diff --git "a/datasets/bgp2_dataset_1200.jsonl" "b/datasets/bgp2_dataset_1200.jsonl" new file mode 100644--- /dev/null +++ "b/datasets/bgp2_dataset_1200.jsonl" @@ -0,0 +1,1000 @@ +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.211"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.5", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.211 maximum-prefix 500 75", "clear ip bgp 192.0.2.211"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.173"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.132", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.173 maximum-prefix 200 90 warning-only", "clear ip bgp 192.0.2.173 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.27"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.27", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2554, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.106", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2167, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.27 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.91", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.211 maximum-prefix 200 90 warning-only", "clear ip bgp 192.0.2.211 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.99"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.51"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.246 weight 200", "clear ip bgp 192.0.2.246 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.171"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.230", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.171 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.130"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.130 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.238"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.236"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.135"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.238 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.251"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.198"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.237"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.251 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.251 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.158"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.145", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.158 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.35 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.28"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.28", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.28 maximum-prefix 1000 75 warning-only", "clear ip bgp 192.0.2.28 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.197"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.197", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.197 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.123"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.123", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4075, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 202, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.123 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.123 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2570, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.141", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3128, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.128 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.102"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.142"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.42"}], "cli_fix": ["router bgp 65100", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.102 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.102 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.246"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.20"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.13", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.83"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.246 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1916, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.125", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2186, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.8 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.227"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.227 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.250"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.250", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.20"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.53"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.250 weight 200", "clear ip bgp 192.0.2.250 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.21"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.64"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.138"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.21 weight 200", "clear ip bgp 192.0.2.21 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.231"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.144"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.149", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.213"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.231 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.231 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.18", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.190"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.25"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.18 weight 200", "clear ip bgp 192.0.2.18 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.193"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.93"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.137"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.193 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.193 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.57"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4706, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3893, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.57 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.115"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3763, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 882, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.115 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.115 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.77"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.77", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3885, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.26", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2094, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.77 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.77 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.151"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4094, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1075, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.151 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.151 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.65"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 447, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3026, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.65 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.65 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.99"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.99", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.69"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.143"}], "cli_fix": ["router bgp 65010", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.99 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.99 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.167"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.199", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.167 maximum-prefix 2000 80", "clear ip bgp 192.0.2.167"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.19", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2914, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1493, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.19 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.19 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.202"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2930, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.122", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3018, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.202 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.202 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.70"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.70 maximum-prefix 1000 90", "clear ip bgp 192.0.2.70"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.16"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.227"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.200"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.16 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.173"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.173 maximum-prefix 200 90", "clear ip bgp 192.0.2.173"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.152"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.177"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.79 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.122", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3366, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3146, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.122 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2653, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2099, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.184 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.239"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.239", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.107", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.239 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.239 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.130 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.227"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.118"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.222"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.227 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.57"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.78"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.19", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.190"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.57 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.102"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.28"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.134", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.73"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.102 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.102 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1802, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1170, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.181 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.181 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.44"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.44", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3768, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2170, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.44 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.44 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.210"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.82", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.210 maximum-prefix 1000 80", "clear ip bgp 192.0.2.210"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.93", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.168 maximum-prefix 200 80", "clear ip bgp 192.0.2.168"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.223"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.223", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.198"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.115"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.223 weight 200", "clear ip bgp 192.0.2.223 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.73"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.178"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.199", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.15"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.73 weight 200", "clear ip bgp 192.0.2.73 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.47 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.234"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 624, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.108", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 270, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.234 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.234 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.96"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.96", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.96 maximum-prefix 1000 75", "clear ip bgp 192.0.2.96"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.182"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.182", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 76, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3378, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.182 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.182 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.92"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.240", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.5"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.85 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.85 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.128"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1025, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.194", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4758, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.128 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.149"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.149", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.69"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.109", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.17"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.149 weight 200", "clear ip bgp 192.0.2.149 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.253"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.147", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.253 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2980, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4936, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.230 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.230 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.144"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3684, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.90", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2444, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.144 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.167"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.167 maximum-prefix 200 90", "clear ip bgp 192.0.2.167"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.206"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.206", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1609, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4470, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.206 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.206 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.74"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 270, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.139", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4570, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.74 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.74 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.14"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4193, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.108", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2021, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.14 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.14 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.84"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.84", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1866, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4512, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.84 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.84 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.45"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.163"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.248"}], "cli_fix": ["router bgp 65100", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.45 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.45 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.53"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.53", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.53 maximum-prefix 200 75", "clear ip bgp 192.0.2.53"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.231"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.76", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.231 maximum-prefix 1000 90", "clear ip bgp 192.0.2.231"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.196"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.196", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.100"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.95"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.196 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.196 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.47"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.47 maximum-prefix 1000 80 warning-only", "clear ip bgp 192.0.2.47 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.64"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.116", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.64 maximum-prefix 200 80", "clear ip bgp 192.0.2.64"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.69"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.69", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.41"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.59", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.58"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.69 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.193"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 532, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.172", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4653, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.193 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.214"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4764, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3166, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.214 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.214 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1601, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 557, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.247 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.247 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.248 maximum-prefix 2000 80", "clear ip bgp 192.0.2.248"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.64"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4256, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1094, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.64 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.64 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.162"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.162 maximum-prefix 500 75", "clear ip bgp 192.0.2.162"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.92"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.92", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1875, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4139, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.92 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.92 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.30"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.30", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.58"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.27"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.30 weight 200", "clear ip bgp 192.0.2.30 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.23"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.18", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.23 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.101"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.101", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 894, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.159", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2559, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.101 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.101 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.97"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.97", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1336, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4600, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.97 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.97 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.80"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.80 maximum-prefix 1000 80 warning-only", "clear ip bgp 192.0.2.80 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.213"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.213", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.136"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.145", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.220"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.213 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.213 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.254", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.60 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3080, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.176", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3098, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.42 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.100"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.100", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.197", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.100 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.36"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4324, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4174, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.36 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.36 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.10"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.10", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.130"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.63"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.10 weight 200", "clear ip bgp 192.0.2.10 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.121"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.36", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.121 maximum-prefix 2000 90", "clear ip bgp 192.0.2.121"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.19"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.19 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.52"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.156"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.217", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.139"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.52 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.95"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 340, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3565, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.95 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.49"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3851, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.126", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4335, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.49 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.49 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.176"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.123"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.147"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.176 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.221"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.221", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.92"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.151", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.21"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 150", "neighbor 192.0.2.221 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.221 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.190 maximum-prefix 1000 80", "clear ip bgp 192.0.2.190"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.98"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.86"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.2"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.98 weight 200", "clear ip bgp 192.0.2.98 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.249"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.249"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.138 weight 200", "clear ip bgp 192.0.2.138 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.148"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.148 maximum-prefix 500 75 warning-only", "clear ip bgp 192.0.2.148 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.228"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.248"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.163"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.228 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.44"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.44", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1034, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3093, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.44 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.44 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.140"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.182"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.39"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.66"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.62 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.214"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.214", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.122"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.41", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.11"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.214 weight 200", "clear ip bgp 192.0.2.214 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.28"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.30", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.28 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.28 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.26"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.252"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.22", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.210"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.26 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.109", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.189"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.18"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.109 weight 200", "clear ip bgp 192.0.2.109 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.140"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.149"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.81"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.140 weight 200", "clear ip bgp 192.0.2.140 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.80"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.80 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.80 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.153", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.104 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.104 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.118"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4909, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.199", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4508, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.118 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.118 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.173"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.167"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.157"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.173 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.173 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.141"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.141", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.96"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.208"}], "cli_fix": ["router bgp 65001", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.141 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.141 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.176"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.176", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.232"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.70"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.176 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.55", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 181, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1901, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.55 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.22"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.88"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.111", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.100"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.22 weight 200", "clear ip bgp 192.0.2.22 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.224"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.63"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.103", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.1"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.224 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.149"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.205"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.67"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.149 weight 200", "clear ip bgp 192.0.2.149 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.65"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.65 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.163"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.163", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.221"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.172", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.245"}], "cli_fix": ["router bgp 65010", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.163 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.163 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.193"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.153", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.193 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.193 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.140"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.190"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.151 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.46", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.52 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.52 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.115"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.112"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.23"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.115 weight 200", "clear ip bgp 192.0.2.115 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.120", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4238, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 787, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.120 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.139"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.204"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.217"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.139 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.139 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.34"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.81"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.155", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.158"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.34 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.222"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.222", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.222 maximum-prefix 1000 80", "clear ip bgp 192.0.2.222"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.179"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.179", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1225, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4663, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.179 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.179 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.232", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.101"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.187", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.123"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.232 weight 200", "clear ip bgp 192.0.2.232 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4569, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.194", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2101, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.247 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.247 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.169"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.169", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.169 maximum-prefix 1000 80 warning-only", "clear ip bgp 192.0.2.169 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.142"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.142", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.122"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.124"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.142 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4896, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.66", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3892, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.115 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.151", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.204"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.184"}], "cli_fix": ["router bgp 65100", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.151 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.151 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.155"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.155", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 550, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.44", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1218, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.155 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.155 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.35 maximum-prefix 2000 80", "clear ip bgp 192.0.2.35"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.173"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 454, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.213", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 502, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.173 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.173 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.120", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.45"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.208", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.141"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.120 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.232"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.81"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.43"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.232 weight 200", "clear ip bgp 192.0.2.232 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.121"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.121 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.121 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.24", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4170, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3100, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.24 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.120"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.120 maximum-prefix 500 75", "clear ip bgp 192.0.2.120"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.111"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1863, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.157", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1953, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.111 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.9"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.9", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.5"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.103"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.9 weight 200", "clear ip bgp 192.0.2.9 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.34"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.127"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.107"}], "cli_fix": ["router bgp 65100", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.34 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.34 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1580, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.175", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4237, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.120 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.120 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.129", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4645, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.66", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 991, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.129 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.221"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.221", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.150"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.117", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.184"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.221 weight 200", "clear ip bgp 192.0.2.221 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.248"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2588, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1139, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.248 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.248 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.212"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.108", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.212 maximum-prefix 2000 80", "clear ip bgp 192.0.2.212"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 394, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.20", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2055, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.247 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.247 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 530, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.45", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 61, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.24 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.24 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.121"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.121 maximum-prefix 2000 90", "clear ip bgp 192.0.2.121"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.46"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.46", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.160"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.227", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.49"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.46 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.17"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.7"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.85"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.17 weight 200", "clear ip bgp 192.0.2.17 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.126"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.26"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.182"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.126 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.101"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.101", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1407, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.131", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2273, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.101 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.101 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.102"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.204"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.18", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.133"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.102 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.102 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.31"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.214", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.230"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.211 weight 200", "clear ip bgp 192.0.2.211 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.167"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.224"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.14"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.167 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.167 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.109"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2456, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.252", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3592, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.109 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.109 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.29"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.29 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.163"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.163", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.163 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.150"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.150", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.82", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.150 maximum-prefix 200 90", "clear ip bgp 192.0.2.150"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.80", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.48"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.66", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.114"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.80 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.45"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.156"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.216 weight 200", "clear ip bgp 192.0.2.216 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.60"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.60", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4904, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3878, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.60 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.60 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.58", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1351, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 571, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.58 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.253"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.253 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.253 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.138 maximum-prefix 500 80", "clear ip bgp 192.0.2.138"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.15"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.238", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.54"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.156 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.156 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.36"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.36", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1181, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1920, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.36 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.47"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.47", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3363, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2763, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.47 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.47 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.220"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3540, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3900, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.220 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.220 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.240"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.240", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.137", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.240 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.27"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.122"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.71", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.126"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.27 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.157"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.157", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3859, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4033, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.157 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.132", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.154 maximum-prefix 1000 80", "clear ip bgp 192.0.2.154"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.129"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.129", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.222"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.185"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.129 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.195"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.195", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.195 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.176", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.23 maximum-prefix 200 80", "clear ip bgp 192.0.2.23"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.199", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1035, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 271, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.199 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.199 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.217"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.68", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.217 maximum-prefix 200 75", "clear ip bgp 192.0.2.217"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.226"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.226", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2307, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4499, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.226 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.226 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.175"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1204, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1218, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.175 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.200"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.150", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.164"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.23 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.23 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.128"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4374, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.124", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1587, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.128 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.135"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.135", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1710, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1539, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.135 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.135 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.45"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.45", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 623, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.250", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 567, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.45 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.45 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.159"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.159", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.46", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.159 maximum-prefix 1000 80", "clear ip bgp 192.0.2.159"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.251"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2399, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2190, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.251 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.28"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.28", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.28 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.28 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.90"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.90", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.61"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.220"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.90 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.90 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.203"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.125"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.162"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.203 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.203 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.16"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.16", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.16 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.31"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.31", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.75"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.199"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.31 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.248"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.26"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.202"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.248 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.179"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.53", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.61"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.168 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.30"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.30", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.43"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.202"}], "cli_fix": ["router bgp 65010", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.30 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.30 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.44"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.44", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4827, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4033, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.44 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.44 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.71"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.71", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4108, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4467, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.71 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.71 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.15"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.163"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.88"}], "cli_fix": ["router bgp 65100", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.15 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.15 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.126"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.27", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.126 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.126 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.70"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.43"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.146", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.39"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.70 weight 200", "clear ip bgp 192.0.2.70 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.23 maximum-prefix 500 80", "clear ip bgp 192.0.2.23"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.247"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.118"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.85", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.164"}], "cli_fix": ["router bgp 65010", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.247 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.247 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.79", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.60"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.133"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.79 weight 200", "clear ip bgp 192.0.2.79 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.212"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.140"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.159"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.212 weight 200", "clear ip bgp 192.0.2.212 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.32"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.32", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.61"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.205"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.32 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.201"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.56"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.109", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.7"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 200", "neighbor 192.0.2.201 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.201 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.206"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.122"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.195", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.9"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.206 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.52"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.146"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.20 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.20 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.112"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.125"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.133"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.112 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.112 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.118"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.239"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.152", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.190"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.118 weight 200", "clear ip bgp 192.0.2.118 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.180"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.180", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3987, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.82", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 527, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.180 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.180 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.116 maximum-prefix 2000 80 warning-only", "clear ip bgp 192.0.2.116 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4584, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1101, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.216 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.121"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.121 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.87"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1318, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 521, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.87 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.87 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.241"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.48"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.78"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.241 weight 200", "clear ip bgp 192.0.2.241 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.23"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.23 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.23 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.158"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.119", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.158 maximum-prefix 200 80 warning-only", "clear ip bgp 192.0.2.158 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.79"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.240"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.34"}], "cli_fix": ["router bgp 65010", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.79 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.79 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.130"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.130", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3189, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3141, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.130 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.130 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.184 maximum-prefix 2000 80 warning-only", "clear ip bgp 192.0.2.184 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2116, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.41", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3035, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.122 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.122 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.212"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.119"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.19"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.212 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.192"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.192", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.85"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.155"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.192 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.78"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.191", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.52"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.159 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.52"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.249", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.219"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.42 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.144"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.144", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2682, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4774, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.144 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.144 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.19", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 409, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2992, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.19 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.19 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.128"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1362, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1124, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.128 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.77"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.58"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.168 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.183"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.183 maximum-prefix 2000 80", "clear ip bgp 192.0.2.183"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.41"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.41", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.41 maximum-prefix 500 90", "clear ip bgp 192.0.2.41"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.1"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4084, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.136", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4111, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.1 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.1 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.189 maximum-prefix 500 90", "clear ip bgp 192.0.2.189"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.94"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4592, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1901, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.94 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.251"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2249, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.181", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 603, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.251 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.251 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.106"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.106", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.65"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.162", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.82"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.106 weight 200", "clear ip bgp 192.0.2.106 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.139"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3505, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4580, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.139 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.139 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.67"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.67", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.67 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.127"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3211, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.12", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4133, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.127 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.127 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.15", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.45", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.15 maximum-prefix 1000 90", "clear ip bgp 192.0.2.15"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.121"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.121 maximum-prefix 1000 75 warning-only", "clear ip bgp 192.0.2.121 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.22"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.245"}], "cli_fix": ["router bgp 65010", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.115 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.115 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.249"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.249", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2905, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.82", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2221, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.249 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.249 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.21"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.21 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.21 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.190", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4439, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1024, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.190 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.16"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.145", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.16 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.16 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.175"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.175 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.174"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.174 maximum-prefix 500 75 warning-only", "clear ip bgp 192.0.2.174 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.62"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.65"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.128"}], "cli_fix": ["router bgp 65010", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.62 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.62 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.2"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 520, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1315, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.2 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.2 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.99"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.9", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.99 maximum-prefix 1000 90", "clear ip bgp 192.0.2.99"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.173"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.173 maximum-prefix 1000 75", "clear ip bgp 192.0.2.173"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.76"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.76", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.106"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.240"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 150", "neighbor 192.0.2.76 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.76 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.27"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.27", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.226", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.27 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.198"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.39"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.153", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.238"}], "cli_fix": ["router bgp 65010", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.198 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.198 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 171, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.102", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 293, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.24 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.243"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.50"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.114", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.145"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.243 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.106"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.193"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.250"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.106 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.139"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.139", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.139 maximum-prefix 1000 75 warning-only", "clear ip bgp 192.0.2.139 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1306, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3509, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.4 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.4 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.76"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.76", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.175"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.175", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.120"}], "cli_fix": ["router bgp 65010", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.76 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.76 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.164"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.164", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.100", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.164 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.164 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.141"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.141", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.175"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.248"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.141 weight 200", "clear ip bgp 192.0.2.141 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.134"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.134", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2770, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3018, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.134 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.134 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1582, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.78", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2610, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.109 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.109 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.192"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.192", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.179", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.192 maximum-prefix 500 75 warning-only", "clear ip bgp 192.0.2.192 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.8"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.8", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.239"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.52"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.8 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.87"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.8"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.159", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.55"}], "cli_fix": ["router bgp 65010", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 200", "neighbor 192.0.2.87 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.87 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.60"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1527, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.233", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 372, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.60 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.60 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.73"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.114"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.148"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.73 weight 200", "clear ip bgp 192.0.2.73 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4701, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.59", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4076, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.166 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.166 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.172"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.172", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.253"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.27", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.238"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.172 weight 200", "clear ip bgp 192.0.2.172 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.163"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.163", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.178"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.196", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.33"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.163 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.248 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.124"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.124", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3872, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.140", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4895, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.124 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.124 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.29"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.29", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.234", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.29 maximum-prefix 200 75", "clear ip bgp 192.0.2.29"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.95"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.11"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.88"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.95 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.95 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.163"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.163", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.125"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.109 weight 200", "clear ip bgp 192.0.2.109 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.102"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.102", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.36", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.102 maximum-prefix 2000 80 warning-only", "clear ip bgp 192.0.2.102 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.58"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.58", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.49"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.133", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.222"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.58 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.143"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.194"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.161 weight 200", "clear ip bgp 192.0.2.161 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.229"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.184", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.152"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.213 weight 200", "clear ip bgp 192.0.2.213 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.243"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.243", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.243 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.243 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.194"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.194", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4570, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4398, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.194 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.194 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.94"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.6"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.38"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.94 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.94 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.191"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.191", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.139"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.106", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.122"}], "cli_fix": ["router bgp 65001", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 200", "neighbor 192.0.2.191 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.191 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.205"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1985, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.162", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2340, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.205 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.205 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.114"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.80"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.70 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.31"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.31", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.164", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.31 maximum-prefix 200 75", "clear ip bgp 192.0.2.31"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.111"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.111", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1617, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 213, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.111 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.111 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.8"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.8", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4255, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.9", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1433, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.8 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.8 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.119"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.119", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.33", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.119 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.25"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.25", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.25 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.116", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2694, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4646, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.116 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.116 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.219"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.219", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.219 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.86"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.27"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.251"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.86 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.29"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.29", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 773, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.33", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3268, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.29 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.29 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3316, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.195", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 482, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.116 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.116 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.70 maximum-prefix 200 80", "clear ip bgp 192.0.2.70"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.32"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.13", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.32 maximum-prefix 500 75 warning-only", "clear ip bgp 192.0.2.32 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.233", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.21 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.21 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.197", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.197 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.1"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.1 maximum-prefix 500 80", "clear ip bgp 192.0.2.1"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.240"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.240", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4620, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2304, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.240 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.127"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.98"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.192"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.127 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.230", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1650, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.143", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3120, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.230 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.30"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.30", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.4"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.69"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.30 weight 200", "clear ip bgp 192.0.2.30 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.77"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.77", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.77 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.8"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.8", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.44"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.69", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.200"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.8 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.214"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.214 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.214 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.41"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3081, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2597, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.41 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 964, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.249", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3913, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.20 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.20 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.114"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.114 maximum-prefix 2000 80 warning-only", "clear ip bgp 192.0.2.114 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.50"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.50", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.115"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.73", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.194"}], "cli_fix": ["router bgp 65100", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 150", "neighbor 192.0.2.50 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.50 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.232"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.232", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3102, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.150", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1155, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.232 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.232 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4477, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.172", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3994, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.248 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.154 maximum-prefix 500 75 warning-only", "clear ip bgp 192.0.2.154 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.125"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.204"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.242", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.154"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.125 weight 200", "clear ip bgp 192.0.2.125 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.14"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.64"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.86"}], "cli_fix": ["router bgp 65100", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.14 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.14 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.178"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2896, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.56", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2804, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.178 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.178 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.141"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.141", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.160", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.141 maximum-prefix 1000 75", "clear ip bgp 192.0.2.141"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.183"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3009, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4988, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.183 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.183 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.189 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.91", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.91 maximum-prefix 2000 90", "clear ip bgp 192.0.2.91"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.2"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.2", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.132"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.252", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.134"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.2 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.176", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.87 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.171"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.171", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.134"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.127", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.41"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.171 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.171 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.81"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.81 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.20", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.238"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.207", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.160"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.20 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.222"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.222", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3232, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.166", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2230, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.222 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.222 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.115"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.115 maximum-prefix 2000 90", "clear ip bgp 192.0.2.115"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.235"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.235 maximum-prefix 2000 90 warning-only", "clear ip bgp 192.0.2.235 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.191"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.191", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 719, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.139", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3952, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.191 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.46"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3240, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4722, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.46 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.46 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.196"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.196 maximum-prefix 500 80", "clear ip bgp 192.0.2.196"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.88", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.102"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.207"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.88 weight 200", "clear ip bgp 192.0.2.88 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.201"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1541, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2170, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.201 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.198"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.226"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.222"}], "cli_fix": ["router bgp 65010", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.198 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.198 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.115"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.115 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.191"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.13"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.159"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.191 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.191 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.1", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.75 maximum-prefix 1000 90", "clear ip bgp 192.0.2.75"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.19"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.19 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.19 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.185", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.185 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.144"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.144 maximum-prefix 1000 90 warning-only", "clear ip bgp 192.0.2.144 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.137"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.137", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.98"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.218"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.137 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.223"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.223", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.30", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.223 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.205"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.205", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.205 maximum-prefix 500 75 warning-only", "clear ip bgp 192.0.2.205 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.23"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.23", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.133"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.234"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.23 weight 200", "clear ip bgp 192.0.2.23 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.223"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.223", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.56"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.80"}], "cli_fix": ["router bgp 65010", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.223 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.223 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.7 maximum-prefix 500 75 warning-only", "clear ip bgp 192.0.2.7 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.184 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.40", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2119, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.157", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4671, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.40 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.132"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.132", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.132 maximum-prefix 2000 90 warning-only", "clear ip bgp 192.0.2.132 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.100"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.100", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.89"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.10", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.145"}], "cli_fix": ["router bgp 65100", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 150", "neighbor 192.0.2.100 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.100 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.180"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.180", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.99"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.137", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.80"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.180 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.183"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.21"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.79"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.183 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.183 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.97"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.97", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.139"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.249"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.97 weight 200", "clear ip bgp 192.0.2.97 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.227"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.227", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.130", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.227 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.206"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.206", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 102, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4794, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.206 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.206 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.156"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.156 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.199"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.199", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3009, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4076, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.199 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.199 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.58 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.58 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.212"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.164"}], "cli_fix": ["router bgp 65010", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.62 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.62 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.33"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1330, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4515, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.33 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.49"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.234"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.188", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.178"}], "cli_fix": ["router bgp 65010", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.49 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.49 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4692, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.152", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2443, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.62 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.62 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.50"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.254"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.125"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.50 weight 200", "clear ip bgp 192.0.2.50 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.149"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.138"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.35 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.35 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.179"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.179", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.81", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.179 maximum-prefix 500 80", "clear ip bgp 192.0.2.179"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.235"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.34", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.235 maximum-prefix 200 80", "clear ip bgp 192.0.2.235"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.112"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 689, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2718, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.112 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.112 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.202"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2190, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.123", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2035, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.202 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.13"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.13", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.13 maximum-prefix 1000 90 warning-only", "clear ip bgp 192.0.2.13 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.189 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.182"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.12", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.109"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.94 weight 200", "clear ip bgp 192.0.2.94 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.134"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 413, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4995, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.134 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.134 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.51"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1186, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2923, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.51 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.51 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.223"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.223 maximum-prefix 200 80", "clear ip bgp 192.0.2.223"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.125"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.78"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.32", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.131"}], "cli_fix": ["router bgp 65010", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.125 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.125 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.243"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.243 maximum-prefix 2000 90", "clear ip bgp 192.0.2.243"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.5"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.5", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.5 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.27"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2403, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.143", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3877, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.27 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.27 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.249"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.249", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.249 maximum-prefix 2000 90 warning-only", "clear ip bgp 192.0.2.249 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.218"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.218", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.218 maximum-prefix 1000 80 warning-only", "clear ip bgp 192.0.2.218 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.210"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.62", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.210 maximum-prefix 2000 90", "clear ip bgp 192.0.2.210"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.122"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4787, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.158", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3732, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.122 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.129", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.101"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.137"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.129 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.66"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.66", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.226"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.174", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.244"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.66 weight 200", "clear ip bgp 192.0.2.66 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.201"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.26"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.101", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.233"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.201 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.137"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.137", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.39"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.93", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.29"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.137 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.137 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2728, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3845, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.21 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.103"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.103", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.103 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.103 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.173"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.96"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.249"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.173 weight 200", "clear ip bgp 192.0.2.173 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.93"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.93 maximum-prefix 200 80 warning-only", "clear ip bgp 192.0.2.93 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.72"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.72", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.72 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.72 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.189 maximum-prefix 1000 80", "clear ip bgp 192.0.2.189"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.158", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.35 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.38"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1130, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1770, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.38 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.198", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.21 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.188"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.188", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4871, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.209", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 624, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.188 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.63"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1573, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.19", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1402, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.63 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.63 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.139"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.139", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.135", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.139 maximum-prefix 1000 90", "clear ip bgp 192.0.2.139"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.81"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.14"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.228 weight 200", "clear ip bgp 192.0.2.228 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.151", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.107"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.222"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.151 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.246"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.95"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.193"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.246 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.165"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.165", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.246"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.41", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.104"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.165 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.36"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.31", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.36 maximum-prefix 2000 75", "clear ip bgp 192.0.2.36"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.169"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.169", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3599, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2503, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.169 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.169 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.33"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.168"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.8 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.53"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.53 maximum-prefix 500 75", "clear ip bgp 192.0.2.53"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.251 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 311, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.36", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 805, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.231 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1049, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4593, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.151 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.151 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.151"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.9", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.206"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.115 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.54"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.74"}], "cli_fix": ["router bgp 65010", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.63 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.63 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.189"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.238"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.176", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.155"}], "cli_fix": ["router bgp 65001", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.189 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.189 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.78"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3731, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.238", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2553, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.78 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.78 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.86"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.86", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.34"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.148"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.86 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.144"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2787, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.148", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4225, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.144 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.144 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.225"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.225", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.58"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.132", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.159"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.225 weight 200", "clear ip bgp 192.0.2.225 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.167"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.21"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.63"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.167 weight 200", "clear ip bgp 192.0.2.167 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.131"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 132, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4517, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.131 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.131 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.29"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3540, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2862, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.29 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.29 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.133"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.133", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.133 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.168"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1210, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2600, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.168 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.168 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.50"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.154"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.21 weight 200", "clear ip bgp 192.0.2.21 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.25"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.25", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.1"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.137"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.25 weight 200", "clear ip bgp 192.0.2.25 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.153"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.153", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.73"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.57"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 200", "neighbor 192.0.2.153 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.153 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.16"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4609, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.206", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 695, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.16 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.196"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.189"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.203"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.196 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.178 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.88"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.30"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.82", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.74"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.88 weight 200", "clear ip bgp 192.0.2.88 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 593, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2876, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.88 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.225"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.225", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.122"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.119", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.42"}], "cli_fix": ["router bgp 65100", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 150", "neighbor 192.0.2.225 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.225 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.25"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.25", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.25 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.25 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.157"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.157", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.131"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.27"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.157 weight 200", "clear ip bgp 192.0.2.157 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.61"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.61", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.56", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.61 maximum-prefix 1000 80", "clear ip bgp 192.0.2.61"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.95"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.95 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.76"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4648, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1216, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.76 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.76 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3364, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.195", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1368, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.28 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.28 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.25"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.25", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.170"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.126"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.25 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.85"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.85 maximum-prefix 2000 80 warning-only", "clear ip bgp 192.0.2.85 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.74"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.67", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.106"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 150", "neighbor 192.0.2.216 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.216 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.34"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.34", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1122, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2995, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.34 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.34 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.210"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2763, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.60", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2408, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.210 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.10"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.198"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.164"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.10 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.10 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.214"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.214", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.214 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.214 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.236"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1511, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2468, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.236 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.198"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.198", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.27"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.240"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.198 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.198 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.16"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.16 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.15", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.111"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.177", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.249"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.15 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.173"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1338, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.141", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4017, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.173 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.173 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.183"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.183 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.30"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.30", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.185"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.92"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.30 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.140"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.29"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.99", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.119"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.140 weight 200", "clear ip bgp 192.0.2.140 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.240"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.240", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.58"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.58"}], "cli_fix": ["router bgp 65100", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.240 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.240 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.237"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1668, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.250", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4647, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.237 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.237 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.178"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1565, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1242, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.178 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.178 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.142"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.142", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3300, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4310, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.142 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.142 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.133"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.189"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.238", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.1"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.133 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.34"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 857, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.132", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4709, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.34 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.34 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.113"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.74", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.113 maximum-prefix 1000 90 warning-only", "clear ip bgp 192.0.2.113 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.103", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.92"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.99"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.103 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.98"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.98 maximum-prefix 200 75", "clear ip bgp 192.0.2.98"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.196", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.122 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.6"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.6", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.246"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.67"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.6 weight 200", "clear ip bgp 192.0.2.6 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.84"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.84 maximum-prefix 200 90", "clear ip bgp 192.0.2.84"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.32"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.32", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4266, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.240", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3153, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.32 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.32 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.86"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.86", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.215"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.67"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.86 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.86 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.180"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.180", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4576, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.194", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4481, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.180 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.180 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.146"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.155"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.214", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.231"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.146 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.146 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.174"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.174 maximum-prefix 200 90", "clear ip bgp 192.0.2.174"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.245"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.245", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.6", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.245 maximum-prefix 200 90", "clear ip bgp 192.0.2.245"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.199", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.199 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.6"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.6", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.23", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.6 maximum-prefix 1000 75", "clear ip bgp 192.0.2.6"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.15"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.15", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.109", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.15 maximum-prefix 500 75", "clear ip bgp 192.0.2.15"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.29"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.179"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.85"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.29 weight 200", "clear ip bgp 192.0.2.29 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.130"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.5"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.178 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.189"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.189 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.117", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.213 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.149"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 973, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.48", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3091, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.149 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.49"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4682, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4593, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.49 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.49 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.13"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.13 maximum-prefix 2000 90 warning-only", "clear ip bgp 192.0.2.13 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.79"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.79 maximum-prefix 1000 75 warning-only", "clear ip bgp 192.0.2.79 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.3"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2250, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1945, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.3 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.83"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.83 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.83 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.177"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.177", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3784, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3929, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.177 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.177 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.75", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3498, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.200", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4105, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.75 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.75 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.235"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.120"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.95", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.97"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.235 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.134"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.134", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2161, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.226", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2657, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.134 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.134 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.234"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.234", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1707, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.101", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1509, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.234 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.174"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.38"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.50"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.174 weight 200", "clear ip bgp 192.0.2.174 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.118"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.44", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.118 maximum-prefix 500 75", "clear ip bgp 192.0.2.118"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.222"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.222", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.222 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.13"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.128"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.178 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.242"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.242", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.164"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.187"}], "cli_fix": ["router bgp 65010", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.242 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.242 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.69"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.69", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.95", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.69 maximum-prefix 1000 75", "clear ip bgp 192.0.2.69"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.124"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.124", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4893, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4598, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.124 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.124 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.71"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.112"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.24 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.231", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.234", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.231 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.175"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.175", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 565, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.28", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2117, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.175 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.175 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.164"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.164", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.86"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.42"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.164 weight 200", "clear ip bgp 192.0.2.164 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.110"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1219, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4766, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.110 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.110 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.253"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.117", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.253 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.222"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.222 maximum-prefix 500 90", "clear ip bgp 192.0.2.222"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.240"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.240", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.165"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.179", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.98"}], "cli_fix": ["router bgp 65001", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.240 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.240 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4918, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.117", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3197, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.35 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.35 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.183"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.183", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.110"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.71", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.97"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.183 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.57"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.170", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.80"}], "cli_fix": ["router bgp 65100", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.63 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.63 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.115 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.52"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.52 maximum-prefix 200 80 warning-only", "clear ip bgp 192.0.2.52 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.135"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.135", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.121"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.237", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.106"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.135 weight 200", "clear ip bgp 192.0.2.135 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.239"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.239", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4014, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1510, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.239 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.239 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.38"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.198", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.38 maximum-prefix 500 75", "clear ip bgp 192.0.2.38"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.247", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.81"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.233", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.186"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 150", "neighbor 192.0.2.247 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.247 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.235"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.174"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.95", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.114"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.235 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.235 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.97"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.60"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.40"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.97 weight 200", "clear ip bgp 192.0.2.97 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.10"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 667, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.160", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1991, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.10 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.10 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.46"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.101", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.46 maximum-prefix 500 90", "clear ip bgp 192.0.2.46"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.152", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.113 maximum-prefix 1000 75", "clear ip bgp 192.0.2.113"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.170"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.170", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3974, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1114, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.170 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3680, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3464, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.178 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.178 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.62"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.62", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.226"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.25", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.7"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.62 weight 200", "clear ip bgp 192.0.2.62 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.161"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2496, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4901, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.161 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.161 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.23"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.93"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.241 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.129"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.129 maximum-prefix 2000 75", "clear ip bgp 192.0.2.129"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 283, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3636, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.91 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.91 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.82", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.247 maximum-prefix 200 75", "clear ip bgp 192.0.2.247"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.81"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.81 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4368, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2764, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.181 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.254"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.138"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.229", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.249"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.254 weight 200", "clear ip bgp 192.0.2.254 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 260, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.5", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1806, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.187 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 726, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2327, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.24 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.24 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.100"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.244", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.100 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.110 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.218"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.129"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.252", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.206"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.218 weight 200", "clear ip bgp 192.0.2.218 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.142"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.142 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.148"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.148", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.14"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.157", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.84"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.148 weight 200", "clear ip bgp 192.0.2.148 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.74"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.74 maximum-prefix 200 80", "clear ip bgp 192.0.2.74"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.170", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2787, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 190, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.170 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.41"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.158", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.41 maximum-prefix 2000 90 warning-only", "clear ip bgp 192.0.2.41 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.50", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.75", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.50 maximum-prefix 200 80", "clear ip bgp 192.0.2.50"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.232"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.144"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.70"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.232 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.227"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.40", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.227 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.1"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.1 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.27"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.171"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.254", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.185"}], "cli_fix": ["router bgp 65100", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.27 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.27 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.99"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.99", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.249"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.240", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.1"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.99 weight 200", "clear ip bgp 192.0.2.99 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.236"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.151"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.80"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.236 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.46"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.46", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.46 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.46 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.26"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.160"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.91", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.56"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.26 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3414, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.199", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1758, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.118 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.118 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.228"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.195"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.236"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.228 weight 200", "clear ip bgp 192.0.2.228 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.237"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 685, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.132", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4902, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.237 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.237 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.42"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2870, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 624, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.42 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.128"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.46"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.100", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.210"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.128 weight 200", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.228", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.228 maximum-prefix 1000 75", "clear ip bgp 192.0.2.228"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.22"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.58"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.105", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.91"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.22 weight 200", "clear ip bgp 192.0.2.22 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.185"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.41", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.185 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.191"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.237"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.94"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 200", "neighbor 192.0.2.191 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.191 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.75"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1919, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3910, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.75 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1895, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3695, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.248 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.248 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.127"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.127", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.197"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.89"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.127 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.22"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.180"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.72", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.40"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.22 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.22 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.211", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.89"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.220"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.211 weight 200", "clear ip bgp 192.0.2.211 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.217"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.217", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.8"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.113"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.217 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.217 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.203"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1637, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.169", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4468, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.203 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.207"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.187"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.212"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.207 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.141"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.141", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.135", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.141 maximum-prefix 2000 80 warning-only", "clear ip bgp 192.0.2.141 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.57"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.57", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.241"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.40"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.57 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.11"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.11", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.9"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.244"}], "cli_fix": ["router bgp 65001", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.11 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.11 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.217"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.238"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.225", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.142"}], "cli_fix": ["router bgp 65010", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.217 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.217 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4587, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2935, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.79 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.208"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.208", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.244", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.208 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.169"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.3"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.115 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.108 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.108 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.156"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 752, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2777, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.156 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.221"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.221", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.146"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.43", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.71"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.221 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.58"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.58", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.173", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.58 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.140"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.224"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.75"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.140 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.140 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.45"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2408, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.229", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4298, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.45 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.191"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.191", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1773, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.111", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4826, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.191 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.191 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.254"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2985, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4011, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.254 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.166"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.166", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1592, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4860, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.166 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.166 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.52"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.205"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.32", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.244"}], "cli_fix": ["router bgp 65001", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.52 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.52 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.91", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.151"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.241"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.91 weight 200", "clear ip bgp 192.0.2.91 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.196"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.168"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.239", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.180"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.196 weight 200", "clear ip bgp 192.0.2.196 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.252"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.252", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 836, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1931, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.252 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.74"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.74", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.29"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.80"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.74 weight 200", "clear ip bgp 192.0.2.74 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.235"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.235 maximum-prefix 1000 80 warning-only", "clear ip bgp 192.0.2.235 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.37"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4122, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.9", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 740, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.37 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.134"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 146, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.123", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2826, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.134 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.134 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.128"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.128", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2388, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.211", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 267, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.128 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.249", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2416, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.158", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2376, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.249 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.249 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.237"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.237", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.210"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.179", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.53"}], "cli_fix": ["router bgp 65001", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.237 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.237 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.171"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.66", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.171 maximum-prefix 500 90", "clear ip bgp 192.0.2.171"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.159"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.200", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.159 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.45"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.45", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.5", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.45 maximum-prefix 2000 80", "clear ip bgp 192.0.2.45"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.250", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.248 maximum-prefix 1000 75 warning-only", "clear ip bgp 192.0.2.248 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.185"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.252"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.83"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.185 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.185 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.51", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.213 maximum-prefix 200 90", "clear ip bgp 192.0.2.213"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.10"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4851, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.34", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3486, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.10 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.10 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.213"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.213", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.11"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.44"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.213 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.213 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.133"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.46", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.133 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.88"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.88", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.170"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.23"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.88 weight 200", "clear ip bgp 192.0.2.88 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.159"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.159", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4940, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4078, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.159 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.76"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4236, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 611, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.76 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.76 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.155"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.155 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.155 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.95"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.246"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.247 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.196"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.196 maximum-prefix 1000 75 warning-only", "clear ip bgp 192.0.2.196 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.101"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2033, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.229", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4569, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.101 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.143"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.143", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.237"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.90"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.143 weight 200", "clear ip bgp 192.0.2.143 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.200"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.200", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.200 maximum-prefix 200 75", "clear ip bgp 192.0.2.200"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.4"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.4", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.4 maximum-prefix 1000 90", "clear ip bgp 192.0.2.4"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.92"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.92 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.194"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.194", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.163"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.192"}], "cli_fix": ["router bgp 65001", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 150", "neighbor 192.0.2.194 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.194 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.153"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.153", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.153 maximum-prefix 2000 75", "clear ip bgp 192.0.2.153"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.23"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 847, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 685, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.23 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.23 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.232"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.232 maximum-prefix 1000 90 warning-only", "clear ip bgp 192.0.2.232 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.96 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.122"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.215"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.10"}], "cli_fix": ["router bgp 65100", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.122 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.122 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.89"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 754, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2068, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.89 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.182"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.182", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.182 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.182 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.2"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.2", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 853, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.149", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2993, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.2 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.16"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.16 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.131"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.36"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.228"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.131 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.131 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.146"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2979, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.32", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3493, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.146 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.172"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.172", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4831, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.222", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 58, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.172 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.172 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.128", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4611, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.135", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1999, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.128 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.60", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3936, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.48", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1500, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.60 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.60 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4768, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1113, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.115 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.144"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.15", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.144 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.85"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2399, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4147, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.85 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.200", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.197 maximum-prefix 500 90", "clear ip bgp 192.0.2.197"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.54"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.54", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.137", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.54 maximum-prefix 2000 90 warning-only", "clear ip bgp 192.0.2.54 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.77"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.75"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.90"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.77 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.48"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.163"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.158", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.208"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.48 weight 200", "clear ip bgp 192.0.2.48 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.145", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.145 maximum-prefix 200 80 warning-only", "clear ip bgp 192.0.2.145 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.56"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.56", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.208", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.56 maximum-prefix 1000 90", "clear ip bgp 192.0.2.56"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.95"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.95", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.226"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.7", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.201"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.95 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.38"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 942, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.207", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3000, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.38 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.161", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.161 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.30"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2471, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.191", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3221, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.30 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.30 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.33"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.33 maximum-prefix 2000 90 warning-only", "clear ip bgp 192.0.2.33 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3280, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2433, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.245 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.245 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.141"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.141", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3520, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.148", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3240, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.141 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.141 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.211"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.252"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.136", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.59"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.211 weight 200", "clear ip bgp 192.0.2.211 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.128"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1757, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1524, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.128 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.173"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.158"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.191"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.173 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.78"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.78", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.223", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.78 maximum-prefix 2000 80", "clear ip bgp 192.0.2.78"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.86"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.185"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.140 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.140 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.57"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.57", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2897, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.94", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3697, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.57 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.57 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.13"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2559, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1336, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.13 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.13 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.160"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.160", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.144"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.133"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.160 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.160 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.235"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.137", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.235 maximum-prefix 2000 90", "clear ip bgp 192.0.2.235"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.1"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 853, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 276, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.1 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.43"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.164"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.206", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.9"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.43 weight 200", "clear ip bgp 192.0.2.43 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.69"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.69", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1845, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3490, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.69 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.18"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.18", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4256, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.136", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2909, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.18 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.245"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.245", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.239", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.245 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.91"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.91", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4384, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3955, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.91 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.91 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.239"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.239", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.159"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.25"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.239 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.106"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1440, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2920, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.106 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.106 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.98"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.205"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.209", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.55"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.98 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.98 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.84"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.99"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.75"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.84 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.84 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.97"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.97", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4173, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.138", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4197, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.97 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.97 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.132"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.132", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.13", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.132 maximum-prefix 1000 75 warning-only", "clear ip bgp 192.0.2.132 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.132"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.132", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.248"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.153", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.221"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.132 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.180"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.180", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 953, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.227", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 964, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.180 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.180 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.48"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.239", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.48 maximum-prefix 1000 75 warning-only", "clear ip bgp 192.0.2.48 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.100"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.170", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.100 maximum-prefix 200 90", "clear ip bgp 192.0.2.100"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.217"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1823, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.56", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2521, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.217 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.217 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.121"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.121", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.73"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.189"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.121 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.121 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.21"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2604, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4108, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.21 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.21 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.11"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.11", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.11 maximum-prefix 500 90", "clear ip bgp 192.0.2.11"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.159 maximum-prefix 1000 80 warning-only", "clear ip bgp 192.0.2.159 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.229"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.229", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4243, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.252", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4387, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.229 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.69"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.69", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.234", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.69 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.58"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.224"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.113", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.222"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.58 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.141"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.141", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4900, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.69", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 969, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.141 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.152"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.152", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.193", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.152 maximum-prefix 200 80 warning-only", "clear ip bgp 192.0.2.152 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.130"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1058, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.75", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2976, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.130 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.130 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.227"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.238"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.225", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.183"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.227 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.120"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.22"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.10"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.120 weight 200", "clear ip bgp 192.0.2.120 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.87 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2723, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.183", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2949, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.94 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.94 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.194"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.194", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.182", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.194 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.131"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.131", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.148", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.131 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.81"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 554, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1951, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.81 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.40", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.124"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.197", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.143"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.40 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.40 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.217"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.217", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.217 maximum-prefix 2000 80 warning-only", "clear ip bgp 192.0.2.217 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.1"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.1", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.177"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.244", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.102"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.1 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.34"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.122"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.197"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.34 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.144"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.29"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.79"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.144 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.38"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.254", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.38 maximum-prefix 200 90 warning-only", "clear ip bgp 192.0.2.38 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.161"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3020, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3856, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.161 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.161 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.233"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.57", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.160"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.110 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.110 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.55"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2945, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3754, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.55 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.55 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.39"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2439, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.200", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1582, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.39 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.39 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.156"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3506, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.82", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 330, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.156 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.156 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.135"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.135", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.31", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.135 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.126"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.209", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.126 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.13"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.13", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.13 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.13 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.164"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.164", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.164 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.44"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.44", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 986, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.5", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2245, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.44 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.44 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.202"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.51", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.202 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.121"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2385, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.182", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 730, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.121 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.121 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.39"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.39 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.39 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.105"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.9", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.105 maximum-prefix 200 80", "clear ip bgp 192.0.2.105"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.127"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.88"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.9"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.127 weight 200", "clear ip bgp 192.0.2.127 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.39", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.216"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.250"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.39 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.39 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.180"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.180", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.71", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.180 maximum-prefix 200 80", "clear ip bgp 192.0.2.180"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.96"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.149"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.182"}], "cli_fix": ["router bgp 65001", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.96 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.96 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.243"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1444, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1423, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.243 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.243 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.110 maximum-prefix 2000 90", "clear ip bgp 192.0.2.110"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.34"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.239"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.235"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.34 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.34 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.235"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.235", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 408, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2764, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.235 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.235 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.235"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.235 maximum-prefix 500 80", "clear ip bgp 192.0.2.235"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.89"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2639, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.165", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 927, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.89 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.89 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.27"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.27", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.98"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.252", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.250"}], "cli_fix": ["router bgp 65001", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 200", "neighbor 192.0.2.27 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.27 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.248"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.248 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.177"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.177", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 827, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1116, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.177 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.177 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.157"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.157", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.160"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.194"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.157 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.134", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.20 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.20 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.86"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.86", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2661, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1634, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.86 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.86 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.70"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2307, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.111", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3081, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.70 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.13", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.65 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.180"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.180", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.54"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.253", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.116"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.180 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.250"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.250", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.250 maximum-prefix 1000 80", "clear ip bgp 192.0.2.250"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.26"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.88", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.26 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.197"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.182"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.46", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.64"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.197 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.197 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.115"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.16", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.115 maximum-prefix 200 75", "clear ip bgp 192.0.2.115"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.9", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1550, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.77", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3927, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.9 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.130"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.130", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4427, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3266, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.130 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.130 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.175"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.107", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.175 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.218"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.69", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.218 maximum-prefix 1000 80 warning-only", "clear ip bgp 192.0.2.218 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.40"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.40", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.229"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.239", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.253"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.40 weight 200", "clear ip bgp 192.0.2.40 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.247", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.247 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.108", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.108 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.57"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.57", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.80"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.167"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.57 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.155"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.162"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.39"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.155 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.155 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.46"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.46", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.38"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.149", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.181"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.46 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.84"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.30", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.84 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.167"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 244, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4555, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.167 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.167 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.215 maximum-prefix 500 90", "clear ip bgp 192.0.2.215"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.25"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.25 maximum-prefix 2000 80 warning-only", "clear ip bgp 192.0.2.25 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.3"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.3", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2359, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.230", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2795, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.3 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.3 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.185"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.169"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.130 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.200"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.200", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.15", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.200 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.20"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.20", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.20 maximum-prefix 500 90", "clear ip bgp 192.0.2.20"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.30"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.30", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.204"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.104"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.30 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.100"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.236"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.148"}], "cli_fix": ["router bgp 65010", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.100 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.100 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.121"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.121", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 417, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.195", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4400, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.121 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.225"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.225", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4739, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4437, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.225 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.225 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.48"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.33"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.192", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.65"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.48 weight 200", "clear ip bgp 192.0.2.48 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.72"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.72", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 559, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1843, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.72 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.118"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.118 maximum-prefix 500 90", "clear ip bgp 192.0.2.118"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.1"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.1", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.108"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.187"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.1 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.200"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.200", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3300, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.121", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2511, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.200 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.200 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.143"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.143", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.99"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.164"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.143 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.24", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.157"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.46", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.224"}], "cli_fix": ["router bgp 65100", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.24 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.24 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.220"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2034, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1093, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.220 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.70"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.70 maximum-prefix 500 75", "clear ip bgp 192.0.2.70"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.155"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.44", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.155 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.59", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4091, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.159", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2027, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.59 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.114"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.155"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.81", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.252"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.114 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.170"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.52"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.254"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.170 weight 200", "clear ip bgp 192.0.2.170 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.13"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.13", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1246, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3938, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.13 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.13 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.35 maximum-prefix 1000 80", "clear ip bgp 192.0.2.35"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.136"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.136", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.202"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.196"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.136 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.83", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.83 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.48"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1132, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 665, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.48 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.48 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.171"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3211, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 976, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.171 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.171 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.251"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2602, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3503, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.251 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.251 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.45"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.45 maximum-prefix 200 80 warning-only", "clear ip bgp 192.0.2.45 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.172"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.172", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.172 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.172 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.247", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.247 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.56"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.56", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4385, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2114, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.56 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.204"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.204", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.176"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.176", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.222"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.204 weight 200", "clear ip bgp 192.0.2.204 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.66"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.66", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 912, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1056, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.66 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.66 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.108 maximum-prefix 2000 90", "clear ip bgp 192.0.2.108"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 709, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 842, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.96 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.214"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.182"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.238", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.104"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.214 weight 200", "clear ip bgp 192.0.2.214 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.9", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4932, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.164", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2468, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.9 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.9", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.84"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.49"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.9 weight 200", "clear ip bgp 192.0.2.9 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.246"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.48", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.87"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.89 weight 200", "clear ip bgp 192.0.2.89 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.192"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.172"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.110 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.26"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2519, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2923, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.26 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.26 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.3"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1425, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.198", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1233, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.3 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.146"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3113, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.67", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3965, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.146 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.179"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.179", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.6"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.21", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.167"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.179 weight 200", "clear ip bgp 192.0.2.179 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.95"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.95", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4643, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.164", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4649, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.95 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.95 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.127"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.127 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.127 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.241"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.37"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.120", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.76"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.241 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.113"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3125, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.12", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 934, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.113 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.113 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.228"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2836, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.77", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 695, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.228 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.228 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.108", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.217", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.108 maximum-prefix 200 75", "clear ip bgp 192.0.2.108"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.155"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.134"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.176"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.155 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.41"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4942, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.58", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2888, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.41 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.41 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.220"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.146"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.215"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.220 weight 200", "clear ip bgp 192.0.2.220 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.84"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.84", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4633, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4567, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.84 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.84 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.103", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4556, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2779, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.103 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.103 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.217", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.168 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.196"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.179", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.196 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.196 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.176"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.176", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.15"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.212"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.176 weight 200", "clear ip bgp 192.0.2.176 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.95"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.95", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.132"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.124"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 150", "neighbor 192.0.2.95 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.95 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.136"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.136", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.154"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.167"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.136 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.136 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.108"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.108", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3618, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1921, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.108 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.59", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.151 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.59", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.150"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.203"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.59 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.81", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.110 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.148"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.232", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.148 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.4"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.4", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.161"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.254", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.166"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.4 weight 200", "clear ip bgp 192.0.2.4 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2669, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 873, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.21 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.21 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3130, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3344, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.151 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.151 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.188"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.188", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.150"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.196", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.185"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.188 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.208"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.208", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.216"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.193"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.208 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.86"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.86", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2384, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3199, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.86 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.86 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.14"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.14 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.68"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.68", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3453, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3331, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.68 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.68 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.128"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.254"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.211 weight 200", "clear ip bgp 192.0.2.211 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2476, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 432, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.115 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.115 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3437, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3118, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.39 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2463, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4850, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.178 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.160"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.181", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.16"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.75 weight 200", "clear ip bgp 192.0.2.75 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.19"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.85"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.200", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.196"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.19 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.19 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.34"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.34 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.34 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.155"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.155 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.106"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.106", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.204", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.106 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.251", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.97"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.40", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.138"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.251 weight 200", "clear ip bgp 192.0.2.251 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.101"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.139"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.248 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.248 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.88"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4409, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 481, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.88 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.88 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4035, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.205", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1937, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.154 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.154 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.208"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.208", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.208 maximum-prefix 1000 80 warning-only", "clear ip bgp 192.0.2.208 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.37"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1722, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.131", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4828, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.37 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.138"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.138 maximum-prefix 1000 75", "clear ip bgp 192.0.2.138"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.167"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2479, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.2", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4390, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.167 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.167 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.61"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4865, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3985, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.61 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.61 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.207 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.210"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.98"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.59"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.210 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.82"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.82", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.234"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.209"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.82 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1520, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3479, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.35 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.252"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.143"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.48"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.252 weight 200", "clear ip bgp 192.0.2.252 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.83"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.83 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.83 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.32"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.21", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.32 maximum-prefix 200 80", "clear ip bgp 192.0.2.32"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.38"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.38", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.38 maximum-prefix 500 75", "clear ip bgp 192.0.2.38"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.36"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.36", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2127, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.107", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4741, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.36 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.36 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.165"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.165", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.165 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.165 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.128"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.111", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.128 maximum-prefix 2000 90 warning-only", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.131"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.19"}], "cli_fix": ["router bgp 65010", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 150", "neighbor 192.0.2.18 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.18 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.150"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.195"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.53"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.150 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.150 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1273, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1779, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.63 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.63 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.65"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.125"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.231", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.173"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.65 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.39"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.39", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.151"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.120", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.181"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.39 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.208"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.208", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4366, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1783, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.208 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.19", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.18 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.155"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.155 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.129", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1502, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1001, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.129 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.129 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.207"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1678, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3170, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.207 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.207 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.91"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.132", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.208"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.104 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.104 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1378, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4878, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.170 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.162"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.162", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 834, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1382, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.162 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.162 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.151"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.151", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.79"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.158", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.111"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.151 weight 200", "clear ip bgp 192.0.2.151 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.33"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.33", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.224", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.33 maximum-prefix 200 90 warning-only", "clear ip bgp 192.0.2.33 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.117"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.161"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.4 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.4 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.208"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.208", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.208 maximum-prefix 200 90 warning-only", "clear ip bgp 192.0.2.208 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.140", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.3", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.140 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.32"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.243"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.212"}], "cli_fix": ["router bgp 65001", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.32 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.32 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.128"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3728, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.136", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4478, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.128 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.91"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.91 maximum-prefix 1000 80 warning-only", "clear ip bgp 192.0.2.91 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.75"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.75", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.151"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.223"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.75 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.187", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.32", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.187 maximum-prefix 500 90", "clear ip bgp 192.0.2.187"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.77"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.57"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.124"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.77 weight 200", "clear ip bgp 192.0.2.77 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.171"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2626, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2853, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.171 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.171 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.6"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.6", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.6 maximum-prefix 500 75", "clear ip bgp 192.0.2.6"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.19"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.169"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.105 weight 200", "clear ip bgp 192.0.2.105 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.133"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.133", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.237", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.133 maximum-prefix 500 75", "clear ip bgp 192.0.2.133"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.131"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.191", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.131 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.2"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.242"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.137"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.137", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.90"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.234"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.137 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.196"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4269, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1325, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.196 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.196 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.159"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.159 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.96"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3046, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2433, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.96 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.96 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.185"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.185", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1613, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1467, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.185 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 173, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3590, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.128 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.210"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.210 maximum-prefix 1000 75", "clear ip bgp 192.0.2.210"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.131"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.131 maximum-prefix 1000 90", "clear ip bgp 192.0.2.131"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.3", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.175"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.84", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.17"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.3 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.69"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.69", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 102, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1984, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.69 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.236"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.18"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.77"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.236 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.154"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.154", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2984, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.31", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1145, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.154 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.154 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.85 maximum-prefix 2000 90 warning-only", "clear ip bgp 192.0.2.85 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.205"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.107"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.28", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.170"}], "cli_fix": ["router bgp 65001", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.205 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.205 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.89", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.230"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.210"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.89 weight 200", "clear ip bgp 192.0.2.89 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.169"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.218"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.198", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.58"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 200", "neighbor 192.0.2.169 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.169 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.156"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.175"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.142"}], "cli_fix": ["router bgp 65010", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.156 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.156 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.123"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.123", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.122"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.111"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.123 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.21"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.21 maximum-prefix 1000 75", "clear ip bgp 192.0.2.21"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.192"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.192", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.124"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.178"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.192 weight 200", "clear ip bgp 192.0.2.192 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.42"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2439, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.237", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 534, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.42 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.42 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.221"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.221", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2889, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2156, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.221 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.221 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.38"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.38", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4573, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2770, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.38 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.45"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.225"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.77", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.202"}], "cli_fix": ["router bgp 65010", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 250", "neighbor 192.0.2.45 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.45 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2673, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4973, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.104 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.104 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.84"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.84", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4792, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.111", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2677, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.84 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.84 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.235"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.235 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.235 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.242"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.111"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.197", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.26"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.242 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.232"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.36"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.8"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.232 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.145", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3792, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2788, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.145 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.96"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.96", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.64"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.147", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.214"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.96 weight 200", "clear ip bgp 192.0.2.96 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.186"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.186", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.104"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.188"}], "cli_fix": ["router bgp 65100", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 200", "neighbor 192.0.2.186 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.186 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.209"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.209", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.44"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.96"}], "cli_fix": ["router bgp 65100", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 200", "neighbor 192.0.2.209 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.209 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.61"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.100", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.61 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.61 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.62"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.62", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.202"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.68", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.228"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.62 weight 200", "clear ip bgp 192.0.2.62 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.183"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.222", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.183 maximum-prefix 1000 80", "clear ip bgp 192.0.2.183"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.221"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.197", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.101"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.187 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.187 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.75"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.86", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.75 maximum-prefix 1000 75 warning-only", "clear ip bgp 192.0.2.75 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.42 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.164"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.164", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.221", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.164 maximum-prefix 1000 90", "clear ip bgp 192.0.2.164"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.9"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.9", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3574, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 912, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.9 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.9 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.98"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.200"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.152", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.226"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.98 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.212"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 957, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.60", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4721, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.212 prefix-list PL-TRANSIT-IN in", "clear ip bgp 192.0.2.212 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.71"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.71", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1772, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 847, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.71 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.71 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.111"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.111", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1900, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1102, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.111 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.111 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.128"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.178"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.238", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.91"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.128 weight 200", "clear ip bgp 192.0.2.128 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.73"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.73", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.181", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.73 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.73 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.172"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.172", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.124"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.134", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.26"}], "cli_fix": ["router bgp 65100", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.172 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.172 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.23"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.209"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.188"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.23 weight 200", "clear ip bgp 192.0.2.23 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.137"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.137", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.27"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.123"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.137 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.90", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.166 maximum-prefix 1000 75", "clear ip bgp 192.0.2.166"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.69"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.69", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 1985, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.148", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1343, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.69 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.69 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.179"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.179", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2517, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.99", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3124, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.179 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.179 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.240"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.197", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.240 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.235"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.139"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.138"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.235 weight 200", "clear ip bgp 192.0.2.235 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.233"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.233", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.84", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.233 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.68"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.68", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.68 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.68 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.38"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.134"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.242"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.38 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.70"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.90", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.70 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.111", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.96 maximum-prefix 500 75 warning-only", "clear ip bgp 192.0.2.96 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3384, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 437, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.24 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.24 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.80"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.175", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.80 maximum-prefix 200 90", "clear ip bgp 192.0.2.80"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.49"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2032, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1741, "leak_scope": "customer_to_transit", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.49 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.49 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 319, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2127, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.178 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.178 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.178"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.105"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.118 weight 200", "clear ip bgp 192.0.2.118 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.25"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.25", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4375, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 217, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.25 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.165"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.165", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 5, "selected_next_hop": "192.0.2.5"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.76"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.165 weight 200", "clear ip bgp 192.0.2.165 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.86"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.86 maximum-prefix 500 75", "clear ip bgp 192.0.2.86"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.217"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.42"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.59", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.218"}], "cli_fix": ["router bgp 65100", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 200", "neighbor 192.0.2.217 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.217 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.102"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.48"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.88", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.242"}], "cli_fix": ["router bgp 65002", "route-map RM-PRIMARY-PATH permit 10", " set local-preference 200", "neighbor 192.0.2.102 route-map RM-PRIMARY-PATH in", "clear ip bgp 192.0.2.102 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.144"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 563, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.185", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 3680, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.144 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.143"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.143", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.219", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.143 maximum-prefix 200 80 warning-only", "clear ip bgp 192.0.2.143 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.252"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.252", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.143"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.51"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.252 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.224"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 2492, "leak_scope": "internal", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 579, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.224 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.224 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.191"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.191", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2959, "leak_scope": "internal", "as_path_pattern": "too_short", "communities_seen": "normal"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4250, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.191 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.191 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.116 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.170 maximum-prefix 500 90 warning-only", "clear ip bgp 192.0.2.170 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.230"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.230 maximum-prefix 2000 75 warning-only", "clear ip bgp 192.0.2.230 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.92"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.110"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 2, "selected_next_hop": "192.0.2.149"}], "cli_fix": ["router bgp 65001", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.92 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.92 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.64"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.64 maximum-prefix 200 80", "clear ip bgp 192.0.2.64"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.216"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.232"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.81", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 50, "as_path_len": 2, "selected_next_hop": "192.0.2.218"}], "cli_fix": ["router bgp 65002", "route-map RM-SET-LOCALPREF permit 10", " set local-preference 250", "neighbor 192.0.2.216 route-map RM-SET-LOCALPREF in", "clear ip bgp 192.0.2.216 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.199", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.199 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.59", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 287, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 896, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.59 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.59 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.47"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 1100, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.47 maximum-prefix 2000 80", "clear ip bgp 192.0.2.47"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.149"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.26", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.149 maximum-prefix 200 75 warning-only", "clear ip bgp 192.0.2.149 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.234"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 50, "as_path_len": 3, "selected_next_hop": "192.0.2.7"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.156"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.234 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.16"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.4"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.154"}], "cli_fix": ["router bgp 65001", "route-map RM-POLICY-STEER permit 10", " set local-preference 150", "neighbor 192.0.2.16 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.16 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.240"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 1100, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.72", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.240 maximum-prefix 500 80 warning-only", "clear ip bgp 192.0.2.240 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.167"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2054, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1778, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.167 prefix-list PL-IN-FILTER in", "clear ip bgp 192.0.2.167 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.60 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.43"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.184", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.43 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.229"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.229", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.97", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.229 maximum-prefix 200 90", "clear ip bgp 192.0.2.229"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.76"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.76", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.72"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.165"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.76 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.149"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 150, "med_current": 0, "as_path_len": 8, "selected_next_hop": "192.0.2.117"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 200, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.192"}], "cli_fix": ["router bgp 65010", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.149 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1140, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 4197, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.42 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.164"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.164", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.250", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.164 maximum-prefix 1000 90", "clear ip bgp 192.0.2.164"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.127"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.127", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "higher_localpref", "localpref_current": 100, "med_current": 0, "as_path_len": 3, "selected_next_hop": "192.0.2.250"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.11", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "higher_localpref", "localpref_current": 200, "med_current": 0, "as_path_len": 5, "selected_next_hop": "192.0.2.10"}], "cli_fix": ["router bgp 65002", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.127 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.141"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.141", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4821, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3134, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.141 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.141 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4653, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.196", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 183, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.245 route-map RM-TRANSIT-IN in", "clear ip bgp 192.0.2.245 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.27"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 200, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.27 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.83"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 200, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.36"}], "cli_fix": ["router bgp 65002", "route-map RM-POLICY-STEER permit 10", " set local-preference 250", "neighbor 192.0.2.55 route-map RM-POLICY-STEER in", "clear ip bgp 192.0.2.55 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.159"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.159", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.51", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 200, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.159 shutdown"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.72"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.72", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 2000, "prefixes_received": 2500, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.206", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 1000, "prefixes_received": 520, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.72 shutdown"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.65"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 2400, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "blackhole"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.76", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 1570, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.65 route-map RM-CUSTOMER-IN in", "clear ip bgp 192.0.2.65 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.241"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 3102, "leak_scope": "internal", "as_path_pattern": "contains_private_as", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4177, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "no-export missing"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.241 prefix-list PL-CUSTOMER-IN in", "clear ip bgp 192.0.2.241 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.148"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.148", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.174"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.28"}], "cli_fix": ["router bgp 65001", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.148 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.150"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 2188, "leak_scope": "customer_to_transit", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "unexpected_prefixes": 4958, "leak_scope": "peer_to_peer", "as_path_pattern": "contains_private_as", "communities_seen": "normal"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.150 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.150 soft in"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.224"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 2, "selected_next_hop": "192.0.2.121"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.56", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "lower_med", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.187"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.224 weight 200", "clear ip bgp 192.0.2.224 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.66"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.66", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.58", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.66 maximum-prefix 1000 80", "clear ip bgp 192.0.2.66"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.73"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 150, "med_current": 100, "as_path_len": 8, "selected_next_hop": "192.0.2.29"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bestpath_reason": "lower_med", "localpref_current": 100, "med_current": 50, "as_path_len": 8, "selected_next_hop": "192.0.2.83"}], "cli_fix": ["router bgp 65100", "bgp bestpath as-path multipath-relax", "clear ip bgp 192.0.2.73 soft in"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.144"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 1684, "leak_scope": "peer_to_peer", "as_path_pattern": "unexpected_origin", "communities_seen": "no-export missing"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.125", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 4917, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.144 route-map RM-IN-FILTER in", "clear ip bgp 192.0.2.144 soft in"]} +{"incident_type": "bgp_prefix_limit_exceeded", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP maximum-prefix limit exceeded", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "prefix_limit": 2000, "prefixes_received": 520, "max_prefix_action": "warning-only", "last_notification": "Cease/Maximum Number of Prefixes Reached"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.167", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "prefix_limit": 500, "prefixes_received": 210, "max_prefix_action": "teardown", "last_notification": "Cease/Maximum Number of Prefixes Reached"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.228 maximum-prefix 2000 75", "clear ip bgp 192.0.2.228"]} +{"incident_type": "bgp_route_leak_suspected", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP route leak suspected", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.109"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "unexpected_prefixes": 3410, "leak_scope": "peer_to_peer", "as_path_pattern": "too_short", "communities_seen": "blackhole"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.86", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "unexpected_prefixes": 659, "leak_scope": "customer_to_transit", "as_path_pattern": "unexpected_origin", "communities_seen": "blackhole"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.109 shutdown"]} +{"incident_type": "bgp_path_selection_incorrect", "instruction": "Analyze BGP routing policy incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset (clear ip bgp soft in/out) when changing policy", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP path selection incorrect", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "lower_as_path", "localpref_current": 100, "med_current": 100, "as_path_len": 5, "selected_next_hop": "192.0.2.5"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bestpath_reason": "ebgp_over_ibgp", "localpref_current": 100, "med_current": 100, "as_path_len": 3, "selected_next_hop": "192.0.2.187"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.241 weight 200", "clear ip bgp 192.0.2.241 soft in"]}