36148}, {"name": "DC-RTR1", "router_id": "4.1.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.153", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 5, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 12433, "tx_updates": 1494, "rx_keepalives": 39706, "tx_keepalives": 35698}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.177 shutdown", "neighbor 192.0.2.177 no shutdown", "clear ip bgp 192.0.2.177"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:45:00Z", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "router_id": "5.1.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 16349, "tx_updates": 46129, "rx_keepalives": 30333, "tx_keepalives": 21460}, {"name": "EDGE-RTR1", "router_id": "4.1.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 6989, "tx_updates": 29654, "rx_keepalives": 5129, "tx_keepalives": 13859}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.247 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:54:00Z", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "router_id": "1.5.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 4525, "tx_updates": 32375, "rx_keepalives": 20912, "tx_keepalives": 14134}, {"name": "BRANCH-RTR1", "router_id": "2.3.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.249", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 5, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 31829, "tx_updates": 113, "rx_keepalives": 44028, "tx_keepalives": 18161}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.42 shutdown", "neighbor 192.0.2.42 no shutdown", "clear ip bgp 192.0.2.42"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:44:00Z", "neighbor": "192.0.2.89"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.89", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 26, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 40868, "tx_updates": 49176, "rx_keepalives": 48374, "tx_keepalives": 31088}, {"name": "CORE-R1", "router_id": "4.1.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 45, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 41402, "tx_updates": 12005, "rx_keepalives": 9074, "tx_keepalives": 13026}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.89 shutdown", "neighbor 192.0.2.89 no shutdown", "clear ip bgp 192.0.2.89"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:10:00Z", "neighbor": "192.0.2.124"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.3.4", "local_as": 65002, "neighbor_ip": "192.0.2.124", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 2455, "tx_updates": 25134, "rx_keepalives": 26217, "tx_keepalives": 16726}, {"name": "DC-RTR1", "router_id": "3.3.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 9494, "tx_updates": 28713, "rx_keepalives": 45054, "tx_keepalives": 4907}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.124 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:05:00Z", "neighbor": "192.0.2.106"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.106", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 35294, "tx_updates": 40221, "rx_keepalives": 44125, "tx_keepalives": 27300}, {"name": "EDGE-RTR1", "router_id": "4.3.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.149", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 16139, "tx_updates": 20504, "rx_keepalives": 36310, "tx_keepalives": 26655}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.106 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:53:00Z", "neighbor": "192.0.2.180"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.5.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.180", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 22916, "tx_updates": 20821, "rx_keepalives": 48891, "tx_keepalives": 171}, {"name": "BRANCH-RTR1", "router_id": "1.2.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 1095, "tx_updates": 5682, "rx_keepalives": 32628, "tx_keepalives": 4858}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.180 timers 30 180", "clear ip bgp 192.0.2.180"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:05:00Z", "neighbor": "192.0.2.245"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 48, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 13502, "tx_updates": 1928, "rx_keepalives": 23537, "tx_keepalives": 17372}, {"name": "BRANCH-RTR1", "router_id": "1.5.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 46, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 43749, "tx_updates": 18075, "rx_keepalives": 1985, "tx_keepalives": 7679}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.245 shutdown", "neighbor 192.0.2.245 no shutdown", "clear ip bgp 192.0.2.245"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:27:00Z", "neighbor": "192.0.2.10"}, "devices": [{"name": "DC-RTR1", "router_id": "1.1.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 33159, "tx_updates": 24965, "rx_keepalives": 12117, "tx_keepalives": 6552}, {"name": "CORE-R1", "router_id": "5.4.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 6, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 6180, "tx_updates": 28908, "rx_keepalives": 680, "tx_keepalives": 31859}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.10"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:51:00Z", "neighbor": "192.0.2.196"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.4.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 11180, "tx_updates": 27953, "rx_keepalives": 30923, "tx_keepalives": 49636}, {"name": "DC-RTR1", "router_id": "3.3.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 9567, "tx_updates": 46523, "rx_keepalives": 5414, "tx_keepalives": 35715}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.196 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:53:00Z", "neighbor": "192.0.2.191"}, "devices": [{"name": "CORE-R1", "router_id": "3.4.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.191", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 48, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 6275, "tx_updates": 34399, "rx_keepalives": 6937, "tx_keepalives": 39670}, {"name": "EDGE-RTR1", "router_id": "4.3.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.139", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 31, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 46998, "tx_updates": 21336, "rx_keepalives": 27015, "tx_keepalives": 23072}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.191 remote-as 65010", "neighbor 192.0.2.191 timers 30 180", "clear ip bgp 192.0.2.191"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:01:00Z", "neighbor": "192.0.2.209"}, "devices": [{"name": "DC-RTR1", "router_id": "4.3.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.209", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 31133, "tx_updates": 4111, "rx_keepalives": 27855, "tx_keepalives": 43357}, {"name": "BRANCH-RTR1", "router_id": "2.5.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 43, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 10332, "tx_updates": 40403, "rx_keepalives": 15110, "tx_keepalives": 19880}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.209 remote-as 65010", "neighbor 192.0.2.209 timers 30 180", "clear ip bgp 192.0.2.209"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:32:00Z", "neighbor": "192.0.2.56"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.3.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.56", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 32249, "tx_updates": 42941, "rx_keepalives": 26428, "tx_keepalives": 36507}, {"name": "EDGE-RTR1", "router_id": "1.2.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 4181, "tx_updates": 28490, "rx_keepalives": 270, "tx_keepalives": 19512}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.56 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:32:00Z", "neighbor": "192.0.2.37"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 23, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 13810, "tx_updates": 13237, "rx_keepalives": 32323, "tx_keepalives": 3928}, {"name": "EDGE-RTR1", "router_id": "2.1.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 29396, "tx_updates": 47069, "rx_keepalives": 30661, "tx_keepalives": 2430}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.37"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:48:00Z", "neighbor": "192.0.2.111"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 14213, "tx_updates": 29999, "rx_keepalives": 45635, "tx_keepalives": 20556}, {"name": "BRANCH-RTR1", "router_id": "1.2.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.221", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 195, "tx_updates": 46691, "rx_keepalives": 15379, "tx_keepalives": 44521}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.111 update-source Loopback0", "neighbor 192.0.2.111 timers 30 180", "clear ip bgp 192.0.2.111"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:12:00Z", "neighbor": "192.0.2.189"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 38441, "tx_updates": 3659, "rx_keepalives": 10777, "tx_keepalives": 50000}, {"name": "CORE-R1", "router_id": "2.2.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 47201, "tx_updates": 48549, "rx_keepalives": 12834, "tx_keepalives": 11609}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.189 update-source Loopback0", "neighbor 192.0.2.189 timers 60 180", "clear ip bgp 192.0.2.189"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:07:00Z", "neighbor": "192.0.2.250"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.3.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.250", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 4341, "tx_updates": 37069, "rx_keepalives": 21342, "tx_keepalives": 21417}, {"name": "CORE-R1", "router_id": "2.5.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 41282, "tx_updates": 34018, "rx_keepalives": 3650, "tx_keepalives": 45021}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.250 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T17:56:00Z", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 47981, "tx_updates": 16257, "rx_keepalives": 7741, "tx_keepalives": 28219}, {"name": "EDGE-RTR1", "router_id": "3.5.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 49794, "tx_updates": 22647, "rx_keepalives": 36735, "tx_keepalives": 18903}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.216 remote-as 65002", "neighbor 192.0.2.216 timers 10 30", "clear ip bgp 192.0.2.216"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:39:00Z", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.1.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.129", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 52, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 43178, "tx_updates": 49035, "rx_keepalives": 47182, "tx_keepalives": 36823}, {"name": "DC-RTR1", "router_id": "2.4.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 26, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 19192, "tx_updates": 7542, "rx_keepalives": 19841, "tx_keepalives": 46591}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.129 shutdown", "neighbor 192.0.2.129 no shutdown", "clear ip bgp 192.0.2.129"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:17:00Z", "neighbor": "192.0.2.106"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.106", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 43830, "tx_updates": 45727, "rx_keepalives": 3618, "tx_keepalives": 12284}, {"name": "CORE-R1", "router_id": "2.2.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 42232, "tx_updates": 39579, "rx_keepalives": 42914, "tx_keepalives": 37613}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.106 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:41:00Z", "neighbor": "192.0.2.211"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 35581, "tx_updates": 13151, "rx_keepalives": 979, "tx_keepalives": 42929}, {"name": "EDGE-RTR1", "router_id": "3.5.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27306, "tx_updates": 27485, "rx_keepalives": 46919, "tx_keepalives": 33334}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.211 update-source Loopback0", "neighbor 192.0.2.211 timers 30 180", "clear ip bgp 192.0.2.211"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:01:00Z", "neighbor": "192.0.2.3"}, "devices": [{"name": "DC-RTR1", "router_id": "2.2.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.3", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 17408, "tx_updates": 27633, "rx_keepalives": 2012, "tx_keepalives": 18579}, {"name": "BRANCH-RTR1", "router_id": "5.4.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.144", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43481, "tx_updates": 34886, "rx_keepalives": 17953, "tx_keepalives": 7949}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "neighbor 192.0.2.3 timers 30 180", "clear ip bgp 192.0.2.3"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:41:00Z", "neighbor": "192.0.2.212"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 27007, "tx_updates": 3502, "rx_keepalives": 3921, "tx_keepalives": 41491}, {"name": "EDGE-RTR1", "router_id": "3.2.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 28785, "tx_updates": 17343, "rx_keepalives": 19439, "tx_keepalives": 41386}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.212"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:38:00Z", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 11964, "tx_updates": 22813, "rx_keepalives": 40426, "tx_keepalives": 16059}, {"name": "CORE-R1", "router_id": "5.4.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 10551, "tx_updates": 6662, "rx_keepalives": 21340, "tx_keepalives": 38226}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.248 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:39:00Z", "neighbor": "192.0.2.119"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.119", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 55, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 47226, "tx_updates": 2137, "rx_keepalives": 35483, "tx_keepalives": 38156}, {"name": "DC-RTR1", "router_id": "4.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.191", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 13444, "tx_updates": 28243, "rx_keepalives": 17865, "tx_keepalives": 37717}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.119"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:47:00Z", "neighbor": "192.0.2.174"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 49, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 15733, "tx_updates": 49642, "rx_keepalives": 25271, "tx_keepalives": 26968}, {"name": "CORE-R1", "router_id": "3.4.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 54, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 38261, "tx_updates": 16535, "rx_keepalives": 43299, "tx_keepalives": 33922}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.174 remote-as 65100", "neighbor 192.0.2.174 timers 60 180", "clear ip bgp 192.0.2.174"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:26:00Z", "neighbor": "192.0.2.166"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 21103, "tx_updates": 21525, "rx_keepalives": 383, "tx_keepalives": 8241}, {"name": "DC-RTR1", "router_id": "5.4.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.20", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 42571, "tx_updates": 44912, "rx_keepalives": 14656, "tx_keepalives": 30659}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.166 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:29:00Z", "neighbor": "192.0.2.153"}, "devices": [{"name": "CORE-R1", "router_id": "3.4.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.153", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 33460, "tx_updates": 32644, "rx_keepalives": 12605, "tx_keepalives": 37829}, {"name": "EDGE-RTR1", "router_id": "4.4.5.2", "local_as": 65010, "neighbor_ip": "192.0.2.36", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 23371, "tx_updates": 27763, "rx_keepalives": 28048, "tx_keepalives": 33354}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.153 update-source Loopback0", "neighbor 192.0.2.153 timers 30 180", "clear ip bgp 192.0.2.153"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:12:00Z", "neighbor": "192.0.2.33"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.2.2.4", "local_as": 65100, "neighbor_ip": "192.0.2.33", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 36, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 41171, "tx_updates": 22057, "rx_keepalives": 48126, "tx_keepalives": 37873}, {"name": "EDGE-RTR1", "router_id": "2.4.4.2", "local_as": 65010, "neighbor_ip": "192.0.2.222", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 58, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 23227, "tx_updates": 42567, "rx_keepalives": 37274, "tx_keepalives": 13284}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.33 remote-as 65010", "neighbor 192.0.2.33 timers 30 90", "clear ip bgp 192.0.2.33"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:07:00Z", "neighbor": "192.0.2.235"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.2.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 41386, "tx_updates": 5661, "rx_keepalives": 21111, "tx_keepalives": 18687}, {"name": "DC-RTR1", "router_id": "2.5.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 34203, "tx_updates": 49142, "rx_keepalives": 39965, "tx_keepalives": 8648}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.235 timers 30 180", "clear ip bgp 192.0.2.235"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:53:00Z", "neighbor": "192.0.2.36"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 11097, "tx_updates": 29003, "rx_keepalives": 3250, "tx_keepalives": 16915}, {"name": "CORE-R1", "router_id": "1.2.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 14, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 20500, "tx_updates": 43291, "rx_keepalives": 18181, "tx_keepalives": 11108}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.36 shutdown", "neighbor 192.0.2.36 no shutdown", "clear ip bgp 192.0.2.36"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:01:00Z", "neighbor": "192.0.2.26"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 11862, "tx_updates": 43894, "rx_keepalives": 5236, "tx_keepalives": 33793}, {"name": "CORE-R1", "router_id": "3.4.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.67", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 38024, "tx_updates": 35878, "rx_keepalives": 18049, "tx_keepalives": 24110}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.26 update-source Loopback0", "neighbor 192.0.2.26 timers 60 180", "clear ip bgp 192.0.2.26"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:31:00Z", "neighbor": "192.0.2.102"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 22400, "tx_updates": 48334, "rx_keepalives": 5361, "tx_keepalives": 46684}, {"name": "BRANCH-RTR1", "router_id": "5.4.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.222", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 45152, "tx_updates": 18860, "rx_keepalives": 8993, "tx_keepalives": 27260}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.102 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:40:00Z", "neighbor": "192.0.2.17"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.3.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 56, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 24768, "tx_updates": 15239, "rx_keepalives": 4088, "tx_keepalives": 45124}, {"name": "BRANCH-RTR1", "router_id": "5.4.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 36, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 22421, "tx_updates": 11148, "rx_keepalives": 23647, "tx_keepalives": 12239}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.17"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:10:00Z", "neighbor": "192.0.2.219"}, "devices": [{"name": "DC-RTR1", "router_id": "3.2.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 22598, "tx_updates": 13384, "rx_keepalives": 46346, "tx_keepalives": 42051}, {"name": "BRANCH-RTR1", "router_id": "3.2.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 41303, "tx_updates": 16810, "rx_keepalives": 34832, "tx_keepalives": 5775}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.219 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:27:00Z", "neighbor": "192.0.2.25"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.25", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 42941, "tx_updates": 49651, "rx_keepalives": 48035, "tx_keepalives": 13560}, {"name": "CORE-R1", "router_id": "5.5.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 20752, "tx_updates": 22844, "rx_keepalives": 24491, "tx_keepalives": 21696}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.25"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:03:00Z", "neighbor": "192.0.2.72"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.72", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 42100, "tx_updates": 38777, "rx_keepalives": 30954, "tx_keepalives": 29483}, {"name": "EDGE-RTR1", "router_id": "4.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.62", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 48203, "tx_updates": 32130, "rx_keepalives": 31309, "tx_keepalives": 37473}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.72 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:28:00Z", "neighbor": "192.0.2.250"}, "devices": [{"name": "DC-RTR1", "router_id": "2.5.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.250", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 39, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 7931, "tx_updates": 44958, "rx_keepalives": 36541, "tx_keepalives": 27661}, {"name": "EDGE-RTR1", "router_id": "2.5.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 14889, "tx_updates": 3506, "rx_keepalives": 26748, "tx_keepalives": 24701}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.250 shutdown", "neighbor 192.0.2.250 no shutdown", "clear ip bgp 192.0.2.250"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:40:00Z", "neighbor": "192.0.2.90"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.90", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27321, "tx_updates": 35707, "rx_keepalives": 16605, "tx_keepalives": 26533}, {"name": "CORE-R1", "router_id": "4.1.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 20, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 12773, "tx_updates": 29183, "rx_keepalives": 25570, "tx_keepalives": 44073}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.90 update-source Loopback0", "neighbor 192.0.2.90 timers 60 180", "clear ip bgp 192.0.2.90"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:32:00Z", "neighbor": "192.0.2.41"}, "devices": [{"name": "CORE-R1", "router_id": "2.5.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27959, "tx_updates": 45280, "rx_keepalives": 38807, "tx_keepalives": 38639}, {"name": "BRANCH-RTR1", "router_id": "4.3.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.234", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 47265, "tx_updates": 35944, "rx_keepalives": 16977, "tx_keepalives": 22612}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.41 timers 30 180", "clear ip bgp 192.0.2.41"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:47:00Z", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.1.3", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 27156, "tx_updates": 9521, "rx_keepalives": 25677, "tx_keepalives": 14203}, {"name": "EDGE-RTR1", "router_id": "3.4.1.1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 36595, "tx_updates": 28479, "rx_keepalives": 5863, "tx_keepalives": 28166}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.104 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:45:00Z", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "router_id": "1.5.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 17, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27538, "tx_updates": 4745, "rx_keepalives": 9410, "tx_keepalives": 44135}, {"name": "BRANCH-RTR1", "router_id": "1.1.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44991, "tx_updates": 16638, "rx_keepalives": 13862, "tx_keepalives": 42662}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.20 timers 30 90", "clear ip bgp 192.0.2.20"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T20:57:00Z", "neighbor": "192.0.2.241"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 21, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 5860, "tx_updates": 46338, "rx_keepalives": 32081, "tx_keepalives": 24114}, {"name": "EDGE-RTR1", "router_id": "3.4.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 51, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 28538, "tx_updates": 48959, "rx_keepalives": 38190, "tx_keepalives": 3847}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.241 remote-as 65010", "neighbor 192.0.2.241 timers 10 60", "clear ip bgp 192.0.2.241"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T22:19:00Z", "neighbor": "192.0.2.57"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.57", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 23083, "tx_updates": 8936, "rx_keepalives": 37770, "tx_keepalives": 41148}, {"name": "DC-RTR1", "router_id": "3.4.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 23321, "tx_updates": 12487, "rx_keepalives": 13692, "tx_keepalives": 28884}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.57 timers 60 180", "clear ip bgp 192.0.2.57"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:37:00Z", "neighbor": "192.0.2.227"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.1.2.1", "local_as": 65100, "neighbor_ip": "192.0.2.227", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 20, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 21677, "tx_updates": 11701, "rx_keepalives": 22056, "tx_keepalives": 46886}, {"name": "CORE-R1", "router_id": "5.4.5.4", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 38811, "tx_updates": 27158, "rx_keepalives": 27534, "tx_keepalives": 47191}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.227"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:25:00Z", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.55", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 47343, "tx_updates": 21021, "rx_keepalives": 41680, "tx_keepalives": 861}, {"name": "CORE-R1", "router_id": "5.4.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 9334, "tx_updates": 14380, "rx_keepalives": 17825, "tx_keepalives": 4704}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.55 update-source Loopback0", "neighbor 192.0.2.55 timers 60 180", "clear ip bgp 192.0.2.55"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:32:00Z", "neighbor": "192.0.2.66"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.66", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 30376, "tx_updates": 21336, "rx_keepalives": 34706, "tx_keepalives": 17387}, {"name": "EDGE-RTR1", "router_id": "3.2.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 30891, "tx_updates": 24762, "rx_keepalives": 7912, "tx_keepalives": 49417}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.66"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:42:00Z", "neighbor": "192.0.2.115"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.4.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 23, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 8597, "tx_updates": 1120, "rx_keepalives": 45417, "tx_keepalives": 16798}, {"name": "DC-RTR1", "router_id": "3.2.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.185", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 22, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 42288, "tx_updates": 19522, "rx_keepalives": 47246, "tx_keepalives": 13522}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.115"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:07:00Z", "neighbor": "192.0.2.32"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 31, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 37375, "tx_updates": 9200, "rx_keepalives": 36762, "tx_keepalives": 20886}, {"name": "BRANCH-RTR1", "router_id": "3.2.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.17", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 20195, "tx_updates": 47579, "rx_keepalives": 19029, "tx_keepalives": 3765}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.32 timers 60 360", "clear ip bgp 192.0.2.32"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T19:53:00Z", "neighbor": "192.0.2.12"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.12", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 25688, "tx_updates": 7450, "rx_keepalives": 1946, "tx_keepalives": 27464}, {"name": "DC-RTR1", "router_id": "5.5.1.4", "local_as": 65010, "neighbor_ip": "192.0.2.84", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 12, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 8676, "tx_updates": 29718, "rx_keepalives": 29095, "tx_keepalives": 29427}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.12"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:36:00Z", "neighbor": "192.0.2.230"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.230", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 24637, "tx_updates": 29791, "rx_keepalives": 21420, "tx_keepalives": 27513}, {"name": "BRANCH-RTR1", "router_id": "3.5.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 7970, "tx_updates": 18772, "rx_keepalives": 24941, "tx_keepalives": 39559}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.230 timers 30 180", "clear ip bgp 192.0.2.230"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:59:00Z", "neighbor": "192.0.2.50"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.50", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 35, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 19592, "tx_updates": 21707, "rx_keepalives": 22456, "tx_keepalives": 23375}, {"name": "EDGE-RTR1", "router_id": "5.4.5.4", "local_as": 65010, "neighbor_ip": "192.0.2.137", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 18584, "tx_updates": 24434, "rx_keepalives": 42922, "tx_keepalives": 27118}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.50 timers 30 180", "clear ip bgp 192.0.2.50"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:51:00Z", "neighbor": "192.0.2.249"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.5.3.3", "local_as": 65001, "neighbor_ip": "192.0.2.249", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 17832, "tx_updates": 1179, "rx_keepalives": 11512, "tx_keepalives": 49428}, {"name": "CORE-R1", "router_id": "5.3.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.225", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 20710, "tx_updates": 995, "rx_keepalives": 49806, "tx_keepalives": 24430}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.249"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T18:14:00Z", "neighbor": "192.0.2.39"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.39", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 33321, "tx_updates": 8629, "rx_keepalives": 21485, "tx_keepalives": 45901}, {"name": "DC-RTR1", "router_id": "5.2.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.9", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 30539, "tx_updates": 31940, "rx_keepalives": 41903, "tx_keepalives": 4766}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.39 timers 30 180", "clear ip bgp 192.0.2.39"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:46:00Z", "neighbor": "192.0.2.64"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.3.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 3806, "tx_updates": 4404, "rx_keepalives": 4651, "tx_keepalives": 47269}, {"name": "EDGE-RTR1", "router_id": "3.4.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.76", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 35968, "tx_updates": 40985, "rx_keepalives": 39201, "tx_keepalives": 46489}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.64 timers 30 180", "clear ip bgp 192.0.2.64"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:05:00Z", "neighbor": "192.0.2.31"}, "devices": [{"name": "DC-RTR1", "router_id": "2.4.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.31", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 1148, "tx_updates": 48771, "rx_keepalives": 28439, "tx_keepalives": 2758}, {"name": "EDGE-RTR1", "router_id": "1.1.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.150", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 827, "tx_updates": 40642, "rx_keepalives": 36875, "tx_keepalives": 32566}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.31 timers 30 180", "clear ip bgp 192.0.2.31"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:12:00Z", "neighbor": "192.0.2.123"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.123", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 33, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 37905, "tx_updates": 19830, "rx_keepalives": 6905, "tx_keepalives": 49443}, {"name": "CORE-R1", "router_id": "3.3.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.164", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 19310, "tx_updates": 10628, "rx_keepalives": 31605, "tx_keepalives": 21296}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "neighbor 192.0.2.123 timers 30 180", "clear ip bgp 192.0.2.123"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:27:00Z", "neighbor": "192.0.2.49"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 47859, "tx_updates": 10290, "rx_keepalives": 5390, "tx_keepalives": 22884}, {"name": "CORE-R1", "router_id": "1.1.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.225", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 16, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 7077, "tx_updates": 26119, "rx_keepalives": 12579, "tx_keepalives": 37098}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.49"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:29:00Z", "neighbor": "192.0.2.162"}, "devices": [{"name": "DC-RTR1", "router_id": "2.2.5.1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 16, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 45554, "tx_updates": 10489, "rx_keepalives": 7332, "tx_keepalives": 4451}, {"name": "BRANCH-RTR1", "router_id": "3.4.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 7239, "tx_updates": 20890, "rx_keepalives": 24821, "tx_keepalives": 22766}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.162 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:23:00Z", "neighbor": "192.0.2.43"}, "devices": [{"name": "DC-RTR1", "router_id": "3.3.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 27, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 10002, "tx_updates": 36693, "rx_keepalives": 20000, "tx_keepalives": 11212}, {"name": "EDGE-RTR1", "router_id": "3.5.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 12601, "tx_updates": 24296, "rx_keepalives": 38479, "tx_keepalives": 21857}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65010", "clear ip bgp 192.0.2.43"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:52:00Z", "neighbor": "192.0.2.224"}, "devices": [{"name": "DC-RTR1", "router_id": "3.5.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 21631, "tx_updates": 580, "rx_keepalives": 45658, "tx_keepalives": 8406}, {"name": "EDGE-RTR1", "router_id": "3.4.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 17624, "tx_updates": 46857, "rx_keepalives": 3137, "tx_keepalives": 49631}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.224 timers 30 180", "clear ip bgp 192.0.2.224"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T22:25:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "DC-RTR1", "router_id": "3.3.2.2", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 30, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 39646, "tx_updates": 33462, "rx_keepalives": 1859, "tx_keepalives": 8131}, {"name": "EDGE-RTR1", "router_id": "2.3.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 30432, "tx_updates": 427, "rx_keepalives": 2942, "tx_keepalives": 39062}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.81 shutdown", "neighbor 192.0.2.81 no shutdown", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:45:00Z", "neighbor": "192.0.2.106"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.106", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 45517, "tx_updates": 678, "rx_keepalives": 35311, "tx_keepalives": 49606}, {"name": "CORE-R1", "router_id": "3.5.4.4", "local_as": 65010, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 33646, "tx_updates": 5819, "rx_keepalives": 45803, "tx_keepalives": 16554}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.106 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:25:00Z", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.190", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 49821, "tx_updates": 22102, "rx_keepalives": 29071, "tx_keepalives": 9588}, {"name": "BRANCH-RTR1", "router_id": "1.2.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 35939, "tx_updates": 29448, "rx_keepalives": 47071, "tx_keepalives": 30589}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:31:00Z", "neighbor": "192.0.2.61"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 58, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 2927, "tx_updates": 21551, "rx_keepalives": 31969, "tx_keepalives": 43944}, {"name": "EDGE-RTR1", "router_id": "4.5.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.68", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 34, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 28731, "tx_updates": 11255, "rx_keepalives": 40124, "tx_keepalives": 37520}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.61"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:12:00Z", "neighbor": "192.0.2.106"}, "devices": [{"name": "DC-RTR1", "router_id": "2.4.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.106", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 17086, "tx_updates": 24853, "rx_keepalives": 37710, "tx_keepalives": 15312}, {"name": "BRANCH-RTR1", "router_id": "4.3.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.127", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 13914, "tx_updates": 29821, "rx_keepalives": 37722, "tx_keepalives": 2280}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.106 remote-as 65100", "neighbor 192.0.2.106 timers 30 90", "clear ip bgp 192.0.2.106"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:56:00Z", "neighbor": "192.0.2.127"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.127", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 13810, "tx_updates": 32490, "rx_keepalives": 49107, "tx_keepalives": 19914}, {"name": "EDGE-RTR1", "router_id": "5.5.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.117", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 15244, "tx_updates": 6342, "rx_keepalives": 1519, "tx_keepalives": 48926}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.127 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:30:00Z", "neighbor": "192.0.2.104"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.2.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 46, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 45100, "tx_updates": 40646, "rx_keepalives": 8305, "tx_keepalives": 14741}, {"name": "BRANCH-RTR1", "router_id": "4.4.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 32436, "tx_updates": 39191, "rx_keepalives": 10464, "tx_keepalives": 10152}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.104 shutdown", "neighbor 192.0.2.104 no shutdown", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:50:00Z", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "router_id": "3.3.4.2", "local_as": 65001, "neighbor_ip": "192.0.2.116", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 30639, "tx_updates": 4663, "rx_keepalives": 29522, "tx_keepalives": 42209}, {"name": "EDGE-RTR1", "router_id": "1.2.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 27809, "tx_updates": 23433, "rx_keepalives": 15140, "tx_keepalives": 30230}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65001", "neighbor 192.0.2.116 timers 30 180", "clear ip bgp 192.0.2.116"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:46:00Z", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "router_id": "2.3.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 7324, "tx_updates": 31910, "rx_keepalives": 9807, "tx_keepalives": 29986}, {"name": "BRANCH-RTR1", "router_id": "1.3.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 13, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 4063, "tx_updates": 23338, "rx_keepalives": 3, "tx_keepalives": 47887}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.52 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T15:46:00Z", "neighbor": "192.0.2.190"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.1.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 4218, "tx_updates": 47648, "rx_keepalives": 13215, "tx_keepalives": 4247}, {"name": "BRANCH-RTR1", "router_id": "1.5.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.123", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 29, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 9932, "tx_updates": 15371, "rx_keepalives": 47242, "tx_keepalives": 39321}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.190 remote-as 65001", "neighbor 192.0.2.190 timers 30 180", "clear ip bgp 192.0.2.190"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:16:00Z", "neighbor": "192.0.2.16"}, "devices": [{"name": "DC-RTR1", "router_id": "3.4.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.16", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 57, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 29221, "tx_updates": 6847, "rx_keepalives": 20303, "tx_keepalives": 37378}, {"name": "EDGE-RTR1", "router_id": "5.5.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 21, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 14599, "tx_updates": 27646, "rx_keepalives": 15164, "tx_keepalives": 39777}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.16 remote-as 65001", "neighbor 192.0.2.16 timers 10 30", "clear ip bgp 192.0.2.16"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:12:00Z", "neighbor": "192.0.2.149"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.2.5", "local_as": 65001, "neighbor_ip": "192.0.2.149", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 23, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 27405, "tx_updates": 3817, "rx_keepalives": 21454, "tx_keepalives": 28390}, {"name": "CORE-R1", "router_id": "3.4.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.86", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 2180, "tx_updates": 12831, "rx_keepalives": 32591, "tx_keepalives": 38795}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.149"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:08:00Z", "neighbor": "192.0.2.244"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.244", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 38647, "tx_updates": 8898, "rx_keepalives": 42965, "tx_keepalives": 28546}, {"name": "BRANCH-RTR1", "router_id": "4.3.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 5, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 3278, "tx_updates": 10714, "rx_keepalives": 11425, "tx_keepalives": 48602}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.244 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:51:00Z", "neighbor": "192.0.2.173"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.2.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 11935, "tx_updates": 10170, "rx_keepalives": 24473, "tx_keepalives": 44397}, {"name": "BRANCH-RTR1", "router_id": "3.3.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 39341, "tx_updates": 20830, "rx_keepalives": 17099, "tx_keepalives": 19085}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.173 timers 60 360", "clear ip bgp 192.0.2.173"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:22:00Z", "neighbor": "192.0.2.94"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 12, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 48844, "tx_updates": 27147, "rx_keepalives": 37472, "tx_keepalives": 40105}, {"name": "DC-RTR1", "router_id": "4.1.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 22104, "tx_updates": 44569, "rx_keepalives": 28446, "tx_keepalives": 9455}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.94 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:45:00Z", "neighbor": "192.0.2.1"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.2.2.3", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 5, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 35902, "tx_updates": 37799, "rx_keepalives": 34863, "tx_keepalives": 23265}, {"name": "EDGE-RTR1", "router_id": "2.2.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 14, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 2345, "tx_updates": 17633, "rx_keepalives": 13079, "tx_keepalives": 20397}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.1"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T18:24:00Z", "neighbor": "192.0.2.62"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.3.3", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 22, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 24519, "tx_updates": 39435, "rx_keepalives": 25402, "tx_keepalives": 37458}, {"name": "EDGE-RTR1", "router_id": "4.1.5.3", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 57, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 20447, "tx_updates": 45766, "rx_keepalives": 43783, "tx_keepalives": 11115}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.62 shutdown", "neighbor 192.0.2.62 no shutdown", "clear ip bgp 192.0.2.62"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:01:00Z", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.4.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 13285, "tx_updates": 5821, "rx_keepalives": 42227, "tx_keepalives": 14007}, {"name": "DC-RTR1", "router_id": "4.5.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.177", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 34135, "tx_updates": 44806, "rx_keepalives": 15545, "tx_keepalives": 34408}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.181 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:45:00Z", "neighbor": "192.0.2.232"}, "devices": [{"name": "DC-RTR1", "router_id": "3.1.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 31207, "tx_updates": 34912, "rx_keepalives": 25676, "tx_keepalives": 35525}, {"name": "EDGE-RTR1", "router_id": "1.2.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.252", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 2116, "tx_updates": 970, "rx_keepalives": 39284, "tx_keepalives": 25343}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.232 timers 30 90", "clear ip bgp 192.0.2.232"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:05:00Z", "neighbor": "192.0.2.90"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.90", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 60, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 25381, "tx_updates": 17048, "rx_keepalives": 13914, "tx_keepalives": 25782}, {"name": "CORE-R1", "router_id": "3.3.4.1", "local_as": 65002, "neighbor_ip": "192.0.2.203", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 59, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 23927, "tx_updates": 2274, "rx_keepalives": 15375, "tx_keepalives": 36588}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.90 shutdown", "neighbor 192.0.2.90 no shutdown", "clear ip bgp 192.0.2.90"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:50:00Z", "neighbor": "192.0.2.54"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.3.3.5", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 6229, "tx_updates": 115, "rx_keepalives": 46197, "tx_keepalives": 45077}, {"name": "BRANCH-RTR1", "router_id": "5.2.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 16663, "tx_updates": 18335, "rx_keepalives": 41007, "tx_keepalives": 34616}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.54 update-source Loopback0", "neighbor 192.0.2.54 timers 60 360", "clear ip bgp 192.0.2.54"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:45:00Z", "neighbor": "192.0.2.79"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.4.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.79", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 39, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 24506, "tx_updates": 45309, "rx_keepalives": 29083, "tx_keepalives": 28500}, {"name": "DC-RTR1", "router_id": "2.3.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 57, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 46590, "tx_updates": 8851, "rx_keepalives": 34593, "tx_keepalives": 47417}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.79 remote-as 65010", "neighbor 192.0.2.79 timers 60 360", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T21:42:00Z", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.5.3", "local_as": 65001, "neighbor_ip": "192.0.2.120", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 20, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 12632, "tx_updates": 12299, "rx_keepalives": 6598, "tx_keepalives": 36804}, {"name": "DC-RTR1", "router_id": "2.3.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.93", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 40836, "tx_updates": 18576, "rx_keepalives": 43572, "tx_keepalives": 26209}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.120 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:06:00Z", "neighbor": "192.0.2.162"}, "devices": [{"name": "DC-RTR1", "router_id": "4.1.3.4", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 11, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 37030, "tx_updates": 27607, "rx_keepalives": 8664, "tx_keepalives": 31800}, {"name": "BRANCH-RTR1", "router_id": "1.1.5.3", "local_as": 65002, "neighbor_ip": "192.0.2.103", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 30, "hold": 180, "flap_count_24h": 34, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 1414, "tx_updates": 48816, "rx_keepalives": 21957, "tx_keepalives": 25071}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.162 shutdown", "neighbor 192.0.2.162 no shutdown", "clear ip bgp 192.0.2.162"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:57:00Z", "neighbor": "192.0.2.102"}, "devices": [{"name": "CORE-R1", "router_id": "4.2.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 22, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 11503, "tx_updates": 8308, "rx_keepalives": 17788, "tx_keepalives": 1814}, {"name": "BRANCH-RTR1", "router_id": "5.4.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.172", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 48, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 25587, "tx_updates": 24513, "rx_keepalives": 33643, "tx_keepalives": 34032}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.102 remote-as 65100", "neighbor 192.0.2.102 timers 60 180", "clear ip bgp 192.0.2.102"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:14:00Z", "neighbor": "192.0.2.92"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 27, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 34539, "tx_updates": 12623, "rx_keepalives": 19814, "tx_keepalives": 40931}, {"name": "BRANCH-RTR1", "router_id": "2.3.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 60, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 4218, "tx_updates": 20271, "rx_keepalives": 12772, "tx_keepalives": 4741}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.92 shutdown", "neighbor 192.0.2.92 no shutdown", "clear ip bgp 192.0.2.92"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:01:00Z", "neighbor": "192.0.2.12"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.12", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 42, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 46545, "tx_updates": 47614, "rx_keepalives": 6333, "tx_keepalives": 13866}, {"name": "EDGE-RTR1", "router_id": "5.1.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 12613, "tx_updates": 42241, "rx_keepalives": 2478, "tx_keepalives": 1518}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.12"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:42:00Z", "neighbor": "192.0.2.171"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.3.1.3", "local_as": 65100, "neighbor_ip": "192.0.2.171", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 8152, "tx_updates": 43418, "rx_keepalives": 15339, "tx_keepalives": 44569}, {"name": "CORE-R1", "router_id": "5.4.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 14, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 34845, "tx_updates": 41138, "rx_keepalives": 36968, "tx_keepalives": 47203}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "neighbor 192.0.2.171 timers 60 360", "clear ip bgp 192.0.2.171"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:50:00Z", "neighbor": "192.0.2.203"}, "devices": [{"name": "DC-RTR1", "router_id": "5.4.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 43934, "tx_updates": 12002, "rx_keepalives": 21801, "tx_keepalives": 16230}, {"name": "BRANCH-RTR1", "router_id": "4.3.4.4", "local_as": 65002, "neighbor_ip": "192.0.2.19", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 38150, "tx_updates": 42111, "rx_keepalives": 1234, "tx_keepalives": 28052}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.203"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:58:00Z", "neighbor": "192.0.2.2"}, "devices": [{"name": "CORE-R1", "router_id": "4.3.5.1", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 5025, "tx_updates": 13369, "rx_keepalives": 22141, "tx_keepalives": 27517}, {"name": "BRANCH-RTR1", "router_id": "5.1.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 12648, "tx_updates": 2781, "rx_keepalives": 20455, "tx_keepalives": 49766}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65010", "neighbor 192.0.2.2 timers 30 180", "clear ip bgp 192.0.2.2"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T16:20:00Z", "neighbor": "192.0.2.60"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 34741, "tx_updates": 4892, "rx_keepalives": 44901, "tx_keepalives": 42987}, {"name": "DC-RTR1", "router_id": "2.5.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 28, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 33019, "tx_updates": 26541, "rx_keepalives": 33900, "tx_keepalives": 13341}], "cli_fix": ["interface Loopback0", "no shutdown", "router bgp 65002", "neighbor 192.0.2.60 timers 30 90", "clear ip bgp 192.0.2.60"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T10:05:00Z", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "router_id": "4.1.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 12, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 23940, "tx_updates": 23328, "rx_keepalives": 7808, "tx_keepalives": 41125}, {"name": "BRANCH-RTR1", "router_id": "1.2.1.5", "local_as": 65001, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 34, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 35740, "tx_updates": 22356, "rx_keepalives": 19465, "tx_keepalives": 33010}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "neighbor 192.0.2.104 timers 60 360", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:52:00Z", "neighbor": "192.0.2.33"}, "devices": [{"name": "DC-RTR1", "router_id": "3.4.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 7, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42094, "tx_updates": 24127, "rx_keepalives": 48722, "tx_keepalives": 42400}, {"name": "CORE-R1", "router_id": "5.1.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.57", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 40, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25362, "tx_updates": 21297, "rx_keepalives": 42260, "tx_keepalives": 37594}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.33 timers 30 180", "clear ip bgp 192.0.2.33"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:30:00Z", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.4.3", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 4967, "tx_updates": 26532, "rx_keepalives": 7, "tx_keepalives": 40413}, {"name": "EDGE-RTR1", "router_id": "4.3.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 31073, "tx_updates": 24489, "rx_keepalives": 37067, "tx_keepalives": 4633}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.104 soft in"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:59:00Z", "neighbor": "192.0.2.228"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 39821, "tx_updates": 49055, "rx_keepalives": 27624, "tx_keepalives": 6034}, {"name": "BRANCH-RTR1", "router_id": "2.3.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 2, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 30053, "tx_updates": 18429, "rx_keepalives": 13623, "tx_keepalives": 38250}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.228 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T13:36:00Z", "neighbor": "192.0.2.143"}, "devices": [{"name": "EDGE-RTR1", "router_id": "1.5.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 4323, "tx_updates": 17904, "rx_keepalives": 30388, "tx_keepalives": 14142}, {"name": "CORE-R1", "router_id": "3.5.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.45", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 23, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 5386, "tx_updates": 40238, "rx_keepalives": 21211, "tx_keepalives": 49798}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.143 timers 60 360", "clear ip bgp 192.0.2.143"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:42:00Z", "neighbor": "192.0.2.190"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 3, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 20719, "tx_updates": 37784, "rx_keepalives": 10634, "tx_keepalives": 6427}, {"name": "BRANCH-RTR1", "router_id": "3.1.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 16582, "tx_updates": 28077, "rx_keepalives": 19605, "tx_keepalives": 34125}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:12:00Z", "neighbor": "192.0.2.94"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.2.2", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 33097, "tx_updates": 43349, "rx_keepalives": 3554, "tx_keepalives": 33969}, {"name": "BRANCH-RTR1", "router_id": "2.4.1.1", "local_as": 65002, "neighbor_ip": "192.0.2.82", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 15677, "tx_updates": 33675, "rx_keepalives": 41680, "tx_keepalives": 41029}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65010", "neighbor 192.0.2.94 timers 30 90", "clear ip bgp 192.0.2.94"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:28:00Z", "neighbor": "192.0.2.22"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.2.4", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 55, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 30378, "tx_updates": 3492, "rx_keepalives": 21593, "tx_keepalives": 13508}, {"name": "EDGE-RTR1", "router_id": "2.2.3.3", "local_as": 65100, "neighbor_ip": "192.0.2.32", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 40, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 35172, "tx_updates": 48636, "rx_keepalives": 32306, "tx_keepalives": 29873}], "cli_fix": ["interface GigabitEthernet0/2", "no shutdown", "router bgp 65001", "clear ip bgp 192.0.2.22"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T20:47:00Z", "neighbor": "192.0.2.141"}, "devices": [{"name": "DC-RTR1", "router_id": "5.5.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.141", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31236, "tx_updates": 30344, "rx_keepalives": 39503, "tx_keepalives": 30704}, {"name": "CORE-R1", "router_id": "4.4.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 23622, "tx_updates": 4531, "rx_keepalives": 10859, "tx_keepalives": 47241}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.141 timers 30 180", "clear ip bgp 192.0.2.141"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:19:00Z", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "router_id": "5.3.1.3", "local_as": 65002, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 4562, "tx_updates": 6323, "rx_keepalives": 33813, "tx_keepalives": 13826}, {"name": "BRANCH-RTR1", "router_id": "1.4.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 49371, "tx_updates": 14704, "rx_keepalives": 36762, "tx_keepalives": 26033}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.50 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T12:08:00Z", "neighbor": "192.0.2.20"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 38959, "tx_updates": 35582, "rx_keepalives": 8204, "tx_keepalives": 37877}, {"name": "DC-RTR1", "router_id": "2.2.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.27", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 16, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 13364, "tx_updates": 9339, "rx_keepalives": 34934, "tx_keepalives": 29385}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.20 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:14:00Z", "neighbor": "192.0.2.31"}, "devices": [{"name": "DC-RTR1", "router_id": "5.2.2.3", "local_as": 65002, "neighbor_ip": "192.0.2.31", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 30, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42691, "tx_updates": 39552, "rx_keepalives": 4054, "tx_keepalives": 29039}, {"name": "EDGE-RTR1", "router_id": "5.2.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 39633, "tx_updates": 28030, "rx_keepalives": 11695, "tx_keepalives": 39542}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.31 timers 60 360", "clear ip bgp 192.0.2.31"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:28:00Z", "neighbor": "192.0.2.193"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.1.4", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 1, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 27412, "tx_updates": 9310, "rx_keepalives": 2627, "tx_keepalives": 16984}, {"name": "DC-RTR1", "router_id": "2.2.4.2", "local_as": 65002, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 16651, "tx_updates": 31436, "rx_keepalives": 2998, "tx_keepalives": 4764}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.193 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:34:00Z", "neighbor": "192.0.2.167"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.167", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 60, "hold": 360, "flap_count_24h": 52, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 21194, "tx_updates": 7409, "rx_keepalives": 28148, "tx_keepalives": 13922}, {"name": "EDGE-RTR1", "router_id": "1.2.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 57, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 46474, "tx_updates": 2746, "rx_keepalives": 32442, "tx_keepalives": 8292}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.167 remote-as 65010", "neighbor 192.0.2.167 timers 30 180", "clear ip bgp 192.0.2.167"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T10:52:00Z", "neighbor": "192.0.2.224"}, "devices": [{"name": "EDGE-RTR1", "router_id": "4.3.3.2", "local_as": 65001, "neighbor_ip": "192.0.2.224", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 5, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 33206, "tx_updates": 2485, "rx_keepalives": 32121, "tx_keepalives": 25539}, {"name": "BRANCH-RTR1", "router_id": "5.2.1.2", "local_as": 65002, "neighbor_ip": "192.0.2.74", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 10, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 5203, "tx_updates": 32077, "rx_keepalives": 33768, "tx_keepalives": 9593}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.224 shutdown", "neighbor 192.0.2.224 no shutdown", "clear ip bgp 192.0.2.224"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T12:00:00Z", "neighbor": "192.0.2.82"}, "devices": [{"name": "CORE-R1", "router_id": "2.4.3.1", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 10, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 31787, "tx_updates": 9302, "rx_keepalives": 5695, "tx_keepalives": 21461}, {"name": "EDGE-RTR1", "router_id": "1.1.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 44532, "tx_updates": 48720, "rx_keepalives": 9598, "tx_keepalives": 1187}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.82 timers 30 90", "clear ip bgp 192.0.2.82"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:55:00Z", "neighbor": "192.0.2.31"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.1.2.3", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 7, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 40322, "tx_updates": 23123, "rx_keepalives": 3673, "tx_keepalives": 45545}, {"name": "DC-RTR1", "router_id": "4.3.2.4", "local_as": 65002, "neighbor_ip": "192.0.2.200", "remote_as": 65010, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 60, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 22168, "tx_updates": 9474, "rx_keepalives": 49352, "tx_keepalives": 29221}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.31 shutdown", "neighbor 192.0.2.31 no shutdown", "clear ip bgp 192.0.2.31"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T15:55:00Z", "neighbor": "192.0.2.185"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.185", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 1752, "tx_updates": 35898, "rx_keepalives": 40184, "tx_keepalives": 4507}, {"name": "EDGE-RTR1", "router_id": "4.5.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 1259, "tx_updates": 37438, "rx_keepalives": 16981, "tx_keepalives": 30018}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.185"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T17:38:00Z", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "router_id": "3.5.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 30, "hold": 180, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 42054, "tx_updates": 22663, "rx_keepalives": 30205, "tx_keepalives": 9949}, {"name": "DC-RTR1", "router_id": "2.3.4.4", "local_as": 65001, "neighbor_ip": "192.0.2.208", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 29, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 31692, "tx_updates": 11868, "rx_keepalives": 20378, "tx_keepalives": 4775}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.190 timers 30 90", "clear ip bgp 192.0.2.190"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:15:00Z", "neighbor": "192.0.2.133"}, "devices": [{"name": "DC-RTR1", "router_id": "5.3.2.4", "local_as": 65010, "neighbor_ip": "192.0.2.133", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 20, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 3266, "tx_updates": 1788, "rx_keepalives": 19839, "tx_keepalives": 45814}, {"name": "CORE-R1", "router_id": "2.5.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.33", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 43494, "tx_updates": 9146, "rx_keepalives": 40298, "tx_keepalives": 5911}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.133 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T21:43:00Z", "neighbor": "192.0.2.14"}, "devices": [{"name": "DC-RTR1", "router_id": "4.4.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 44934, "tx_updates": 20021, "rx_keepalives": 31120, "tx_keepalives": 41616}, {"name": "EDGE-RTR1", "router_id": "5.1.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.190", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 30, "hold": 90, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 43666, "tx_updates": 12835, "rx_keepalives": 31395, "tx_keepalives": 6005}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.14 timers 30 180", "clear ip bgp 192.0.2.14"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:59:00Z", "neighbor": "192.0.2.123"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.3.4.5", "local_as": 65100, "neighbor_ip": "192.0.2.123", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 27, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 38802, "tx_updates": 8897, "rx_keepalives": 4056, "tx_keepalives": 32342}, {"name": "DC-RTR1", "router_id": "2.1.3.1", "local_as": 65002, "neighbor_ip": "192.0.2.239", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 26620, "tx_updates": 26731, "rx_keepalives": 3997, "tx_keepalives": 38449}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65100", "neighbor 192.0.2.123 timers 30 180", "clear ip bgp 192.0.2.123"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T13:26:00Z", "neighbor": "192.0.2.220"}, "devices": [{"name": "DC-RTR1", "router_id": "1.4.2.5", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 8461, "tx_updates": 31183, "rx_keepalives": 42802, "tx_keepalives": 1412}, {"name": "CORE-R1", "router_id": "2.1.3.5", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 22499, "tx_updates": 14025, "rx_keepalives": 31924, "tx_keepalives": 16120}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.220 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:44:00Z", "neighbor": "192.0.2.81"}, "devices": [{"name": "DC-RTR1", "router_id": "2.4.3.3", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 21, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 38574, "tx_updates": 30412, "rx_keepalives": 16169, "tx_keepalives": 9367}, {"name": "BRANCH-RTR1", "router_id": "3.2.1.5", "local_as": 65010, "neighbor_ip": "192.0.2.9", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 32, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 12403, "tx_updates": 12999, "rx_keepalives": 36326, "tx_keepalives": 4520}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.81 timers 60 180", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T14:22:00Z", "neighbor": "192.0.2.233"}, "devices": [{"name": "EDGE-RTR1", "router_id": "2.2.2.1", "local_as": 65001, "neighbor_ip": "192.0.2.233", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 16, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 31970, "tx_updates": 24768, "rx_keepalives": 23664, "tx_keepalives": 17062}, {"name": "BRANCH-RTR1", "router_id": "2.4.5.4", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 51, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 40854, "tx_updates": 28344, "rx_keepalives": 16264, "tx_keepalives": 6449}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.233 remote-as 65100", "neighbor 192.0.2.233 timers 10 30", "clear ip bgp 192.0.2.233"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T16:18:00Z", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.5.2", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 43, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 10460, "tx_updates": 4438, "rx_keepalives": 37575, "tx_keepalives": 16608}, {"name": "EDGE-RTR1", "router_id": "3.4.5.2", "local_as": 65002, "neighbor_ip": "192.0.2.194", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 59, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 4718, "tx_updates": 47138, "rx_keepalives": 9937, "tx_keepalives": 10005}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.189 shutdown", "neighbor 192.0.2.189 no shutdown", "clear ip bgp 192.0.2.189"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:15:00Z", "neighbor": "192.0.2.65"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 24, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 17251, "tx_updates": 11951, "rx_keepalives": 5381, "tx_keepalives": 5199}, {"name": "CORE-R1", "router_id": "4.2.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 6, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 10369, "tx_updates": 17729, "rx_keepalives": 4720, "tx_keepalives": 41575}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.65 timers 30 180", "clear ip bgp 192.0.2.65"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:22:00Z", "neighbor": "192.0.2.85"}, "devices": [{"name": "EDGE-RTR1", "router_id": "3.1.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25303, "tx_updates": 45384, "rx_keepalives": 37582, "tx_keepalives": 42344}, {"name": "CORE-R1", "router_id": "5.3.1.5", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 16, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 25050, "tx_updates": 39059, "rx_keepalives": 42400, "tx_keepalives": 36563}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "neighbor 192.0.2.85 timers 30 180", "clear ip bgp 192.0.2.85"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "EDGE-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T11:00:00Z", "neighbor": "192.0.2.136"}, "devices": [{"name": "EDGE-RTR1", "router_id": "5.5.2.5", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 6, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 21371, "tx_updates": 32386, "rx_keepalives": 45068, "tx_keepalives": 19175}, {"name": "CORE-R1", "router_id": "4.1.1.4", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 10, "hold": 60, "flap_count_24h": 51, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 29737, "tx_updates": 29495, "rx_keepalives": 20883, "tx_keepalives": 2294}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.136 shutdown", "neighbor 192.0.2.136 no shutdown", "clear ip bgp 192.0.2.136"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:59:00Z", "neighbor": "192.0.2.235"}, "devices": [{"name": "CORE-R1", "router_id": "3.2.1.1", "local_as": 65100, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 9, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 21035, "tx_updates": 43141, "rx_keepalives": 43807, "tx_keepalives": 49071}, {"name": "BRANCH-RTR1", "router_id": "1.1.4.5", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 4, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 45872, "tx_updates": 31997, "rx_keepalives": 10520, "tx_keepalives": 7984}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.235 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T15:07:00Z", "neighbor": "192.0.2.67"}, "devices": [{"name": "CORE-R1", "router_id": "5.2.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65100, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 39, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 34865, "tx_updates": 31850, "rx_keepalives": 17601, "tx_keepalives": 4751}, {"name": "DC-RTR1", "router_id": "1.3.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.151", "remote_as": 65002, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 23637, "tx_updates": 19729, "rx_keepalives": 37695, "tx_keepalives": 41369}], "cli_fix": ["interface GigabitEthernet0/1", "no shutdown", "router bgp 65002", "neighbor 192.0.2.67 timers 60 180", "clear ip bgp 192.0.2.67"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:49:00Z", "neighbor": "192.0.2.130"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 12, "last_reset_reason": "Admin reset", "bfd": "enabled", "rx_updates": 45016, "tx_updates": 23855, "rx_keepalives": 24738, "tx_keepalives": 12559}, {"name": "CORE-R1", "router_id": "2.3.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.11", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 16, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 11766, "tx_updates": 18772, "rx_keepalives": 17729, "tx_keepalives": 1631}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.130"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:31:00Z", "neighbor": "192.0.2.1"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.4.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.1", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 36, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 35123, "tx_updates": 9549, "rx_keepalives": 30225, "tx_keepalives": 23394}, {"name": "CORE-R1", "router_id": "3.2.2.2", "local_as": 65100, "neighbor_ip": "192.0.2.229", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 90, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 43355, "tx_updates": 33840, "rx_keepalives": 23107, "tx_keepalives": 26040}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.1 update-source Loopback0", "neighbor 192.0.2.1 timers 60 360", "clear ip bgp 192.0.2.1"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T20:27:00Z", "neighbor": "192.0.2.74"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 3306, "tx_updates": 27015, "rx_keepalives": 22398, "tx_keepalives": 32229}, {"name": "DC-RTR1", "router_id": "1.1.5.3", "local_as": 65010, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 13, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 36745, "tx_updates": 6760, "rx_keepalives": 41898, "tx_keepalives": 41186}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.74 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T12:59:00Z", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "3.5.5.1", "local_as": 65002, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 19, "last_reset_reason": "BFD down", "bfd": "enabled", "rx_updates": 37764, "tx_updates": 6462, "rx_keepalives": 27666, "tx_keepalives": 1492}, {"name": "DC-RTR1", "router_id": "3.1.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.34", "remote_as": 65002, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 57, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 1455, "tx_updates": 22770, "rx_keepalives": 42176, "tx_keepalives": 32580}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65002", "clear ip bgp 192.0.2.166"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T23:15:00Z", "neighbor": "192.0.2.39"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.3.5.2", "local_as": 65001, "neighbor_ip": "192.0.2.39", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 11, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 30106, "tx_updates": 10414, "rx_keepalives": 47359, "tx_keepalives": 8398}, {"name": "EDGE-RTR1", "router_id": "4.5.3.5", "local_as": 65010, "neighbor_ip": "192.0.2.96", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 32088, "tx_updates": 33882, "rx_keepalives": 28572, "tx_keepalives": 41934}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.39 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T22:30:00Z", "neighbor": "192.0.2.22"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.1.5", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 43669, "tx_updates": 28873, "rx_keepalives": 31225, "tx_keepalives": 7684}, {"name": "EDGE-RTR1", "router_id": "4.4.3.1", "local_as": 65001, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 14271, "tx_updates": 513, "rx_keepalives": 32041, "tx_keepalives": 38712}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.22 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T11:19:00Z", "neighbor": "192.0.2.141"}, "devices": [{"name": "DC-RTR1", "router_id": "3.5.4.1", "local_as": 65010, "neighbor_ip": "192.0.2.141", "remote_as": 65100, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 17, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 2575, "tx_updates": 20981, "rx_keepalives": 8028, "tx_keepalives": 20308}, {"name": "BRANCH-RTR1", "router_id": "2.2.4.1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 7, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 5004, "tx_updates": 39276, "rx_keepalives": 24666, "tx_keepalives": 48148}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.141"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "high", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T19:52:00Z", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "router_id": "5.5.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 13320, "tx_updates": 12497, "rx_keepalives": 33630, "tx_keepalives": 12456}, {"name": "EDGE-RTR1", "router_id": "5.4.4.2", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 38, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 21290, "tx_updates": 12763, "rx_keepalives": 27016, "tx_keepalives": 28236}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.7 update-source Loopback0", "neighbor 192.0.2.7 timers 60 360", "clear ip bgp 192.0.2.7"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "DC-RTR1", "severity": "high", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T23:47:00Z", "neighbor": "192.0.2.173"}, "devices": [{"name": "DC-RTR1", "router_id": "4.2.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.173", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 26, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 7626, "tx_updates": 12281, "rx_keepalives": 17546, "tx_keepalives": 26214}, {"name": "EDGE-RTR1", "router_id": "2.1.5.5", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 8, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 28204, "tx_updates": 11620, "rx_keepalives": 17050, "tx_keepalives": 10742}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.173 remote-as 65002", "neighbor 192.0.2.173 timers 10 60", "clear ip bgp 192.0.2.173"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T14:41:00Z", "neighbor": "192.0.2.175"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.5.5.1", "local_as": 65100, "neighbor_ip": "192.0.2.175", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 30, "hold": 180, "flap_count_24h": 3, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 45542, "tx_updates": 43608, "rx_keepalives": 38957, "tx_keepalives": 18944}, {"name": "DC-RTR1", "router_id": "4.3.5.5", "local_as": 65010, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 7, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 47067, "tx_updates": 27891, "rx_keepalives": 16921, "tx_keepalives": 30249}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.175"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T21:44:00Z", "neighbor": "192.0.2.201"}, "devices": [{"name": "CORE-R1", "router_id": "5.1.4.4", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Connect", "keepalive": 10, "hold": 30, "flap_count_24h": 40, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 22604, "tx_updates": 40321, "rx_keepalives": 39323, "tx_keepalives": 14515}, {"name": "BRANCH-RTR1", "router_id": "5.5.3.2", "local_as": 65010, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 180, "flap_count_24h": 26, "last_reset_reason": "BFD down", "bfd": "disabled", "rx_updates": 29063, "tx_updates": 36937, "rx_keepalives": 27817, "tx_keepalives": 11510}], "cli_fix": ["interface GigabitEthernet0/0", "no shutdown", "router bgp 65100", "clear ip bgp 192.0.2.201"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:32:00Z", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "5.2.3.4", "local_as": 65100, "neighbor_ip": "192.0.2.113", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 10, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 39159, "tx_updates": 1420, "rx_keepalives": 39315, "tx_keepalives": 15143}, {"name": "EDGE-RTR1", "router_id": "3.1.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 60, "hold": 360, "flap_count_24h": 15, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 43905, "tx_updates": 23004, "rx_keepalives": 15390, "tx_keepalives": 6396}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.113"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "high", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:47:00Z", "neighbor": "192.0.2.219"}, "devices": [{"name": "CORE-R1", "router_id": "4.1.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.219", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 30, "flap_count_24h": 18, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 10553, "tx_updates": 25835, "rx_keepalives": 48354, "tx_keepalives": 5672}, {"name": "EDGE-RTR1", "router_id": "1.3.3.2", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 10, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 18598, "tx_updates": 11456, "rx_keepalives": 45919, "tx_keepalives": 17221}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.219"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "DC-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T17:18:00Z", "neighbor": "192.0.2.128"}, "devices": [{"name": "DC-RTR1", "router_id": "1.2.1.4", "local_as": 65001, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 4, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 15895, "tx_updates": 31629, "rx_keepalives": 9792, "tx_keepalives": 31997}, {"name": "BRANCH-RTR1", "router_id": "1.3.3.5", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 11, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 590, "tx_updates": 7063, "rx_keepalives": 35096, "tx_keepalives": 39490}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.128 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T16:56:00Z", "neighbor": "192.0.2.215"}, "devices": [{"name": "CORE-R1", "router_id": "4.4.4.3", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65001, "update_source": "GigabitEthernet0/0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 5, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 23753, "tx_updates": 2915, "rx_keepalives": 13979, "tx_keepalives": 48279}, {"name": "EDGE-RTR1", "router_id": "5.3.1.1", "local_as": 65001, "neighbor_ip": "192.0.2.136", "remote_as": 65002, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 30, "hold": 90, "flap_count_24h": 4, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 8100, "tx_updates": 12411, "rx_keepalives": 10007, "tx_keepalives": 31563}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.215 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T23:53:00Z", "neighbor": "192.0.2.88"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.2.1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 3, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 12474, "tx_updates": 37433, "rx_keepalives": 13932, "tx_keepalives": 12571}, {"name": "EDGE-RTR1", "router_id": "1.5.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65010, "update_source": "Loopback0", "interface": "GigabitEthernet0/2", "bgp_state": "Established", "keepalive": 10, "hold": 60, "flap_count_24h": 22, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 400, "tx_updates": 41455, "rx_keepalives": 39701, "tx_keepalives": 12511}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.88 update-source Loopback0", "neighbor 192.0.2.88 timers 30 180", "clear ip bgp 192.0.2.88"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "medium", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T10:45:00Z", "neighbor": "192.0.2.142"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "2.5.4.5", "local_as": 65010, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 11, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 22080, "tx_updates": 37273, "rx_keepalives": 26354, "tx_keepalives": 19326}, {"name": "DC-RTR1", "router_id": "2.2.5.5", "local_as": 65100, "neighbor_ip": "192.0.2.79", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Active", "keepalive": 30, "hold": 180, "flap_count_24h": 15, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 9366, "tx_updates": 7830, "rx_keepalives": 2692, "tx_keepalives": 41267}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.142 soft in"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP session flap detected", "device": "CORE-R1", "severity": "medium", "description": "BGP neighbor session is flapping frequently.", "timestamp": "2025-11-21T13:12:00Z", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "router_id": "3.5.2.1", "local_as": 65002, "neighbor_ip": "192.0.2.105", "remote_as": 65001, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Connect", "keepalive": 30, "hold": 90, "flap_count_24h": 33, "last_reset_reason": "Peer reset", "bfd": "enabled", "rx_updates": 22770, "tx_updates": 5547, "rx_keepalives": 43987, "tx_keepalives": 4950}, {"name": "DC-RTR1", "router_id": "3.2.4.3", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/1", "bgp_state": "Connect", "keepalive": 60, "hold": 180, "flap_count_24h": 59, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 15523, "tx_updates": 9463, "rx_keepalives": 18436, "tx_keepalives": 8303}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.105 shutdown", "neighbor 192.0.2.105 no shutdown", "clear ip bgp 192.0.2.105"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T18:38:00Z", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "1.1.5.4", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Active", "keepalive": 10, "hold": 60, "flap_count_24h": 14, "last_reset_reason": "Admin reset", "bfd": "disabled", "rx_updates": 32167, "tx_updates": 8162, "rx_keepalives": 12431, "tx_keepalives": 19849}, {"name": "CORE-R1", "router_id": "1.1.3.2", "local_as": 65002, "neighbor_ip": "192.0.2.27", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 19, "last_reset_reason": "Cease/other configuration change", "bfd": "enabled", "rx_updates": 19115, "tx_updates": 46366, "rx_keepalives": 47280, "tx_keepalives": 8968}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.113 soft in"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T11:11:00Z", "neighbor": "192.0.2.36"}, "devices": [{"name": "BRANCH-RTR1", "router_id": "4.5.4.1", "local_as": 65001, "neighbor_ip": "192.0.2.36", "remote_as": 65100, "update_source": "GigabitEthernet0/2", "interface": "GigabitEthernet0/2", "bgp_state": "Idle", "keepalive": 60, "hold": 360, "flap_count_24h": 19, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 10012, "tx_updates": 29562, "rx_keepalives": 6521, "tx_keepalives": 30655}, {"name": "DC-RTR1", "router_id": "5.5.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 37, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 37360, "tx_updates": 44417, "rx_keepalives": 2374, "tx_keepalives": 30996}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.36 timers 30 180", "clear ip bgp 192.0.2.36"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP hold timer expiration", "device": "CORE-R1", "severity": "medium", "description": "BGP session reset due to hold timer expiration.", "timestamp": "2025-11-21T14:55:00Z", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "router_id": "1.4.4.3", "local_as": 65010, "neighbor_ip": "192.0.2.52", "remote_as": 65001, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Idle", "keepalive": 60, "hold": 180, "flap_count_24h": 30, "last_reset_reason": "Hold timer expired", "bfd": "enabled", "rx_updates": 13604, "tx_updates": 5447, "rx_keepalives": 36939, "tx_keepalives": 1985}, {"name": "DC-RTR1", "router_id": "4.3.2.3", "local_as": 65001, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "update_source": "GigabitEthernet0/1", "interface": "GigabitEthernet0/1", "bgp_state": "Active", "keepalive": 60, "hold": 360, "flap_count_24h": 9, "last_reset_reason": "Hold timer expired", "bfd": "disabled", "rx_updates": 1780, "tx_updates": 5149, "rx_keepalives": 33805, "tx_keepalives": 12980}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.52 update-source Loopback0", "neighbor 192.0.2.52 timers 60 180", "clear ip bgp 192.0.2.52"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "wazuh_alert": {"rule": "BGP neighborship reset detected", "device": "CORE-R1", "severity": "critical", "description": "BGP session reset/cleared detected.", "timestamp": "2025-11-21T19:22:00Z", "neighbor": "192.0.2.155"}, "devices": [{"name": "CORE-R1", "router_id": "5.4.3.4", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65100, "update_source": "Loopback0", "interface": "GigabitEthernet0/0", "bgp_state": "Established", "keepalive": 10, "hold": 30, "flap_count_24h": 15, "last_reset_reason": "Cease/other configuration change", "bfd": "disabled", "rx_updates": 36188, "tx_updates": 9017, "rx_keepalives": 22969, "tx_keepalives": 35872}, {"name": "DC-RTR1", "router_id": "2.5.1.2", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65010, "update_source": "Loopback0", "interface": "Loopback0", "bgp_state": "Established", "keepalive": 60, "hold": 180, "flap_count_24h": 8, "last_reset_reason": "Peer reset", "bfd": "disabled", "rx_updates": 21136, "tx_updates": 13298, "rx_keepalives": 8243, "tx_keepalives": 5916}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.155"]}