diff --git "a/datasets/bgp1_dataset_v3_900.jsonl" "b/datasets/bgp1_dataset_v3_900.jsonl"
new file mode 100644--- /dev/null
+++ "b/datasets/bgp1_dataset_v3_900.jsonl"
@@ -0,0 +1,900 @@
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.157"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.157", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.157 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.3"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.3 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.236"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.236"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.171"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.171 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.165"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.165", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.165 timers 60 180", "clear ip bgp 192.0.2.165"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.154", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.154 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.237"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.237", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.237 timers 30 90", "clear ip bgp 192.0.2.237"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.123"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.123", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.123 timers 30 180", "clear ip bgp 192.0.2.123"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.10"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.10 timers 30 180", "clear ip bgp 192.0.2.10"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.51"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.51 timers 30 180", "clear ip bgp 192.0.2.51"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.78"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.78", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.78 timers 60 180", "clear ip bgp 192.0.2.78"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.191"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.191", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.191 timers 60 180", "clear ip bgp 192.0.2.191"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.54"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.54"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.84"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.84", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.84"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.24 timers 60 180", "clear ip bgp 192.0.2.24"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.22"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.22 timers 60 180", "clear ip bgp 192.0.2.22"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.164"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.164", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.164"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.30"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.30"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.110 timers 30 180", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.64"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.64 timers 60 180", "clear ip bgp 192.0.2.64"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.11"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.11", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.11 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.76"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.76 timers 30 90", "clear ip bgp 192.0.2.76"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.79 timers 60 180", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.194"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.194", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.194 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.200"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.200", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.200 timers 30 90", "clear ip bgp 192.0.2.200"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.236"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.236 timers 30 90", "clear ip bgp 192.0.2.236"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.113"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.113 timers 60 180", "clear ip bgp 192.0.2.113"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.35 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.252"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.252", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.252 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.204"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.204 timers 30 180", "clear ip bgp 192.0.2.204"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.164"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.164", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.164 timers 60 180", "clear ip bgp 192.0.2.164"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.125"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.125 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.54"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.54"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.235"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.235 timers 30 90", "clear ip bgp 192.0.2.235"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.125"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.125 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.190 timers 60 180", "clear ip bgp 192.0.2.190"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.15"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.15", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.15 timers 60 180", "clear ip bgp 192.0.2.15"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.90"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.90", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.90 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.70"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.70", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.70 timers 30 90", "clear ip bgp 192.0.2.70"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.93"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.93", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.93 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.204"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.204 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.233"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.233", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.233"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.35 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.114"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.114 timers 30 180", "clear ip bgp 192.0.2.114"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.83"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.83", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.83 timers 30 180", "clear ip bgp 192.0.2.83"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.223"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.223 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.122", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.122 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.201"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.201", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.201 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.66"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.66", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.66 timers 30 90", "clear ip bgp 192.0.2.66"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.65"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.65 timers 60 180", "clear ip bgp 192.0.2.65"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.216"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.216 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.105", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.105 timers 60 180", "clear ip bgp 192.0.2.105"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.135"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.135", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.135 timers 30 180", "clear ip bgp 192.0.2.135"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.186"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.186 timers 30 180", "clear ip bgp 192.0.2.186"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.164"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.164", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.164 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.34"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.34", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.34 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.147"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.147", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.147 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.222"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.222 timers 30 180", "clear ip bgp 192.0.2.222"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.166"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.166", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.166"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.15", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.15 timers 60 180", "clear ip bgp 192.0.2.15"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.160"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.160 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.192"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.192", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.192 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.58"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.58", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.58 timers 60 180", "clear ip bgp 192.0.2.58"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.222"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.222", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.222 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.187", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.187 timers 60 180", "clear ip bgp 192.0.2.187"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.55"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.55"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.91"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.213", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.213 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.225"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.225", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.225 timers 60 180", "clear ip bgp 192.0.2.225"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.245", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.245"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.188"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.188 timers 30 180", "clear ip bgp 192.0.2.188"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.250"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.250 timers 30 180", "clear ip bgp 192.0.2.250"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.219"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.219", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.219"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.217"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.217", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.217"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.30"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.30 timers 30 90", "clear ip bgp 192.0.2.30"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.119"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.119 timers 60 180", "clear ip bgp 192.0.2.119"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.77"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.77 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.252"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.252 timers 30 90", "clear ip bgp 192.0.2.252"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.44"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.44", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.44 timers 30 90", "clear ip bgp 192.0.2.44"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.49"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.49", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.49 timers 30 180", "clear ip bgp 192.0.2.49"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.200"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.200", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.200"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.15"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.15", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.15 timers 60 180", "clear ip bgp 192.0.2.15"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.244"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.244", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.244 timers 60 180", "clear ip bgp 192.0.2.244"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.2"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.2 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.154"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.154 timers 60 180", "clear ip bgp 192.0.2.154"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.113"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.113 timers 30 180", "clear ip bgp 192.0.2.113"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.206"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.206", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.206 timers 30 90", "clear ip bgp 192.0.2.206"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.116 timers 30 180", "clear ip bgp 192.0.2.116"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.61"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.61", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.61 timers 30 90", "clear ip bgp 192.0.2.61"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.7 timers 60 180", "clear ip bgp 192.0.2.7"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.107"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.107 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.96"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.96"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.209"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.209", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.209 timers 30 180", "clear ip bgp 192.0.2.209"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.73"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.73 timers 30 180", "clear ip bgp 192.0.2.73"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.104"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.166 timers 30 180", "clear ip bgp 192.0.2.166"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.223"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.223 timers 30 180", "clear ip bgp 192.0.2.223"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.165"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.165", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.165 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.253"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.253 timers 30 90", "clear ip bgp 192.0.2.253"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.78"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.78", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.78 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.59", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.59 timers 30 90", "clear ip bgp 192.0.2.59"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.65 timers 30 180", "clear ip bgp 192.0.2.65"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.16"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.16 timers 60 180", "clear ip bgp 192.0.2.16"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.63 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.6"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.6 timers 30 180", "clear ip bgp 192.0.2.6"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.47 timers 60 180", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.59"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.59", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.59 timers 30 180", "clear ip bgp 192.0.2.59"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.174"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.174 timers 30 180", "clear ip bgp 192.0.2.174"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.190"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.190 timers 30 180", "clear ip bgp 192.0.2.190"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.122"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.222"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.222", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.222 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.161"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.161 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.186"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.186 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.48"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.48 timers 60 180", "clear ip bgp 192.0.2.48"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.43"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.43 timers 60 180", "clear ip bgp 192.0.2.43"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.202"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.202 timers 30 180", "clear ip bgp 192.0.2.202"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.160"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.160"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.130"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.130"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.99"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.99 timers 30 90", "clear ip bgp 192.0.2.99"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.226"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.226", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.226 timers 30 90", "clear ip bgp 192.0.2.226"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.234"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.234 timers 30 180", "clear ip bgp 192.0.2.234"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.182"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.182", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.182 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.191"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.191", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.191 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.131"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.131"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.221"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.221", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.221 timers 60 180", "clear ip bgp 192.0.2.221"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.112"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.112", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.112 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.249 timers 30 180", "clear ip bgp 192.0.2.249"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.79"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.79 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.176"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.176", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.176"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.74"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.74 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.27"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.27 timers 30 90", "clear ip bgp 192.0.2.27"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.158"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.158 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.125"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.125 timers 30 90", "clear ip bgp 192.0.2.125"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.212"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.212", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.212 timers 30 90", "clear ip bgp 192.0.2.212"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.122"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.19 timers 30 90", "clear ip bgp 192.0.2.19"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.14"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.14 timers 30 90", "clear ip bgp 192.0.2.14"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.88", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.88"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.154"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.154", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.154 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.231", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.231 timers 30 180", "clear ip bgp 192.0.2.231"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.158"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.158", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.158 timers 30 90", "clear ip bgp 192.0.2.158"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.156 timers 30 180", "clear ip bgp 192.0.2.156"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.151"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.151", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.151 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.79 timers 60 180", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.19", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.19 timers 60 180", "clear ip bgp 192.0.2.19"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.78"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.78 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.71"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.71", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.71"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.121"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.121 timers 30 180", "clear ip bgp 192.0.2.121"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.29"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.29 timers 30 180", "clear ip bgp 192.0.2.29"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.199"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.199", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.199 timers 60 180", "clear ip bgp 192.0.2.199"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.198"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.198", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.198 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.147"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.147", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.147"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.241"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.241"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.243"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.243 timers 30 180", "clear ip bgp 192.0.2.243"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.91 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.194"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.194", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.194 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.164"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.164", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.164 timers 30 180", "clear ip bgp 192.0.2.164"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.115 timers 30 90", "clear ip bgp 192.0.2.115"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.199"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.199", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.199 timers 30 90", "clear ip bgp 192.0.2.199"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.83"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.83", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.83 timers 60 180", "clear ip bgp 192.0.2.83"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.42"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.42", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.42 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.234"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.234 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.253"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.253", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.253"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.2"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.2", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.2 timers 30 90", "clear ip bgp 192.0.2.2"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.135"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.135", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.135 timers 30 180", "clear ip bgp 192.0.2.135"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.18", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.18 timers 30 90", "clear ip bgp 192.0.2.18"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.85 timers 30 90", "clear ip bgp 192.0.2.85"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.89"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.89", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.89 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.233"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.233 timers 30 90", "clear ip bgp 192.0.2.233"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.166 timers 30 180", "clear ip bgp 192.0.2.166"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.243"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.243", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.243 timers 30 180", "clear ip bgp 192.0.2.243"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.76"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.76", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.76"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.94"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.94", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.94"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.2"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.2"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.99"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.99 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.207"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.207", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.207"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.138", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.138"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.1"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.1 timers 60 180", "clear ip bgp 192.0.2.1"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.224"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.224 timers 30 180", "clear ip bgp 192.0.2.224"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.127"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.127", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.127 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.44"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.44", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.44 timers 30 90", "clear ip bgp 192.0.2.44"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.18", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.18 timers 30 180", "clear ip bgp 192.0.2.18"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.87 timers 30 180", "clear ip bgp 192.0.2.87"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.208"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.208", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.208 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.202"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.202"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.169 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.57"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.57", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.57 timers 30 90", "clear ip bgp 192.0.2.57"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.96"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.96 timers 60 180", "clear ip bgp 192.0.2.96"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.29"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.29 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.162"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.162"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.45"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.45 timers 60 180", "clear ip bgp 192.0.2.45"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.4"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.4 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.170 timers 60 180", "clear ip bgp 192.0.2.170"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.215"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.215 timers 30 90", "clear ip bgp 192.0.2.215"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.52"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.52 timers 30 90", "clear ip bgp 192.0.2.52"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.191"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.191 timers 30 90", "clear ip bgp 192.0.2.191"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.201"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.201 timers 60 180", "clear ip bgp 192.0.2.201"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.146"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.146 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.163"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.163", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.163 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.178"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.178"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.113"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.113 timers 30 180", "clear ip bgp 192.0.2.113"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.33"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.33 timers 60 180", "clear ip bgp 192.0.2.33"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.117"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.117 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.104"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.135"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.135", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.135 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.44"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.44", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.44 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.14"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.14 timers 30 180", "clear ip bgp 192.0.2.14"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.231 timers 60 180", "clear ip bgp 192.0.2.231"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.207", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.207 timers 60 180", "clear ip bgp 192.0.2.207"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.71"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.71", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.71"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.233"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.233"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.114"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.114 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.4", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.4 timers 60 180", "clear ip bgp 192.0.2.4"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.148"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.148", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.148 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.50"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.50", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.50 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.116", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.116 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.31"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.31"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.175"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.175 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.78"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.78"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.48"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.48 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.208"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.208", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.208 timers 60 180", "clear ip bgp 192.0.2.208"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.191"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.191", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.191 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.126"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.126"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.106"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.106 timers 30 90", "clear ip bgp 192.0.2.106"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.19"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.19 timers 60 180", "clear ip bgp 192.0.2.19"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.35 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.187 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.34"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.34", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.34 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.51"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.51 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.226"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.226", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.226 timers 30 90", "clear ip bgp 192.0.2.226"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.183"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.183 timers 30 180", "clear ip bgp 192.0.2.183"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.118 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.18", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.18 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.207"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.207", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.207 timers 60 180", "clear ip bgp 192.0.2.207"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.132"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.132", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.132 timers 30 180", "clear ip bgp 192.0.2.132"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.238"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.238 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.52"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.56"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.56", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.56"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.211", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.211 timers 60 180", "clear ip bgp 192.0.2.211"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.91"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.91", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.91 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.182"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.182", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.182 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.53"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.53", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.53"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.156 timers 30 90", "clear ip bgp 192.0.2.156"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.82"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.82", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.82 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.114"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.114 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.114"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.114 timers 60 180", "clear ip bgp 192.0.2.114"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.212"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.212 timers 30 180", "clear ip bgp 192.0.2.212"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.54"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.54"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.65"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.65 timers 60 180", "clear ip bgp 192.0.2.65"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.22"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.22 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.156"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.156", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.156 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.43"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.43"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.126"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.126 timers 30 90", "clear ip bgp 192.0.2.126"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.249"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.249 timers 60 180", "clear ip bgp 192.0.2.249"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.1"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.1", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.1 timers 60 180", "clear ip bgp 192.0.2.1"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.246"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.246"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.221"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.221", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.221 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.16"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.16", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.16 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.47"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.47 timers 60 180", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.163"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.163", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.163 timers 60 180", "clear ip bgp 192.0.2.163"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.211"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.211", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.211 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.91", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.91"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.189"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.189 timers 30 180", "clear ip bgp 192.0.2.189"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.143"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.143"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.87"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.87 timers 60 180", "clear ip bgp 192.0.2.87"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.136"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.136 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.224"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.224 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.2"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.2", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.2 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.146"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.146 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.53"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.53", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.53 timers 30 90", "clear ip bgp 192.0.2.53"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.186"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.186", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.186 timers 30 180", "clear ip bgp 192.0.2.186"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.121"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.121"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.149"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.149", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.149 timers 60 180", "clear ip bgp 192.0.2.149"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.45"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.45", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.45 timers 30 90", "clear ip bgp 192.0.2.45"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.92"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.92 timers 30 90", "clear ip bgp 192.0.2.92"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.214"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.214", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.214 timers 30 180", "clear ip bgp 192.0.2.214"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.244", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.244 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.128"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.128", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.128 timers 30 180", "clear ip bgp 192.0.2.128"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.40"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.40", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.40 timers 30 180", "clear ip bgp 192.0.2.40"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.161"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.161 timers 30 90", "clear ip bgp 192.0.2.161"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.232", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.232"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.128"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.128 timers 30 90", "clear ip bgp 192.0.2.128"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.19"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.19", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.19"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.226"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.226", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.226 timers 30 180", "clear ip bgp 192.0.2.226"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.166"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.166", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.166 timers 60 180", "clear ip bgp 192.0.2.166"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.136"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.136", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.136 timers 60 180", "clear ip bgp 192.0.2.136"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.204"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.204", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.204"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.236"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.236", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.236 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.155"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.155 timers 60 180", "clear ip bgp 192.0.2.155"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.190"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.233"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.233", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.233 timers 30 90", "clear ip bgp 192.0.2.233"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.240"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.240", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.240 timers 30 180", "clear ip bgp 192.0.2.240"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.8", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.8 timers 30 90", "clear ip bgp 192.0.2.8"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.182"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.182", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.182 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.188"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.188 timers 30 90", "clear ip bgp 192.0.2.188"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.103", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.103"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.190", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.197"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.197 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.4"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.93"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.93", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.93 timers 30 180", "clear ip bgp 192.0.2.93"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.54"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.54 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.168"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.168 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.169", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.169 timers 30 180", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.113 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.97"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.97 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.173"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.173 timers 30 180", "clear ip bgp 192.0.2.173"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.159"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.159", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.159"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.189 timers 30 180", "clear ip bgp 192.0.2.189"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.104 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.185"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.185", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.185 timers 30 180", "clear ip bgp 192.0.2.185"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.208"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.208", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.208 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.16"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.16 timers 30 90", "clear ip bgp 192.0.2.16"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.76"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.76", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.76"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.210"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.210", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.210 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.143"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.143", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.143"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.52", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.52 timers 30 90", "clear ip bgp 192.0.2.52"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.7", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.7 timers 60 180", "clear ip bgp 192.0.2.7"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.199"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.199", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.199 timers 30 90", "clear ip bgp 192.0.2.199"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.12"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.12", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.12"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.56"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.56", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.56 timers 60 180", "clear ip bgp 192.0.2.56"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.94 timers 60 180", "clear ip bgp 192.0.2.94"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.253"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.253 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.174"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.174 timers 30 180", "clear ip bgp 192.0.2.174"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.62 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.196"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.196 timers 30 180", "clear ip bgp 192.0.2.196"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.226"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.226", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.226 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.30"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.30 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.159 timers 60 180", "clear ip bgp 192.0.2.159"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.88", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.88 timers 60 180", "clear ip bgp 192.0.2.88"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.109", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.109"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.22"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.22", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.22 timers 60 180", "clear ip bgp 192.0.2.22"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.189 timers 30 180", "clear ip bgp 192.0.2.189"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.87 timers 30 90", "clear ip bgp 192.0.2.87"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.151 timers 30 180", "clear ip bgp 192.0.2.151"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.140"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.140"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.184 timers 30 90", "clear ip bgp 192.0.2.184"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.119"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.119 timers 30 90", "clear ip bgp 192.0.2.119"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.176"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.176 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.247 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.83"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.83 timers 30 90", "clear ip bgp 192.0.2.83"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.173"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.173 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.47"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.37"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.37", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.37 timers 30 180", "clear ip bgp 192.0.2.37"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.243"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.243 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.236"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.236", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.236 timers 60 180", "clear ip bgp 192.0.2.236"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.236"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.236 timers 30 90", "clear ip bgp 192.0.2.236"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.7"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.7 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.99"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.99 timers 60 180", "clear ip bgp 192.0.2.99"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.79"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.79 timers 60 180", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.126"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.126 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.72"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.72", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.72 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.4"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.4"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.41"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.41", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.41 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.50"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.50 timers 60 180", "clear ip bgp 192.0.2.50"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.136"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.136 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.25 timers 30 180", "clear ip bgp 192.0.2.25"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.166 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.128 timers 30 90", "clear ip bgp 192.0.2.128"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.188"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.188", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.188 timers 30 90", "clear ip bgp 192.0.2.188"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.181"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.181 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.101"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.101", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.101 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.160"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.160", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.160 timers 30 90", "clear ip bgp 192.0.2.160"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.180"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.180", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.180 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.64"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.64"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.9"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.9", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.9"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.47"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.47", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.47 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.215 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.6"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.6 timers 30 180", "clear ip bgp 192.0.2.6"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.160"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.160", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.160 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.192"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.192", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.192 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.35 timers 60 180", "clear ip bgp 192.0.2.35"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.155"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.155 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.175"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.175", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.175 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.186"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.186", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.186 timers 30 180", "clear ip bgp 192.0.2.186"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.169", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.169"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.120"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.120", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.120"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.85"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.85 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.109"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.109 timers 60 180", "clear ip bgp 192.0.2.109"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.201"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.201"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.59", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.59 timers 30 90", "clear ip bgp 192.0.2.59"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.241"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.241"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.146"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.146"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.26"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.26 timers 30 180", "clear ip bgp 192.0.2.26"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.146"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.146 timers 60 180", "clear ip bgp 192.0.2.146"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.28"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.28", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.28 timers 30 180", "clear ip bgp 192.0.2.28"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.29"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.29 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.54"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.54 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.181 timers 30 90", "clear ip bgp 192.0.2.181"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.197 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.210"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.210 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.60"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.60", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.60 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.17"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.17"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.168"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.168", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.168"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.166"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.166 timers 60 180", "clear ip bgp 192.0.2.166"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.162"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.162 timers 60 180", "clear ip bgp 192.0.2.162"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.62"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.62 timers 30 180", "clear ip bgp 192.0.2.62"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.186"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.186 timers 30 90", "clear ip bgp 192.0.2.186"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.177"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.177", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.177 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.13"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.13"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.53"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.53 timers 60 180", "clear ip bgp 192.0.2.53"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.108"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.108", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.108 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.122", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.122 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.233"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.233", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.233 timers 30 90", "clear ip bgp 192.0.2.233"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.39 timers 30 180", "clear ip bgp 192.0.2.39"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.63"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.63"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.240"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.240 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.131"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.131 timers 30 90", "clear ip bgp 192.0.2.131"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.98"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.98 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.43"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.43", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.43 timers 30 90", "clear ip bgp 192.0.2.43"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.220"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.220 timers 30 90", "clear ip bgp 192.0.2.220"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.103", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.103 timers 30 90", "clear ip bgp 192.0.2.103"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.55 timers 30 180", "clear ip bgp 192.0.2.55"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.55"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.55 timers 60 180", "clear ip bgp 192.0.2.55"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.91", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.91 timers 30 180", "clear ip bgp 192.0.2.91"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.216"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.216"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.220"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.220"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.126"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.126 timers 30 90", "clear ip bgp 192.0.2.126"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.123"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.123 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.107"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.107", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.107 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.160"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.160", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.160 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.209"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.209", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.209 timers 30 180", "clear ip bgp 192.0.2.209"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.116"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.116", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.116 timers 60 180", "clear ip bgp 192.0.2.116"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.167"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.167 timers 30 180", "clear ip bgp 192.0.2.167"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.85 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.163"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.163", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.163"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.42 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.9"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.9", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.9 timers 30 90", "clear ip bgp 192.0.2.9"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.224"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.224 timers 30 90", "clear ip bgp 192.0.2.224"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.59", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.59 timers 30 90", "clear ip bgp 192.0.2.59"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.93"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.93", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.93"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.229"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.229", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.229 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.17"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.17 timers 30 90", "clear ip bgp 192.0.2.17"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.58", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.58 timers 30 90", "clear ip bgp 192.0.2.58"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.94"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.200"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.200", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.200 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.82"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.82", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.82 timers 30 180", "clear ip bgp 192.0.2.82"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.205"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.205", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.205 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.79"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.79 timers 30 180", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.19", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.19 timers 30 180", "clear ip bgp 192.0.2.19"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.240"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.240", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.240"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.223"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.223", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.223"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.198"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.198 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.126"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.126 timers 60 180", "clear ip bgp 192.0.2.126"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.23 timers 30 180", "clear ip bgp 192.0.2.23"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.129", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.129 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.42"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.42 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.147"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.147 timers 30 90", "clear ip bgp 192.0.2.147"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.27"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.27", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.27 timers 30 90", "clear ip bgp 192.0.2.27"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.147"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.147", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.147 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.230"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.230", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.230 timers 60 180", "clear ip bgp 192.0.2.230"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.151", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.151 timers 30 180", "clear ip bgp 192.0.2.151"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.221"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.221", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.221"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.57"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.57 timers 30 90", "clear ip bgp 192.0.2.57"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.156 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.219"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.219 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.53"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.53 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.242"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.242 timers 60 180", "clear ip bgp 192.0.2.242"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.36"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.36 timers 60 180", "clear ip bgp 192.0.2.36"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.197"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.197 timers 30 90", "clear ip bgp 192.0.2.197"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.140 timers 30 90", "clear ip bgp 192.0.2.140"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.55 timers 60 180", "clear ip bgp 192.0.2.55"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.160"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.160 timers 30 90", "clear ip bgp 192.0.2.160"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.112"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.112", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.112 timers 60 180", "clear ip bgp 192.0.2.112"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.156"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.156", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.156 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.104 timers 60 180", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.74"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.74 timers 30 180", "clear ip bgp 192.0.2.74"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.119"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.119", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.119 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.37"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.37"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.140 timers 30 180", "clear ip bgp 192.0.2.140"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.82"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.82 timers 30 180", "clear ip bgp 192.0.2.82"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.63 timers 30 180", "clear ip bgp 192.0.2.63"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.108 timers 30 180", "clear ip bgp 192.0.2.108"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.80 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.238"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.238", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.238 timers 60 180", "clear ip bgp 192.0.2.238"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.204"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.204", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.204 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.89"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.89", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.89 timers 30 180", "clear ip bgp 192.0.2.89"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.54"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.54 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.72"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.72", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.72 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.70"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.70 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.70"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.70 timers 60 180", "clear ip bgp 192.0.2.70"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.173"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.173 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.37"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.37 timers 60 180", "clear ip bgp 192.0.2.37"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.159 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.247", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.247"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.35 timers 60 180", "clear ip bgp 192.0.2.35"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.57"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.57", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.57 timers 30 90", "clear ip bgp 192.0.2.57"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.180"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.180", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.180"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.27"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.27 timers 30 180", "clear ip bgp 192.0.2.27"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.125"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.125 timers 60 180", "clear ip bgp 192.0.2.125"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.246"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.246 timers 30 180", "clear ip bgp 192.0.2.246"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.93"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.93 timers 30 90", "clear ip bgp 192.0.2.93"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.30"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.30", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.30 timers 30 180", "clear ip bgp 192.0.2.30"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.15"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.15"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.64"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.64 timers 60 180", "clear ip bgp 192.0.2.64"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.62"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.62 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.138", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.138 timers 30 90", "clear ip bgp 192.0.2.138"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.251"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.251", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.251 timers 60 180", "clear ip bgp 192.0.2.251"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.50"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.50 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.23 timers 30 180", "clear ip bgp 192.0.2.23"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.55 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.254"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.254 timers 60 180", "clear ip bgp 192.0.2.254"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.178"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.178", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.178 timers 60 180", "clear ip bgp 192.0.2.178"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.58"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.58"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.4"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.4", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.4 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.168"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.168", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.168"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.11"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.11", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.11 timers 30 180", "clear ip bgp 192.0.2.11"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.110"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.110 timers 30 180", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.114"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.114 timers 30 180", "clear ip bgp 192.0.2.114"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.151"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.36"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.36", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.36 timers 30 180", "clear ip bgp 192.0.2.36"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.104"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.104 timers 60 180", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.238"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.238", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.238 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.249"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.249", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.249"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.34"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.34", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.34 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.7"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.199"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.199", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.199 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.31"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.31", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.31 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.229"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.229", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.229 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.246"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.246 timers 60 180", "clear ip bgp 192.0.2.246"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.226"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.226 timers 30 90", "clear ip bgp 192.0.2.226"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.243"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.243 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.166"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.166 timers 60 180", "clear ip bgp 192.0.2.166"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.19"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.19", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.19"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.236"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.236 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.187 timers 30 180", "clear ip bgp 192.0.2.187"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.172"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.172", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.172 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.7"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.7 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.13"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.13", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.13 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.60"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.60", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.60"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.119"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.119 timers 30 180", "clear ip bgp 192.0.2.119"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.68"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.68 timers 30 90", "clear ip bgp 192.0.2.68"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.161 timers 60 180", "clear ip bgp 192.0.2.161"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.253"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.253", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.253 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.91 timers 60 180", "clear ip bgp 192.0.2.91"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.11"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.11 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.102"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.102 timers 30 90", "clear ip bgp 192.0.2.102"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.70", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.70"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.46"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.46", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.46"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.14"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.14 timers 60 180", "clear ip bgp 192.0.2.14"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.129", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.129 timers 30 90", "clear ip bgp 192.0.2.129"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.187", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.187"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.159"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.159 timers 30 180", "clear ip bgp 192.0.2.159"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.160"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.160", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.160 timers 30 180", "clear ip bgp 192.0.2.160"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.140", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.140 timers 30 180", "clear ip bgp 192.0.2.140"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.214"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.214", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.214"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.6"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.6", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.6 timers 60 180", "clear ip bgp 192.0.2.6"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.249", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.249"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.246"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.246", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.246 timers 30 90", "clear ip bgp 192.0.2.246"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.137"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.137", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.137 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.119"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.119 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.25 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.93"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.93", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.93 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.210"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.210 timers 60 180", "clear ip bgp 192.0.2.210"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.252"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.252", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.252 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.24", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.24 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.168"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.168 timers 30 90", "clear ip bgp 192.0.2.168"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.227"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.227 timers 60 180", "clear ip bgp 192.0.2.227"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.218"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.218", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.218"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.87", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.87 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.104"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.90"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.90 timers 60 180", "clear ip bgp 192.0.2.90"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.41"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.41"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.51"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.51", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.51 timers 30 90", "clear ip bgp 192.0.2.51"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.34"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.34", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.34 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.103"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.103", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.103 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.23"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.23", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.23 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.252"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.252", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.252 timers 30 90", "clear ip bgp 192.0.2.252"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.81"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.81 timers 30 180", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.207"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.207", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.207"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.235"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.235 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.146"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.146", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.146 timers 30 180", "clear ip bgp 192.0.2.146"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.248 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.220"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.220", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.220 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.170 timers 60 180", "clear ip bgp 192.0.2.170"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.206"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.206 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.49"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.49 timers 30 90", "clear ip bgp 192.0.2.49"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.215"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.215 timers 60 180", "clear ip bgp 192.0.2.215"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.28 timers 60 180", "clear ip bgp 192.0.2.28"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.78"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.78", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.78 timers 30 180", "clear ip bgp 192.0.2.78"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.121"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.121", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.121"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.82"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.82", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.82 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.241"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.197"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.197 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.129"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.129", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.129 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.44"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.44", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.44 timers 60 180", "clear ip bgp 192.0.2.44"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.63 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.21"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.21 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.33"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.33 timers 60 180", "clear ip bgp 192.0.2.33"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.138 timers 30 90", "clear ip bgp 192.0.2.138"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.66"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.66", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.66 timers 30 180", "clear ip bgp 192.0.2.66"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.93"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.93 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.67"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.67 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.237"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.237", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.237 timers 60 180", "clear ip bgp 192.0.2.237"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.81"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.81", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.81 timers 30 180", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.232"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.232 timers 30 90", "clear ip bgp 192.0.2.232"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.108"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.108", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.108 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.164"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.164", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.164 timers 60 180", "clear ip bgp 192.0.2.164"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.24 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.184", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.184 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.187 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.45"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.45 timers 30 90", "clear ip bgp 192.0.2.45"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.146"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.146", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.146 timers 30 90", "clear ip bgp 192.0.2.146"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.163"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.163", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.163 timers 60 180", "clear ip bgp 192.0.2.163"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.138 timers 30 90", "clear ip bgp 192.0.2.138"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.139"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.139 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.160"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.160 timers 60 180", "clear ip bgp 192.0.2.160"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.219"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.219", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.219 timers 30 180", "clear ip bgp 192.0.2.219"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.7"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.152"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.152", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.152 timers 30 180", "clear ip bgp 192.0.2.152"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.30"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.30", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.30 timers 30 90", "clear ip bgp 192.0.2.30"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.122", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.122 timers 60 180", "clear ip bgp 192.0.2.122"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.64"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.64 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.187 timers 30 90", "clear ip bgp 192.0.2.187"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.233"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.233", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.233 timers 60 180", "clear ip bgp 192.0.2.233"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.94"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.94 timers 30 90", "clear ip bgp 192.0.2.94"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.55 timers 30 180", "clear ip bgp 192.0.2.55"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.234"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.234 timers 30 90", "clear ip bgp 192.0.2.234"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.3"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.3 timers 60 180", "clear ip bgp 192.0.2.3"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.244"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.244", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.244 timers 60 180", "clear ip bgp 192.0.2.244"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.14"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.14", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.14 timers 60 180", "clear ip bgp 192.0.2.14"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.15"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.15", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.15 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.204"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.204 timers 60 180", "clear ip bgp 192.0.2.204"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.103", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.103"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.244", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.244"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.74"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.74 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.209"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.209", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.209 timers 60 180", "clear ip bgp 192.0.2.209"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.216 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.102"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.102", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.102"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.190"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.252"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.252", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.252 timers 30 90", "clear ip bgp 192.0.2.252"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.47 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.240"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.240 timers 60 180", "clear ip bgp 192.0.2.240"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.63 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.152"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.152", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.152 timers 30 180", "clear ip bgp 192.0.2.152"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.210"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.210 timers 30 180", "clear ip bgp 192.0.2.210"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.216 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.172"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.172", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.172 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.47"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.47 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.124"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.124", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.124 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.12"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.12", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.12"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.221"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.221", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.221 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.163"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.163", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.163 timers 30 180", "clear ip bgp 192.0.2.163"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.216 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.36"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.36 timers 30 180", "clear ip bgp 192.0.2.36"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.250"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.250", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.250 timers 60 180", "clear ip bgp 192.0.2.250"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.196"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.196", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.196 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.157"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.157", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.157"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.65"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.65 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.31"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.31", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.31 timers 30 90", "clear ip bgp 192.0.2.31"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.50"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.50", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.50 timers 30 180", "clear ip bgp 192.0.2.50"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.20"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.20", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.20 timers 30 90", "clear ip bgp 192.0.2.20"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.237"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.237", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.237 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.219"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.219"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.165"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.165", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.165 timers 30 90", "clear ip bgp 192.0.2.165"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.102"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.102 timers 30 180", "clear ip bgp 192.0.2.102"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.100"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.100 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.181", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.181 timers 60 180", "clear ip bgp 192.0.2.181"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.253"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.253 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.101"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.101"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.124"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.124", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.124 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.181"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.181", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.181 timers 60 180", "clear ip bgp 192.0.2.181"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.125"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.125", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.125 timers 30 90", "clear ip bgp 192.0.2.125"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.221"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.221", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.221 timers 60 180", "clear ip bgp 192.0.2.221"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.200"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.200", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.200 timers 60 180", "clear ip bgp 192.0.2.200"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.35 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.12"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.12", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.12"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.148"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.148 timers 60 180", "clear ip bgp 192.0.2.148"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.110 timers 30 180", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.203"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.203 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.154 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.24", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.24 timers 30 90", "clear ip bgp 192.0.2.24"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.71"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.71", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.71 timers 30 180", "clear ip bgp 192.0.2.71"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.88", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.88 timers 60 180", "clear ip bgp 192.0.2.88"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.174"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.174", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.174 timers 60 180", "clear ip bgp 192.0.2.174"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.247"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.247 timers 30 90", "clear ip bgp 192.0.2.247"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.122 timers 60 180", "clear ip bgp 192.0.2.122"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.99"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.99"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.28"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.28", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.28"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.104 timers 60 180", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.116 timers 30 180", "clear ip bgp 192.0.2.116"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.104 timers 30 180", "clear ip bgp 192.0.2.104"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.41"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.41"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.24 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.90"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.90", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.90"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.187", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.187 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.105"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.105 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.254"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.254", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.254 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.151"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.81"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.81 timers 30 180", "clear ip bgp 192.0.2.81"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.215"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.24"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.24 timers 60 180", "clear ip bgp 192.0.2.24"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.35 timers 30 180", "clear ip bgp 192.0.2.35"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.75"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.75 timers 30 90", "clear ip bgp 192.0.2.75"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.9"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.9", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.9 timers 30 90", "clear ip bgp 192.0.2.9"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.194"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.194", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.194 timers 30 180", "clear ip bgp 192.0.2.194"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.114"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.114 timers 30 90", "clear ip bgp 192.0.2.114"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.230"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.230", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.230 timers 30 90", "clear ip bgp 192.0.2.230"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.206"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.206", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.206 timers 30 90", "clear ip bgp 192.0.2.206"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.199", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.199 timers 60 180", "clear ip bgp 192.0.2.199"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.230"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.230", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.230 timers 30 180", "clear ip bgp 192.0.2.230"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.143"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.143", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.143 timers 60 180", "clear ip bgp 192.0.2.143"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.86"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.86 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.43"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.43 timers 30 180", "clear ip bgp 192.0.2.43"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.120"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.120", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.120 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.117"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.117 timers 30 180", "clear ip bgp 192.0.2.117"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.127"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.127", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.127 timers 30 90", "clear ip bgp 192.0.2.127"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.197"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.197 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.217"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.217"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.102"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.102", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.102 timers 60 180", "clear ip bgp 192.0.2.102"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.52 timers 30 90", "clear ip bgp 192.0.2.52"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.78"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.78"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.47", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.234"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.234"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.5"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.5", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.5 timers 60 180", "clear ip bgp 192.0.2.5"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.86"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.86"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.184"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.213 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.233"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.233 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.67"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.67", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.67 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.48"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.48", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.48 timers 30 180", "clear ip bgp 192.0.2.48"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.216"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.216"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.196"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.196 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.145"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.145", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.145 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.131"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.131 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.178"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.178 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.247", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.247 timers 60 180", "clear ip bgp 192.0.2.247"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.214"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.214 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.26"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.26"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.232"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.232 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.130 timers 60 180", "clear ip bgp 192.0.2.130"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.246 timers 60 180", "clear ip bgp 192.0.2.246"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.206"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.206 timers 30 90", "clear ip bgp 192.0.2.206"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.92"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.92 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.100"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.100"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.186"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.186", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.186 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.195"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.195", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.195 timers 30 180", "clear ip bgp 192.0.2.195"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.28 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.120"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.120", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.120 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.122"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.122 timers 30 90", "clear ip bgp 192.0.2.122"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.201"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.201"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.34"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.34 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.26"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.26 timers 30 90", "clear ip bgp 192.0.2.26"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.116 timers 30 90", "clear ip bgp 192.0.2.116"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.248"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.248 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.195"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.195", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.195 timers 60 180", "clear ip bgp 192.0.2.195"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.138 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.8"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.8", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.8 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.194"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.194", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.194 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.249 timers 60 180", "clear ip bgp 192.0.2.249"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.237"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.237", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.237"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.56"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.56", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.56 timers 30 90", "clear ip bgp 192.0.2.56"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.245 timers 30 180", "clear ip bgp 192.0.2.245"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.39 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.85"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.85 timers 30 90", "clear ip bgp 192.0.2.85"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.238"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.238", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.238"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.81"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.81", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.81 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.163"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.163", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.163 timers 60 180", "clear ip bgp 192.0.2.163"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.40", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.40 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.250"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.250", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.250 timers 30 180", "clear ip bgp 192.0.2.250"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.241"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.241 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.24"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.14"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.14 timers 60 180", "clear ip bgp 192.0.2.14"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.222"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.222", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.222"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.163"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.163", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.163 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.45"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.45 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.229"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.229", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.229 timers 30 180", "clear ip bgp 192.0.2.229"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.230"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.230", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.230 timers 30 90", "clear ip bgp 192.0.2.230"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.106"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.106"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.205"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.205 timers 30 180", "clear ip bgp 192.0.2.205"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.218"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.218", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.218 timers 30 90", "clear ip bgp 192.0.2.218"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.35 timers 30 90", "clear ip bgp 192.0.2.35"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.107"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.107", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.107"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.92"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.92 timers 30 180", "clear ip bgp 192.0.2.92"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.15 timers 30 180", "clear ip bgp 192.0.2.15"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.198"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.198", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.198 timers 30 90", "clear ip bgp 192.0.2.198"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.115 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.115"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.115 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.145 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.35", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.35 timers 30 90", "clear ip bgp 192.0.2.35"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.69"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.69", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.69 timers 30 180", "clear ip bgp 192.0.2.69"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.215 timers 60 180", "clear ip bgp 192.0.2.215"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.187"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.190"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.190"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.38"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.38 timers 30 90", "clear ip bgp 192.0.2.38"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.67"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.67", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.67 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.45"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.45 timers 30 90", "clear ip bgp 192.0.2.45"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.52 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.245"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.245 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.110 timers 60 180", "clear ip bgp 192.0.2.110"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.185"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.185 timers 30 180", "clear ip bgp 192.0.2.185"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.99"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.99"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.127"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.127 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.55"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.55", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.55 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.156"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.156"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.197"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.197", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.197 timers 60 180", "clear ip bgp 192.0.2.197"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.94"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.43"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.43 timers 30 90", "clear ip bgp 192.0.2.43"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.11"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.11 timers 30 90", "clear ip bgp 192.0.2.11"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.198"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.198 timers 60 180", "clear ip bgp 192.0.2.198"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.31"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.31", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.31 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.156 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.161"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.161", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.161 timers 30 90", "clear ip bgp 192.0.2.161"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.63"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.59"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.59", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.59"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.106"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.106"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.125"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.125 timers 60 180", "clear ip bgp 192.0.2.125"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.94 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.52"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.186"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.186 timers 30 90", "clear ip bgp 192.0.2.186"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.202"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.202 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.188"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.188", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.188"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.69"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.69", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.69"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.245"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.4"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.4", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.4"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.31"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.31", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.31 timers 30 90", "clear ip bgp 192.0.2.31"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.17"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.17 timers 30 180", "clear ip bgp 192.0.2.17"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.231"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.231 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.123"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.123 timers 30 90", "clear ip bgp 192.0.2.123"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.125"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.125"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.90"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.90", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.90 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.188"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.188 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.23"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.169"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.169 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.233"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.233", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.233 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.58", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.58 timers 30 90", "clear ip bgp 192.0.2.58"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.79", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.79 timers 30 90", "clear ip bgp 192.0.2.79"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.223"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.223", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.223 timers 30 180", "clear ip bgp 192.0.2.223"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.101"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.101", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.101 timers 30 90", "clear ip bgp 192.0.2.101"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.56"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.56", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.56 timers 60 180", "clear ip bgp 192.0.2.56"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.197"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.197"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.5"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.5", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.5"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.150"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.150", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.150"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.142"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.142", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.142 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.3"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.239"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.239", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.239 timers 60 180", "clear ip bgp 192.0.2.239"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.39"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.33"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.33 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.221"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.221", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.221 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.116"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.116", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.116 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.91"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.91", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.91 timers 30 180", "clear ip bgp 192.0.2.91"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.109", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.109 timers 60 180", "clear ip bgp 192.0.2.109"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.55"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.55 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.67"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.67", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.67 timers 30 90", "clear ip bgp 192.0.2.67"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.19", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.19 timers 30 90", "clear ip bgp 192.0.2.19"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.209"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.209", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.209 timers 30 180", "clear ip bgp 192.0.2.209"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.4", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.4 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.47", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.47 timers 60 180", "clear ip bgp 192.0.2.47"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.103"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.103", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.103 timers 60 180", "clear ip bgp 192.0.2.103"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.50"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.50 timers 30 90", "clear ip bgp 192.0.2.50"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.159 timers 30 90", "clear ip bgp 192.0.2.159"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.39 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.148"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.148 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.16"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.16 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.109"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.109 timers 30 90", "clear ip bgp 192.0.2.109"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.186"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.186 timers 30 180", "clear ip bgp 192.0.2.186"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.84"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.84 timers 30 180", "clear ip bgp 192.0.2.84"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.127"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.127 soft out"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.251"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.251", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.251 timers 30 90", "clear ip bgp 192.0.2.251"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.157"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.157", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.157 timers 60 180", "clear ip bgp 192.0.2.157"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.204"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.204", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.204 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.91 timers 30 180", "clear ip bgp 192.0.2.91"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.115"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.115 timers 60 180", "clear ip bgp 192.0.2.115"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.96 timers 30 180", "clear ip bgp 192.0.2.96"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.44"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.44", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.44 soft out"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.218"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.218", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.218 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.196"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.196 timers 30 90", "clear ip bgp 192.0.2.196"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.63 timers 30 90", "clear ip bgp 192.0.2.63"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.44"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.44", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.44 timers 30 180", "clear ip bgp 192.0.2.44"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.159", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.159 timers 30 180", "clear ip bgp 192.0.2.159"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.55 timers 30 90", "clear ip bgp 192.0.2.55"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.228"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.228"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.185"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.185", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.185 timers 30 90", "clear ip bgp 192.0.2.185"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.252"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.252", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.252"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.132"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.132", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.132 timers 60 180", "clear ip bgp 192.0.2.132"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.49"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.49"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.144"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.144"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.149"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.149 timers 30 90", "clear ip bgp 192.0.2.149"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.188"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.188 timers 60 180", "clear ip bgp 192.0.2.188"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.3 timers 60 180", "clear ip bgp 192.0.2.3"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.40"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.40", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.40 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.45"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.45 timers 30 90", "clear ip bgp 192.0.2.45"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.100"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.100 timers 60 180", "clear ip bgp 192.0.2.100"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.144"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.144"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.87"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.87 timers 30 90", "clear ip bgp 192.0.2.87"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.37"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.37 timers 60 180", "clear ip bgp 192.0.2.37"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.240"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.240", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.240 timers 30 90", "clear ip bgp 192.0.2.240"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.239"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.239", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.239 timers 30 90", "clear ip bgp 192.0.2.239"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.89"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.89 timers 30 90", "clear ip bgp 192.0.2.89"]}
+{"incident_type": "bgp_neighborship_reset", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp neighborship reset", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.174"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.174 soft out"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.28", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.28 timers 60 180", "clear ip bgp 192.0.2.28"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.209"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.209", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.209 timers 30 180", "clear ip bgp 192.0.2.209"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.252"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.252", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.252 timers 30 180", "clear ip bgp 192.0.2.252"]}
+{"incident_type": "bgp_session_flap", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp session flap", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.64"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.64"]}
+{"incident_type": "bgp_hold_timer_expiration", "instruction": "Analyze BGP session stability incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["NEVER set BGP timers to 10 30", "For neighborship reset, do NOT modify configuration", "For hold timer expiration, timers MUST match the peer", "Prefer minimal-impact actions"], "wazuh_alert": {"rule": "bgp hold timer expiration", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.50 timers 60 180", "clear ip bgp 192.0.2.50"]}