diff --git "a/datasets/bgp3_dataset_v2_1300.jsonl" "b/datasets/bgp3_dataset_v2_1300.jsonl"
new file mode 100644--- /dev/null
+++ "b/datasets/bgp3_dataset_v2_1300.jsonl"
@@ -0,0 +1,1300 @@
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::53"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::53", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::53 activate", " exit-address-family", "clear ip bgp 2001:db8::53 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::186"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::186", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::186 activate", " exit-address-family", "clear ip bgp 2001:db8::186 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::133"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::133", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::133 activate", " exit-address-family", "clear ip bgp 2001:db8::133 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.227"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.227", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.227 next-hop-self", "clear ip bgp 10.0.0.227 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.167"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.167", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.167 next-hop-self", "clear ip bgp 192.0.2.167 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.97"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.97", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.97 next-hop-self", "clear ip bgp 10.0.0.97 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.59", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.89"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.89", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.89 next-hop-self", "clear ip bgp 10.0.0.89 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.174"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.174", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.174 next-hop-self", "clear ip bgp 192.0.2.174 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.197"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.197", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.197 next-hop-self", "clear ip bgp 10.0.0.197 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.16"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.16", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.16 next-hop-self", "clear ip bgp 10.0.0.16 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::34"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::34", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::34 activate", " exit-address-family", "clear ip bgp 2001:db8::34 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.74"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.74", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.74 next-hop-self", "clear ip bgp 10.0.0.74 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.120", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.120 next-hop-self", "clear ip bgp 192.0.2.120 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.96 next-hop-self", "clear ip bgp 192.0.2.96 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.24"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.24", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.24 next-hop-self", "clear ip bgp 10.0.0.24 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::50"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::50", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::50 activate", " exit-address-family", "clear ip bgp 2001:db8::50 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.118"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.118", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.118 next-hop-self", "clear ip bgp 10.0.0.118 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.185", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.185 next-hop-self", "clear ip bgp 192.0.2.185 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.1"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.1", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.1 next-hop-self", "clear ip bgp 192.0.2.1 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::177"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::177", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::177 activate", " exit-address-family", "clear ip bgp 2001:db8::177 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.66"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.66", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.66 next-hop-self", "clear ip bgp 192.0.2.66 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.17"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.17", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.17 next-hop-self", "clear ip bgp 10.0.0.17 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::52"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::52", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::52 activate", " exit-address-family", "clear ip bgp 2001:db8::52 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.113"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.113 next-hop-self", "clear ip bgp 192.0.2.113 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.68"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.68", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.68 next-hop-self", "clear ip bgp 192.0.2.68 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.244", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.244 next-hop-self", "clear ip bgp 192.0.2.244 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::120"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::120", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::120 activate", " exit-address-family", "clear ip bgp 2001:db8::120 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.5"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.5", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.5 next-hop-self", "clear ip bgp 10.0.0.5 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.254"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.254", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.254 next-hop-self", "clear ip bgp 10.0.0.254 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.94", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.94 next-hop-self", "clear ip bgp 192.0.2.94 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.22"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.22", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.22 next-hop-self", "clear ip bgp 10.0.0.22 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.206"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.206", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.206 next-hop-self", "clear ip bgp 10.0.0.206 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.246", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.246 next-hop-self", "clear ip bgp 192.0.2.246 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::82"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::82", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::82 activate", " exit-address-family", "clear ip bgp 2001:db8::82 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.149"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.149", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.149 next-hop-self", "clear ip bgp 10.0.0.149 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.13"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.13", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.13 next-hop-self", "clear ip bgp 192.0.2.13 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.138", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.138 next-hop-self", "clear ip bgp 192.0.2.138 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::28", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::28 activate", " exit-address-family", "clear ip bgp 2001:db8::28 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.165"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.165", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.165 next-hop-self", "clear ip bgp 192.0.2.165 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::20"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::20", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::20 activate", " exit-address-family", "clear ip bgp 2001:db8::20 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.105 next-hop-self", "clear ip bgp 192.0.2.105 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::110"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::110", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::110 activate", " exit-address-family", "clear ip bgp 2001:db8::110 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.95"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.95", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.95 next-hop-self", "clear ip bgp 10.0.0.95 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.171"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.171", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.171 next-hop-self", "clear ip bgp 10.0.0.171 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.39"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.39", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.39 next-hop-self", "clear ip bgp 10.0.0.39 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.130"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.130", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.130 next-hop-self", "clear ip bgp 10.0.0.130 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.248"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.248", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.248 next-hop-self", "clear ip bgp 10.0.0.248 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.3"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.3", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.3 next-hop-self", "clear ip bgp 192.0.2.3 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.198"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.198", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.198 next-hop-self", "clear ip bgp 192.0.2.198 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.154"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.154", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.154 next-hop-self", "clear ip bgp 10.0.0.154 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.3"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.3 next-hop-self", "clear ip bgp 192.0.2.3 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.95"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.95", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.95 next-hop-self", "clear ip bgp 10.0.0.95 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.130"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.130", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.130 next-hop-self", "clear ip bgp 192.0.2.130 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.182"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.182", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.182 next-hop-self", "clear ip bgp 10.0.0.182 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.25", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.25 next-hop-self", "clear ip bgp 192.0.2.25 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::170"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::170", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::170 activate", " exit-address-family", "clear ip bgp 2001:db8::170 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.28"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.28", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.28 next-hop-self", "clear ip bgp 192.0.2.28 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.187", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.187 next-hop-self", "clear ip bgp 192.0.2.187 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::84"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::84", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::84 activate", " exit-address-family", "clear ip bgp 2001:db8::84 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.2"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.2", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.2 next-hop-self", "clear ip bgp 192.0.2.2 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.110 next-hop-self", "clear ip bgp 192.0.2.110 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.240"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.240", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.240 next-hop-self", "clear ip bgp 192.0.2.240 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::184", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::184 activate", " exit-address-family", "clear ip bgp 2001:db8::184 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::199"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::199", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::199 activate", " exit-address-family", "clear ip bgp 2001:db8::199 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::55", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::55 activate", " exit-address-family", "clear ip bgp 2001:db8::55 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::29"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::29", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::29 activate", " exit-address-family", "clear ip bgp 2001:db8::29 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.210"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.210", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.210 next-hop-self", "clear ip bgp 192.0.2.210 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.140"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.140 next-hop-self", "clear ip bgp 192.0.2.140 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::21"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::21", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::21 activate", " exit-address-family", "clear ip bgp 2001:db8::21 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.113"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.113 next-hop-self", "clear ip bgp 192.0.2.113 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::159"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::159", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::159 activate", " exit-address-family", "clear ip bgp 2001:db8::159 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.76"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.76", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.76 next-hop-self", "clear ip bgp 192.0.2.76 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.76"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.76", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.76 next-hop-self", "clear ip bgp 10.0.0.76 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::74"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::74", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::74 activate", " exit-address-family", "clear ip bgp 2001:db8::74 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.144"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.144", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.144 next-hop-self", "clear ip bgp 10.0.0.144 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.124"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.124", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.124 next-hop-self", "clear ip bgp 192.0.2.124 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.241"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.241", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.241 next-hop-self", "clear ip bgp 10.0.0.241 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::83"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::83", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::83 activate", " exit-address-family", "clear ip bgp 2001:db8::83 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.33"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.33", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.33 next-hop-self", "clear ip bgp 10.0.0.33 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::54"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::54", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::54 activate", " exit-address-family", "clear ip bgp 2001:db8::54 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.125"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.125 next-hop-self", "clear ip bgp 192.0.2.125 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.81"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.81", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.81 next-hop-self", "clear ip bgp 192.0.2.81 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::28", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::28 activate", " exit-address-family", "clear ip bgp 2001:db8::28 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::163"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::163", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::163 activate", " exit-address-family", "clear ip bgp 2001:db8::163 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.97"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.97", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.97 next-hop-self", "clear ip bgp 10.0.0.97 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.97"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.97", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.97 next-hop-self", "clear ip bgp 10.0.0.97 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::4"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::4", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::4 activate", " exit-address-family", "clear ip bgp 2001:db8::4 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.154"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.154", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.154 next-hop-self", "clear ip bgp 10.0.0.154 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.226"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.226", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.226 next-hop-self", "clear ip bgp 10.0.0.226 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.31"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.31", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.31 next-hop-self", "clear ip bgp 10.0.0.31 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.222"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.222", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.222 next-hop-self", "clear ip bgp 10.0.0.222 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::194"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::194", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::194 activate", " exit-address-family", "clear ip bgp 2001:db8::194 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.179"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.179", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.179 next-hop-self", "clear ip bgp 192.0.2.179 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.20"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.20", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.20 next-hop-self", "clear ip bgp 10.0.0.20 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.54"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.54", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.54 next-hop-self", "clear ip bgp 10.0.0.54 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.142"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.142 next-hop-self", "clear ip bgp 192.0.2.142 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.197 next-hop-self", "clear ip bgp 192.0.2.197 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.194"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.194", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.194 next-hop-self", "clear ip bgp 192.0.2.194 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::100"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::100", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::100 activate", " exit-address-family", "clear ip bgp 2001:db8::100 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.80"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.80", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.80 next-hop-self", "clear ip bgp 10.0.0.80 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.65"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.65 next-hop-self", "clear ip bgp 192.0.2.65 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.50"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.50", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.50 next-hop-self", "clear ip bgp 10.0.0.50 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::29"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::29", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::29 activate", " exit-address-family", "clear ip bgp 2001:db8::29 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::185"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::185", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::185 activate", " exit-address-family", "clear ip bgp 2001:db8::185 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.189"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.189", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.189 next-hop-self", "clear ip bgp 10.0.0.189 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::167"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::167", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::167 activate", " exit-address-family", "clear ip bgp 2001:db8::167 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.50", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.50 next-hop-self", "clear ip bgp 192.0.2.50 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::142"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::142", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::142 activate", " exit-address-family", "clear ip bgp 2001:db8::142 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::136"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::136", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::136 activate", " exit-address-family", "clear ip bgp 2001:db8::136 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.224"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.224", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.224 next-hop-self", "clear ip bgp 192.0.2.224 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.35"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.35", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.35 next-hop-self", "clear ip bgp 10.0.0.35 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.52", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.52 next-hop-self", "clear ip bgp 192.0.2.52 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::179"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::179", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::179 activate", " exit-address-family", "clear ip bgp 2001:db8::179 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::85", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::85 activate", " exit-address-family", "clear ip bgp 2001:db8::85 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::135"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::135", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::135 activate", " exit-address-family", "clear ip bgp 2001:db8::135 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.192"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.192", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.192 next-hop-self", "clear ip bgp 192.0.2.192 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.79"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.79", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.79 next-hop-self", "clear ip bgp 10.0.0.79 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.126"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.126", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.126 next-hop-self", "clear ip bgp 10.0.0.126 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::164"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::164", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::164 activate", " exit-address-family", "clear ip bgp 2001:db8::164 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.235"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.235", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.235 next-hop-self", "clear ip bgp 10.0.0.235 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.145 next-hop-self", "clear ip bgp 192.0.2.145 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::4"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::4", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::4 activate", " exit-address-family", "clear ip bgp 2001:db8::4 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.59", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.238"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.238", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.238 next-hop-self", "clear ip bgp 192.0.2.238 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.81"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.81", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.81 next-hop-self", "clear ip bgp 10.0.0.81 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.68"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.68", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.68 next-hop-self", "clear ip bgp 192.0.2.68 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::188"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::188", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::188 activate", " exit-address-family", "clear ip bgp 2001:db8::188 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.228"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.228", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.228 next-hop-self", "clear ip bgp 10.0.0.228 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::117"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::117", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::117 activate", " exit-address-family", "clear ip bgp 2001:db8::117 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.124"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.124", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.124 next-hop-self", "clear ip bgp 10.0.0.124 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.119"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.119", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.119 next-hop-self", "clear ip bgp 192.0.2.119 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.99"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.99", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.99 next-hop-self", "clear ip bgp 10.0.0.99 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.110"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.110", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.110 next-hop-self", "clear ip bgp 10.0.0.110 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.180"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.180", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.180 next-hop-self", "clear ip bgp 10.0.0.180 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.80 next-hop-self", "clear ip bgp 192.0.2.80 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.191"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.191", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.191 next-hop-self", "clear ip bgp 192.0.2.191 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.5"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.5", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.5 next-hop-self", "clear ip bgp 192.0.2.5 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.164"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.164", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.164 next-hop-self", "clear ip bgp 192.0.2.164 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::32"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::32", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::32 activate", " exit-address-family", "clear ip bgp 2001:db8::32 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::72"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::72", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::72 activate", " exit-address-family", "clear ip bgp 2001:db8::72 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.49"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.49", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.49 next-hop-self", "clear ip bgp 192.0.2.49 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::93"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::93", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::93 activate", " exit-address-family", "clear ip bgp 2001:db8::93 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.229"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.229", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.229 next-hop-self", "clear ip bgp 192.0.2.229 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.24 next-hop-self", "clear ip bgp 192.0.2.24 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.231"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.231", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.231 next-hop-self", "clear ip bgp 10.0.0.231 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.232 next-hop-self", "clear ip bgp 192.0.2.232 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.137"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.137", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.137 next-hop-self", "clear ip bgp 10.0.0.137 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.209"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.209", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.209 next-hop-self", "clear ip bgp 10.0.0.209 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::141"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::141", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::141 activate", " exit-address-family", "clear ip bgp 2001:db8::141 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::83"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::83", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::83 activate", " exit-address-family", "clear ip bgp 2001:db8::83 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::17"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::17", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::17 activate", " exit-address-family", "clear ip bgp 2001:db8::17 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.31"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.31", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.31 next-hop-self", "clear ip bgp 10.0.0.31 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.149"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.149", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.149 next-hop-self", "clear ip bgp 10.0.0.149 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.165"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.165", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.165 next-hop-self", "clear ip bgp 192.0.2.165 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::83"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::83", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::83 activate", " exit-address-family", "clear ip bgp 2001:db8::83 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::125"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::125", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::125 activate", " exit-address-family", "clear ip bgp 2001:db8::125 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::81"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::81", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::81 activate", " exit-address-family", "clear ip bgp 2001:db8::81 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.51"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.51", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.51 next-hop-self", "clear ip bgp 10.0.0.51 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.201"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.201 next-hop-self", "clear ip bgp 192.0.2.201 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.50 next-hop-self", "clear ip bgp 192.0.2.50 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.181"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.181", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.181 next-hop-self", "clear ip bgp 10.0.0.181 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.73"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.73", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.73 next-hop-self", "clear ip bgp 192.0.2.73 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.33"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.33", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.33 next-hop-self", "clear ip bgp 10.0.0.33 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.127"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.127", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.127 next-hop-self", "clear ip bgp 192.0.2.127 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.101"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.101", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.101 next-hop-self", "clear ip bgp 192.0.2.101 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.170", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.170 next-hop-self", "clear ip bgp 192.0.2.170 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.84"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.84", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.84 next-hop-self", "clear ip bgp 10.0.0.84 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.227"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.227 next-hop-self", "clear ip bgp 192.0.2.227 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.53"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.53", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.53 next-hop-self", "clear ip bgp 192.0.2.53 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.109 next-hop-self", "clear ip bgp 192.0.2.109 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.230", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.230 next-hop-self", "clear ip bgp 192.0.2.230 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::188"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::188", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::188 activate", " exit-address-family", "clear ip bgp 2001:db8::188 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::38"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::38", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::38 activate", " exit-address-family", "clear ip bgp 2001:db8::38 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.54"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.54", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.54 next-hop-self", "clear ip bgp 10.0.0.54 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.190", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.190 next-hop-self", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::56"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::56", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::56 activate", " exit-address-family", "clear ip bgp 2001:db8::56 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.253"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.253", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.253 next-hop-self", "clear ip bgp 10.0.0.253 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::96"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::96", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::96 activate", " exit-address-family", "clear ip bgp 2001:db8::96 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.3"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.3", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.3 next-hop-self", "clear ip bgp 192.0.2.3 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.58"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.58", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.58 next-hop-self", "clear ip bgp 10.0.0.58 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::23"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::23", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::23 activate", " exit-address-family", "clear ip bgp 2001:db8::23 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.121"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.121", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.121 next-hop-self", "clear ip bgp 10.0.0.121 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.20"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.20", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.20 next-hop-self", "clear ip bgp 10.0.0.20 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::11"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::11", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::11 activate", " exit-address-family", "clear ip bgp 2001:db8::11 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.107"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.107 next-hop-self", "clear ip bgp 192.0.2.107 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.164"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.164", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.164 next-hop-self", "clear ip bgp 10.0.0.164 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.211"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.211", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.211 next-hop-self", "clear ip bgp 10.0.0.211 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.91", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.91 next-hop-self", "clear ip bgp 192.0.2.91 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.140"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.140", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.140 next-hop-self", "clear ip bgp 10.0.0.140 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.25"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.25", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.25 next-hop-self", "clear ip bgp 10.0.0.25 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.176"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.176", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.176 next-hop-self", "clear ip bgp 10.0.0.176 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::4"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::4", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::4 activate", " exit-address-family", "clear ip bgp 2001:db8::4 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::174"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::174", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::174 activate", " exit-address-family", "clear ip bgp 2001:db8::174 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::173"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::173", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::173 activate", " exit-address-family", "clear ip bgp 2001:db8::173 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.209"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.209", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.209 next-hop-self", "clear ip bgp 192.0.2.209 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.221"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.221", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.221 next-hop-self", "clear ip bgp 192.0.2.221 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.17"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.17", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.17 next-hop-self", "clear ip bgp 10.0.0.17 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::185"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::185", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::185 activate", " exit-address-family", "clear ip bgp 2001:db8::185 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.24"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.24", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.24 next-hop-self", "clear ip bgp 10.0.0.24 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::156"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::156", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::156 activate", " exit-address-family", "clear ip bgp 2001:db8::156 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.124"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.124", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.124 next-hop-self", "clear ip bgp 10.0.0.124 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::20"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::20", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::20 activate", " exit-address-family", "clear ip bgp 2001:db8::20 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.43"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.43", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.43 next-hop-self", "clear ip bgp 10.0.0.43 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::77"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::77", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::77 activate", " exit-address-family", "clear ip bgp 2001:db8::77 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.13"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.13", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.13 next-hop-self", "clear ip bgp 192.0.2.13 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.111"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.111", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.111 next-hop-self", "clear ip bgp 192.0.2.111 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.232", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.232 next-hop-self", "clear ip bgp 192.0.2.232 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.127"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.127", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.127 next-hop-self", "clear ip bgp 10.0.0.127 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.179"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.179", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.179 next-hop-self", "clear ip bgp 192.0.2.179 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::97"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::97", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::97 activate", " exit-address-family", "clear ip bgp 2001:db8::97 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::82"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::82", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::82 activate", " exit-address-family", "clear ip bgp 2001:db8::82 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.187 next-hop-self", "clear ip bgp 192.0.2.187 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.87", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.87 next-hop-self", "clear ip bgp 192.0.2.87 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.208"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.208", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.208 next-hop-self", "clear ip bgp 10.0.0.208 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::152"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::152", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::152 activate", " exit-address-family", "clear ip bgp 2001:db8::152 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.115"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.115 next-hop-self", "clear ip bgp 192.0.2.115 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.225"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.225", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.225 next-hop-self", "clear ip bgp 192.0.2.225 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::31"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::31", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::31 activate", " exit-address-family", "clear ip bgp 2001:db8::31 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.248"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.248", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.248 next-hop-self", "clear ip bgp 192.0.2.248 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.133"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.133 next-hop-self", "clear ip bgp 192.0.2.133 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.45"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.45", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.45 next-hop-self", "clear ip bgp 10.0.0.45 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::14"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::14", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::14 activate", " exit-address-family", "clear ip bgp 2001:db8::14 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.114"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.114", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.114 next-hop-self", "clear ip bgp 10.0.0.114 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.54"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.54", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.54 next-hop-self", "clear ip bgp 10.0.0.54 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::6"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::6", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::6 activate", " exit-address-family", "clear ip bgp 2001:db8::6 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.249", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.249 next-hop-self", "clear ip bgp 192.0.2.249 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.58", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.58 next-hop-self", "clear ip bgp 192.0.2.58 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.212"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.212", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.212 next-hop-self", "clear ip bgp 192.0.2.212 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.73"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.73", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.73 next-hop-self", "clear ip bgp 10.0.0.73 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.147"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.147", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.147 next-hop-self", "clear ip bgp 10.0.0.147 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.117"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.117", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.117 next-hop-self", "clear ip bgp 192.0.2.117 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::60"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::60", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::60 activate", " exit-address-family", "clear ip bgp 2001:db8::60 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.168"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.168", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.168 next-hop-self", "clear ip bgp 10.0.0.168 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::95"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::95", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::95 activate", " exit-address-family", "clear ip bgp 2001:db8::95 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.188"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.188", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.188 next-hop-self", "clear ip bgp 192.0.2.188 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.231 next-hop-self", "clear ip bgp 192.0.2.231 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::50"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::50", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::50 activate", " exit-address-family", "clear ip bgp 2001:db8::50 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.175"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.175", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.175 next-hop-self", "clear ip bgp 10.0.0.175 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::28", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::28 activate", " exit-address-family", "clear ip bgp 2001:db8::28 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.3"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.3", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.3 next-hop-self", "clear ip bgp 192.0.2.3 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::158"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::158", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::158 activate", " exit-address-family", "clear ip bgp 2001:db8::158 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::24"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::24", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::24 activate", " exit-address-family", "clear ip bgp 2001:db8::24 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.170"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.170", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.170 next-hop-self", "clear ip bgp 10.0.0.170 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.101"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.101", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.101 next-hop-self", "clear ip bgp 192.0.2.101 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.57"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.57", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.57 next-hop-self", "clear ip bgp 192.0.2.57 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.227"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.227 next-hop-self", "clear ip bgp 192.0.2.227 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::156"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::156", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::156 activate", " exit-address-family", "clear ip bgp 2001:db8::156 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.8", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.8 next-hop-self", "clear ip bgp 192.0.2.8 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::116"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::116", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::116 activate", " exit-address-family", "clear ip bgp 2001:db8::116 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.26"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.26", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.26 next-hop-self", "clear ip bgp 10.0.0.26 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.181"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.181", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.181 next-hop-self", "clear ip bgp 10.0.0.181 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.16"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.16", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.16 next-hop-self", "clear ip bgp 192.0.2.16 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::162"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::162", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::162 activate", " exit-address-family", "clear ip bgp 2001:db8::162 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.159"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.159", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.159 next-hop-self", "clear ip bgp 10.0.0.159 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::60"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::60", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::60 activate", " exit-address-family", "clear ip bgp 2001:db8::60 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::21"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::21", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::21 activate", " exit-address-family", "clear ip bgp 2001:db8::21 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::197"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::197", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::197 activate", " exit-address-family", "clear ip bgp 2001:db8::197 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.200"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.200", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.200 next-hop-self", "clear ip bgp 192.0.2.200 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::28", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::28 activate", " exit-address-family", "clear ip bgp 2001:db8::28 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.198"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.198", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.198 next-hop-self", "clear ip bgp 192.0.2.198 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::145"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::145", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::145 activate", " exit-address-family", "clear ip bgp 2001:db8::145 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.68"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.68", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.68 next-hop-self", "clear ip bgp 10.0.0.68 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.174"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.174 next-hop-self", "clear ip bgp 192.0.2.174 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::5"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::5", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::5 activate", " exit-address-family", "clear ip bgp 2001:db8::5 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.8", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.8 next-hop-self", "clear ip bgp 192.0.2.8 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::48"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::48", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::48 activate", " exit-address-family", "clear ip bgp 2001:db8::48 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.132"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.132", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.132 next-hop-self", "clear ip bgp 10.0.0.132 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::84"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::84", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::84 activate", " exit-address-family", "clear ip bgp 2001:db8::84 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.92"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.92", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.92 next-hop-self", "clear ip bgp 192.0.2.92 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.189 next-hop-self", "clear ip bgp 192.0.2.189 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::56"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::56", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::56 activate", " exit-address-family", "clear ip bgp 2001:db8::56 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::100"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::100", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::100 activate", " exit-address-family", "clear ip bgp 2001:db8::100 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.106"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.106", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.106 next-hop-self", "clear ip bgp 10.0.0.106 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::113"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::113", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::113 activate", " exit-address-family", "clear ip bgp 2001:db8::113 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.185 next-hop-self", "clear ip bgp 192.0.2.185 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.6"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.6", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.6 next-hop-self", "clear ip bgp 10.0.0.6 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.97"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.97", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.97 next-hop-self", "clear ip bgp 192.0.2.97 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.236"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.236", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.236 next-hop-self", "clear ip bgp 10.0.0.236 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::10"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::10", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::10 activate", " exit-address-family", "clear ip bgp 2001:db8::10 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.23"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.23", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.23 next-hop-self", "clear ip bgp 10.0.0.23 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::34"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::34", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::34 activate", " exit-address-family", "clear ip bgp 2001:db8::34 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.209"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.209", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.209 next-hop-self", "clear ip bgp 192.0.2.209 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::6"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::6", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::6 activate", " exit-address-family", "clear ip bgp 2001:db8::6 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.245", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.245 next-hop-self", "clear ip bgp 192.0.2.245 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.39 next-hop-self", "clear ip bgp 192.0.2.39 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::66"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::66", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::66 activate", " exit-address-family", "clear ip bgp 2001:db8::66 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.85"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.85", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.85 next-hop-self", "clear ip bgp 10.0.0.85 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.247"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.247", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.247 next-hop-self", "clear ip bgp 10.0.0.247 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::163"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::163", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::163 activate", " exit-address-family", "clear ip bgp 2001:db8::163 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.157"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.157", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.157 next-hop-self", "clear ip bgp 192.0.2.157 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.80 next-hop-self", "clear ip bgp 192.0.2.80 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.232"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.232", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.232 next-hop-self", "clear ip bgp 10.0.0.232 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.57"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.57", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.57 next-hop-self", "clear ip bgp 192.0.2.57 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.18"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.18", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.18 next-hop-self", "clear ip bgp 10.0.0.18 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.141"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.141", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.141 next-hop-self", "clear ip bgp 10.0.0.141 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::8"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::8", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::8 activate", " exit-address-family", "clear ip bgp 2001:db8::8 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.161 next-hop-self", "clear ip bgp 192.0.2.161 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::42"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::42", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::42 activate", " exit-address-family", "clear ip bgp 2001:db8::42 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.60"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.60", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.60 next-hop-self", "clear ip bgp 10.0.0.60 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.230", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.230 next-hop-self", "clear ip bgp 192.0.2.230 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.227"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.227", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.227 next-hop-self", "clear ip bgp 10.0.0.227 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.226"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.226", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.226 next-hop-self", "clear ip bgp 10.0.0.226 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.193"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.193", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.193 next-hop-self", "clear ip bgp 192.0.2.193 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.161", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.161 next-hop-self", "clear ip bgp 192.0.2.161 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.145", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.145 next-hop-self", "clear ip bgp 192.0.2.145 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::5"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::5", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::5 activate", " exit-address-family", "clear ip bgp 2001:db8::5 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.84"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.84", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.84 next-hop-self", "clear ip bgp 10.0.0.84 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::85", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::85 activate", " exit-address-family", "clear ip bgp 2001:db8::85 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.202"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.202 next-hop-self", "clear ip bgp 192.0.2.202 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.38"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.38", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.38 next-hop-self", "clear ip bgp 192.0.2.38 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.102"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.102", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.102 next-hop-self", "clear ip bgp 10.0.0.102 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.66"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.66", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.66 next-hop-self", "clear ip bgp 192.0.2.66 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.86"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.86", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.86 next-hop-self", "clear ip bgp 10.0.0.86 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::62"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::62", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::62 activate", " exit-address-family", "clear ip bgp 2001:db8::62 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.202"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.202", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.202 next-hop-self", "clear ip bgp 10.0.0.202 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.103"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.103", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.103 next-hop-self", "clear ip bgp 10.0.0.103 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.171"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.171", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.171 next-hop-self", "clear ip bgp 192.0.2.171 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.184", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.184 next-hop-self", "clear ip bgp 192.0.2.184 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.251", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.251 next-hop-self", "clear ip bgp 192.0.2.251 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::62"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::62", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::62 activate", " exit-address-family", "clear ip bgp 2001:db8::62 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::135"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::135", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::135 activate", " exit-address-family", "clear ip bgp 2001:db8::135 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.107"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.107", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.107 next-hop-self", "clear ip bgp 10.0.0.107 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::160"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::160", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::160 activate", " exit-address-family", "clear ip bgp 2001:db8::160 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.184"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.184", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.184 next-hop-self", "clear ip bgp 10.0.0.184 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.26"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.26", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.26 next-hop-self", "clear ip bgp 10.0.0.26 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.72"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.72", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.72 next-hop-self", "clear ip bgp 10.0.0.72 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.216 next-hop-self", "clear ip bgp 192.0.2.216 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::178", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::178 activate", " exit-address-family", "clear ip bgp 2001:db8::178 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::179"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::179", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::179 activate", " exit-address-family", "clear ip bgp 2001:db8::179 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.214"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.214", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.214 next-hop-self", "clear ip bgp 192.0.2.214 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::40"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::40", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::40 activate", " exit-address-family", "clear ip bgp 2001:db8::40 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.125"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.125", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.125 next-hop-self", "clear ip bgp 192.0.2.125 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.193"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.193", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.193 next-hop-self", "clear ip bgp 10.0.0.193 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.49"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.49", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.49 next-hop-self", "clear ip bgp 10.0.0.49 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::200"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::200", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::200 activate", " exit-address-family", "clear ip bgp 2001:db8::200 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.252"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.252", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.252 next-hop-self", "clear ip bgp 192.0.2.252 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.31"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.31", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.31 next-hop-self", "clear ip bgp 10.0.0.31 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.67"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.67", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.67 next-hop-self", "clear ip bgp 10.0.0.67 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.144"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.144 next-hop-self", "clear ip bgp 192.0.2.144 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.186"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.186", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.186 next-hop-self", "clear ip bgp 192.0.2.186 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.141"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.141", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.141 next-hop-self", "clear ip bgp 192.0.2.141 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.154", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.154 next-hop-self", "clear ip bgp 192.0.2.154 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.195"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.195", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.195 next-hop-self", "clear ip bgp 192.0.2.195 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.171"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.171", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.171 next-hop-self", "clear ip bgp 192.0.2.171 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.62"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.62", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.62 next-hop-self", "clear ip bgp 10.0.0.62 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.224"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.224", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.224 next-hop-self", "clear ip bgp 192.0.2.224 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.8", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.8 next-hop-self", "clear ip bgp 192.0.2.8 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::123"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::123", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::123 activate", " exit-address-family", "clear ip bgp 2001:db8::123 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.214"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.214", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.214 next-hop-self", "clear ip bgp 10.0.0.214 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::157"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::157", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::157 activate", " exit-address-family", "clear ip bgp 2001:db8::157 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.99"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.99", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.99 next-hop-self", "clear ip bgp 10.0.0.99 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::54"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::54", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::54 activate", " exit-address-family", "clear ip bgp 2001:db8::54 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.102"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.102 next-hop-self", "clear ip bgp 192.0.2.102 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::171"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::171", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::171 activate", " exit-address-family", "clear ip bgp 2001:db8::171 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.63 next-hop-self", "clear ip bgp 192.0.2.63 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::36"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::36", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::36 activate", " exit-address-family", "clear ip bgp 2001:db8::36 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.7 next-hop-self", "clear ip bgp 192.0.2.7 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.193"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.193", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.193 next-hop-self", "clear ip bgp 192.0.2.193 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.152"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.152", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.152 next-hop-self", "clear ip bgp 10.0.0.152 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::81"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::81", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::81 activate", " exit-address-family", "clear ip bgp 2001:db8::81 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.254"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.254", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.254 next-hop-self", "clear ip bgp 192.0.2.254 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::181", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::181 activate", " exit-address-family", "clear ip bgp 2001:db8::181 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.196"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.196", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.196 next-hop-self", "clear ip bgp 10.0.0.196 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.18", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.18 next-hop-self", "clear ip bgp 192.0.2.18 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::88"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::88", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::88 activate", " exit-address-family", "clear ip bgp 2001:db8::88 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.67"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.67", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.67 next-hop-self", "clear ip bgp 192.0.2.67 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.109 next-hop-self", "clear ip bgp 192.0.2.109 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.34"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.34", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.34 next-hop-self", "clear ip bgp 10.0.0.34 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.180"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.180", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.180 next-hop-self", "clear ip bgp 192.0.2.180 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::73"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::73", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::73 activate", " exit-address-family", "clear ip bgp 2001:db8::73 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.47"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.47", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.47 next-hop-self", "clear ip bgp 10.0.0.47 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::33"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::33", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::33 activate", " exit-address-family", "clear ip bgp 2001:db8::33 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::85", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::85 activate", " exit-address-family", "clear ip bgp 2001:db8::85 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.28"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.28", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.28 next-hop-self", "clear ip bgp 10.0.0.28 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.143"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.143", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.143 next-hop-self", "clear ip bgp 10.0.0.143 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::197"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::197", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::197 activate", " exit-address-family", "clear ip bgp 2001:db8::197 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.66"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.66", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.66 next-hop-self", "clear ip bgp 192.0.2.66 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.143"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.143", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.143 next-hop-self", "clear ip bgp 10.0.0.143 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.164"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.164", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.164 next-hop-self", "clear ip bgp 192.0.2.164 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.59", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.87", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.87 next-hop-self", "clear ip bgp 192.0.2.87 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::111"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::111", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::111 activate", " exit-address-family", "clear ip bgp 2001:db8::111 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::135"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::135", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::135 activate", " exit-address-family", "clear ip bgp 2001:db8::135 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.9", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.9 next-hop-self", "clear ip bgp 192.0.2.9 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::138", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::138 activate", " exit-address-family", "clear ip bgp 2001:db8::138 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.17"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.17 next-hop-self", "clear ip bgp 192.0.2.17 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.210"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.210", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.210 next-hop-self", "clear ip bgp 192.0.2.210 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.205"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.205", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.205 next-hop-self", "clear ip bgp 192.0.2.205 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.160"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.160", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.160 next-hop-self", "clear ip bgp 10.0.0.160 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::79", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::79 activate", " exit-address-family", "clear ip bgp 2001:db8::79 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::151", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::151 activate", " exit-address-family", "clear ip bgp 2001:db8::151 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.115"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.115", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.115 next-hop-self", "clear ip bgp 10.0.0.115 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.220"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.220", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.220 next-hop-self", "clear ip bgp 10.0.0.220 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.217"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.217", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.217 next-hop-self", "clear ip bgp 192.0.2.217 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::136"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::136", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::136 activate", " exit-address-family", "clear ip bgp 2001:db8::136 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::40"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::40", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::40 activate", " exit-address-family", "clear ip bgp 2001:db8::40 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.120", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.120 next-hop-self", "clear ip bgp 192.0.2.120 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.244"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.244", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.244 next-hop-self", "clear ip bgp 10.0.0.244 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::169"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::169", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::169 activate", " exit-address-family", "clear ip bgp 2001:db8::169 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.58", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.58 next-hop-self", "clear ip bgp 192.0.2.58 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.165"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.165", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.165 next-hop-self", "clear ip bgp 192.0.2.165 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.241 next-hop-self", "clear ip bgp 192.0.2.241 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.83", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.83 next-hop-self", "clear ip bgp 192.0.2.83 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::8"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::8", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::8 activate", " exit-address-family", "clear ip bgp 2001:db8::8 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::138", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::138 activate", " exit-address-family", "clear ip bgp 2001:db8::138 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.148"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.148", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.148 next-hop-self", "clear ip bgp 192.0.2.148 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.120", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.120 next-hop-self", "clear ip bgp 192.0.2.120 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.198"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.198", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.198 next-hop-self", "clear ip bgp 10.0.0.198 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.216", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.216 next-hop-self", "clear ip bgp 192.0.2.216 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::182"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::182", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::182 activate", " exit-address-family", "clear ip bgp 2001:db8::182 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::33"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::33", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::33 activate", " exit-address-family", "clear ip bgp 2001:db8::33 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.108 next-hop-self", "clear ip bgp 192.0.2.108 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.69"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.69", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.69 next-hop-self", "clear ip bgp 192.0.2.69 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.169", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.169 next-hop-self", "clear ip bgp 192.0.2.169 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::147"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::147", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::147 activate", " exit-address-family", "clear ip bgp 2001:db8::147 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.97"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.97", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.97 next-hop-self", "clear ip bgp 10.0.0.97 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::20"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::20", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::20 activate", " exit-address-family", "clear ip bgp 2001:db8::20 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.84"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.84", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.84 next-hop-self", "clear ip bgp 10.0.0.84 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.207", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.207 next-hop-self", "clear ip bgp 192.0.2.207 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.254"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.254", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.254 next-hop-self", "clear ip bgp 192.0.2.254 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::184", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::184 activate", " exit-address-family", "clear ip bgp 2001:db8::184 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.88"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.88", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.88 next-hop-self", "clear ip bgp 10.0.0.88 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.137"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.137", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.137 next-hop-self", "clear ip bgp 10.0.0.137 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::127"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::127", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::127 activate", " exit-address-family", "clear ip bgp 2001:db8::127 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::189"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::189", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::189 activate", " exit-address-family", "clear ip bgp 2001:db8::189 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.190 next-hop-self", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::141"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::141", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::141 activate", " exit-address-family", "clear ip bgp 2001:db8::141 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.183"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.183 next-hop-self", "clear ip bgp 192.0.2.183 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.54"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.54 next-hop-self", "clear ip bgp 192.0.2.54 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.209"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.209", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.209 next-hop-self", "clear ip bgp 192.0.2.209 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::175"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::175", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::175 activate", " exit-address-family", "clear ip bgp 2001:db8::175 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.99"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.99", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.99 next-hop-self", "clear ip bgp 10.0.0.99 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.191"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.191", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.191 next-hop-self", "clear ip bgp 192.0.2.191 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.49"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.49", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.49 next-hop-self", "clear ip bgp 10.0.0.49 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.175"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.175", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.175 next-hop-self", "clear ip bgp 10.0.0.175 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::141"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::141", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::141 activate", " exit-address-family", "clear ip bgp 2001:db8::141 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::154"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::154", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::154 activate", " exit-address-family", "clear ip bgp 2001:db8::154 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.230", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.230 next-hop-self", "clear ip bgp 192.0.2.230 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::126"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::126", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::126 activate", " exit-address-family", "clear ip bgp 2001:db8::126 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.226"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.226", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.226 next-hop-self", "clear ip bgp 192.0.2.226 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.34"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.34", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.34 next-hop-self", "clear ip bgp 192.0.2.34 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.165"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.165", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.165 next-hop-self", "clear ip bgp 10.0.0.165 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.206"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.206", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.206 next-hop-self", "clear ip bgp 10.0.0.206 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.113"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.113", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.113 next-hop-self", "clear ip bgp 10.0.0.113 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.242"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.242 next-hop-self", "clear ip bgp 192.0.2.242 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::56"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::56", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::56 activate", " exit-address-family", "clear ip bgp 2001:db8::56 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.251", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.251 next-hop-self", "clear ip bgp 192.0.2.251 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.176"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.176", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.176 next-hop-self", "clear ip bgp 192.0.2.176 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.41"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.41", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.41 next-hop-self", "clear ip bgp 10.0.0.41 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.39 next-hop-self", "clear ip bgp 192.0.2.39 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.219"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.219", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.219 next-hop-self", "clear ip bgp 10.0.0.219 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.247 next-hop-self", "clear ip bgp 192.0.2.247 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::197"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::197", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::197 activate", " exit-address-family", "clear ip bgp 2001:db8::197 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.186"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.186", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.186 next-hop-self", "clear ip bgp 192.0.2.186 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.228", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.228 next-hop-self", "clear ip bgp 192.0.2.228 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.8", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.8 next-hop-self", "clear ip bgp 192.0.2.8 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.110"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.110", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.110 next-hop-self", "clear ip bgp 10.0.0.110 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.145 next-hop-self", "clear ip bgp 192.0.2.145 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.231 next-hop-self", "clear ip bgp 192.0.2.231 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.222"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.222", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.222 next-hop-self", "clear ip bgp 10.0.0.222 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.86"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.86", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.86 next-hop-self", "clear ip bgp 192.0.2.86 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.63 next-hop-self", "clear ip bgp 192.0.2.63 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.185"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.185", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.185 next-hop-self", "clear ip bgp 10.0.0.185 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.228"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.228", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.228 next-hop-self", "clear ip bgp 10.0.0.228 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.89", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.89 next-hop-self", "clear ip bgp 192.0.2.89 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.244", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.244 next-hop-self", "clear ip bgp 192.0.2.244 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::164"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::164", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::164 activate", " exit-address-family", "clear ip bgp 2001:db8::164 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.39", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.39 next-hop-self", "clear ip bgp 192.0.2.39 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.249 next-hop-self", "clear ip bgp 192.0.2.249 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::62"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::62", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::62 activate", " exit-address-family", "clear ip bgp 2001:db8::62 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.203"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.203", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.203 next-hop-self", "clear ip bgp 192.0.2.203 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.240"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.240", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.240 next-hop-self", "clear ip bgp 10.0.0.240 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.189"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.189 next-hop-self", "clear ip bgp 192.0.2.189 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.86"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.86", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.86 next-hop-self", "clear ip bgp 192.0.2.86 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.56"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.56", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.56 next-hop-self", "clear ip bgp 192.0.2.56 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.246 next-hop-self", "clear ip bgp 192.0.2.246 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.242"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.242", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.242 next-hop-self", "clear ip bgp 192.0.2.242 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.168"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.168", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.168 next-hop-self", "clear ip bgp 10.0.0.168 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.188"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.188", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.188 next-hop-self", "clear ip bgp 10.0.0.188 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.9", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.9 next-hop-self", "clear ip bgp 192.0.2.9 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.222"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.222", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.222 next-hop-self", "clear ip bgp 192.0.2.222 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::149"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::149", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::149 activate", " exit-address-family", "clear ip bgp 2001:db8::149 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::9"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::9", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::9 activate", " exit-address-family", "clear ip bgp 2001:db8::9 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::91", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::91 activate", " exit-address-family", "clear ip bgp 2001:db8::91 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.136"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.136 next-hop-self", "clear ip bgp 192.0.2.136 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.38"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.38", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.38 next-hop-self", "clear ip bgp 10.0.0.38 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.29"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.29 next-hop-self", "clear ip bgp 192.0.2.29 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::151", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::151 activate", " exit-address-family", "clear ip bgp 2001:db8::151 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::36"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::36", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::36 activate", " exit-address-family", "clear ip bgp 2001:db8::36 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.122", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.122 next-hop-self", "clear ip bgp 192.0.2.122 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::97"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::97", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::97 activate", " exit-address-family", "clear ip bgp 2001:db8::97 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.83", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.83 next-hop-self", "clear ip bgp 192.0.2.83 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.251", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.251 next-hop-self", "clear ip bgp 192.0.2.251 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.217"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.217", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.217 next-hop-self", "clear ip bgp 192.0.2.217 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.37"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.37", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.37 next-hop-self", "clear ip bgp 192.0.2.37 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.5"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.5", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.5 next-hop-self", "clear ip bgp 192.0.2.5 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::57"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::57", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::57 activate", " exit-address-family", "clear ip bgp 2001:db8::57 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.19"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.19", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.19 next-hop-self", "clear ip bgp 10.0.0.19 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::155"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::155", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::155 activate", " exit-address-family", "clear ip bgp 2001:db8::155 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::8"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::8", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::8 activate", " exit-address-family", "clear ip bgp 2001:db8::8 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.179"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.179", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.179 next-hop-self", "clear ip bgp 10.0.0.179 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.248"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.248", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.248 next-hop-self", "clear ip bgp 10.0.0.248 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.240"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.240", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.240 next-hop-self", "clear ip bgp 192.0.2.240 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.11"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.11", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.11 next-hop-self", "clear ip bgp 192.0.2.11 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.158"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.158 next-hop-self", "clear ip bgp 192.0.2.158 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.190"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.190", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.190 next-hop-self", "clear ip bgp 10.0.0.190 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.23"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.23", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.23 next-hop-self", "clear ip bgp 10.0.0.23 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.226"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.226", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.226 next-hop-self", "clear ip bgp 10.0.0.226 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::88"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::88", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::88 activate", " exit-address-family", "clear ip bgp 2001:db8::88 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::142"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::142", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::142 activate", " exit-address-family", "clear ip bgp 2001:db8::142 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.212"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.212", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.212 next-hop-self", "clear ip bgp 10.0.0.212 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.211 next-hop-self", "clear ip bgp 192.0.2.211 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::196"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::196", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::196 activate", " exit-address-family", "clear ip bgp 2001:db8::196 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.152"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.152", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.152 next-hop-self", "clear ip bgp 192.0.2.152 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.163"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.163", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.163 next-hop-self", "clear ip bgp 10.0.0.163 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::120"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::120", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::120 activate", " exit-address-family", "clear ip bgp 2001:db8::120 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.40", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.40 next-hop-self", "clear ip bgp 192.0.2.40 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.59", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::171"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::171", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::171 activate", " exit-address-family", "clear ip bgp 2001:db8::171 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::166"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::166", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::166 activate", " exit-address-family", "clear ip bgp 2001:db8::166 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::162"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::162", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::162 activate", " exit-address-family", "clear ip bgp 2001:db8::162 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.185"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.185", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.185 next-hop-self", "clear ip bgp 10.0.0.185 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.20"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.20", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.20 next-hop-self", "clear ip bgp 192.0.2.20 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.213"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.213", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.213 next-hop-self", "clear ip bgp 10.0.0.213 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.223"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.223", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.223 next-hop-self", "clear ip bgp 10.0.0.223 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.189"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.189", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.189 next-hop-self", "clear ip bgp 10.0.0.189 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.47"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.47", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.47 next-hop-self", "clear ip bgp 10.0.0.47 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::28", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::28 activate", " exit-address-family", "clear ip bgp 2001:db8::28 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::15"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::15", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::15 activate", " exit-address-family", "clear ip bgp 2001:db8::15 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.172"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.172", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.172 next-hop-self", "clear ip bgp 10.0.0.172 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.194"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.194", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.194 next-hop-self", "clear ip bgp 192.0.2.194 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.25", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.25 next-hop-self", "clear ip bgp 192.0.2.25 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::24"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::24", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::24 activate", " exit-address-family", "clear ip bgp 2001:db8::24 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::119"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::119", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::119 activate", " exit-address-family", "clear ip bgp 2001:db8::119 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.28"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.28", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.28 next-hop-self", "clear ip bgp 10.0.0.28 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.104", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.104 next-hop-self", "clear ip bgp 192.0.2.104 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.244", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.244 next-hop-self", "clear ip bgp 192.0.2.244 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.194"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.194", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.194 next-hop-self", "clear ip bgp 10.0.0.194 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.139"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.139", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.139 next-hop-self", "clear ip bgp 10.0.0.139 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.251"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.251", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.251 next-hop-self", "clear ip bgp 10.0.0.251 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.193"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.193", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.193 next-hop-self", "clear ip bgp 10.0.0.193 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.8", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.8 next-hop-self", "clear ip bgp 192.0.2.8 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.75"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.75", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.75 next-hop-self", "clear ip bgp 192.0.2.75 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.3"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.3", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.3 next-hop-self", "clear ip bgp 10.0.0.3 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.155"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.155 next-hop-self", "clear ip bgp 192.0.2.155 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::45"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::45", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::45 activate", " exit-address-family", "clear ip bgp 2001:db8::45 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.252"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.252", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.252 next-hop-self", "clear ip bgp 192.0.2.252 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.187", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.187 next-hop-self", "clear ip bgp 192.0.2.187 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.26"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.26", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.26 next-hop-self", "clear ip bgp 192.0.2.26 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.34"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.34 next-hop-self", "clear ip bgp 192.0.2.34 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.191"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.191", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.191 next-hop-self", "clear ip bgp 192.0.2.191 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::127"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::127", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::127 activate", " exit-address-family", "clear ip bgp 2001:db8::127 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.151", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.151 next-hop-self", "clear ip bgp 192.0.2.151 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::55", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::55 activate", " exit-address-family", "clear ip bgp 2001:db8::55 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.6"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.6", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.6 next-hop-self", "clear ip bgp 10.0.0.6 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.4"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.4", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.4 next-hop-self", "clear ip bgp 10.0.0.4 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::9"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::9", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::9 activate", " exit-address-family", "clear ip bgp 2001:db8::9 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.179"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.179", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.179 next-hop-self", "clear ip bgp 10.0.0.179 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::96"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::96", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::96 activate", " exit-address-family", "clear ip bgp 2001:db8::96 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.78"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.78", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.78 next-hop-self", "clear ip bgp 192.0.2.78 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::67"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::67", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::67 activate", " exit-address-family", "clear ip bgp 2001:db8::67 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.188"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.188", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.188 next-hop-self", "clear ip bgp 192.0.2.188 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.81"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.81", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.81 next-hop-self", "clear ip bgp 10.0.0.81 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::75"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::75", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::75 activate", " exit-address-family", "clear ip bgp 2001:db8::75 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::133"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::133", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::133 activate", " exit-address-family", "clear ip bgp 2001:db8::133 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.124"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.124", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.124 next-hop-self", "clear ip bgp 10.0.0.124 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::143"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::143", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::143 activate", " exit-address-family", "clear ip bgp 2001:db8::143 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.65"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.65", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.65 next-hop-self", "clear ip bgp 10.0.0.65 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::111"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::111", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::111 activate", " exit-address-family", "clear ip bgp 2001:db8::111 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.40", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.40 next-hop-self", "clear ip bgp 192.0.2.40 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.110"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.110", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.110 next-hop-self", "clear ip bgp 10.0.0.110 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.231"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.231", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.231 next-hop-self", "clear ip bgp 10.0.0.231 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.247", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.247 next-hop-self", "clear ip bgp 192.0.2.247 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.200"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.200", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.200 next-hop-self", "clear ip bgp 10.0.0.200 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.113"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.113 next-hop-self", "clear ip bgp 192.0.2.113 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::137"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::137", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::137 activate", " exit-address-family", "clear ip bgp 2001:db8::137 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::118"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::118", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::118 activate", " exit-address-family", "clear ip bgp 2001:db8::118 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::139"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::139", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::139 activate", " exit-address-family", "clear ip bgp 2001:db8::139 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.136"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.136", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.136 next-hop-self", "clear ip bgp 192.0.2.136 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.18"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.18", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.18 next-hop-self", "clear ip bgp 10.0.0.18 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::184", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::184 activate", " exit-address-family", "clear ip bgp 2001:db8::184 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.249 next-hop-self", "clear ip bgp 192.0.2.249 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::121"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::121", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::121 activate", " exit-address-family", "clear ip bgp 2001:db8::121 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.123"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.123", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.123 next-hop-self", "clear ip bgp 10.0.0.123 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.109"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.109", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.109 next-hop-self", "clear ip bgp 10.0.0.109 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.16"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.16 next-hop-self", "clear ip bgp 192.0.2.16 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::193"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::193", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::193 activate", " exit-address-family", "clear ip bgp 2001:db8::193 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.165"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.165", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.165 next-hop-self", "clear ip bgp 192.0.2.165 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.183"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.183", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.183 next-hop-self", "clear ip bgp 10.0.0.183 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.128"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.128", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.128 next-hop-self", "clear ip bgp 10.0.0.128 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::42"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::42", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::42 activate", " exit-address-family", "clear ip bgp 2001:db8::42 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::119"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::119", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::119 activate", " exit-address-family", "clear ip bgp 2001:db8::119 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.63"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.63", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.63 next-hop-self", "clear ip bgp 10.0.0.63 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::43"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::43", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::43 activate", " exit-address-family", "clear ip bgp 2001:db8::43 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.108 next-hop-self", "clear ip bgp 192.0.2.108 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.105 next-hop-self", "clear ip bgp 192.0.2.105 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.9", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.9 next-hop-self", "clear ip bgp 192.0.2.9 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.184"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.184", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.184 next-hop-self", "clear ip bgp 10.0.0.184 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.123"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.123", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.123 next-hop-self", "clear ip bgp 10.0.0.123 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.117"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.117", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.117 next-hop-self", "clear ip bgp 10.0.0.117 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::169"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::169", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::169 activate", " exit-address-family", "clear ip bgp 2001:db8::169 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.128 next-hop-self", "clear ip bgp 192.0.2.128 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.85", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.85 next-hop-self", "clear ip bgp 192.0.2.85 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::126"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::126", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::126 activate", " exit-address-family", "clear ip bgp 2001:db8::126 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.126"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.126", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.126 next-hop-self", "clear ip bgp 10.0.0.126 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::128"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::128", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::128 activate", " exit-address-family", "clear ip bgp 2001:db8::128 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.240"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.240", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.240 next-hop-self", "clear ip bgp 10.0.0.240 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::136"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::136", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::136 activate", " exit-address-family", "clear ip bgp 2001:db8::136 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.179"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.179", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.179 next-hop-self", "clear ip bgp 192.0.2.179 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.225"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.225", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.225 next-hop-self", "clear ip bgp 192.0.2.225 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.62"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.62", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.62 next-hop-self", "clear ip bgp 10.0.0.62 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::19"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::19", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::19 activate", " exit-address-family", "clear ip bgp 2001:db8::19 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::176"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::176", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::176 activate", " exit-address-family", "clear ip bgp 2001:db8::176 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.110"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.110", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.110 next-hop-self", "clear ip bgp 10.0.0.110 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.169", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.169 next-hop-self", "clear ip bgp 192.0.2.169 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::27"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::27", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::27 activate", " exit-address-family", "clear ip bgp 2001:db8::27 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.89", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.89 next-hop-self", "clear ip bgp 192.0.2.89 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.76"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.76", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.76 next-hop-self", "clear ip bgp 192.0.2.76 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.58", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.58 next-hop-self", "clear ip bgp 192.0.2.58 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.156 next-hop-self", "clear ip bgp 192.0.2.156 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.65"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.65", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.65 next-hop-self", "clear ip bgp 10.0.0.65 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.109"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.109", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.109 next-hop-self", "clear ip bgp 10.0.0.109 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.42 next-hop-self", "clear ip bgp 192.0.2.42 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::91", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::91 activate", " exit-address-family", "clear ip bgp 2001:db8::91 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.224"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.224", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.224 next-hop-self", "clear ip bgp 192.0.2.224 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.61"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.61", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.61 next-hop-self", "clear ip bgp 10.0.0.61 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.95"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.95", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.95 next-hop-self", "clear ip bgp 192.0.2.95 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.105"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.105", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.105 next-hop-self", "clear ip bgp 10.0.0.105 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.29"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.29 next-hop-self", "clear ip bgp 192.0.2.29 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.92"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.92", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.92 next-hop-self", "clear ip bgp 10.0.0.92 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.118"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.118", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.118 next-hop-self", "clear ip bgp 10.0.0.118 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.217"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.217", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.217 next-hop-self", "clear ip bgp 10.0.0.217 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.33"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.33", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.33 next-hop-self", "clear ip bgp 192.0.2.33 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::94"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::94", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::94 activate", " exit-address-family", "clear ip bgp 2001:db8::94 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::147"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::147", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::147 activate", " exit-address-family", "clear ip bgp 2001:db8::147 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.170"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.170", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.170 next-hop-self", "clear ip bgp 10.0.0.170 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.131"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.131", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.131 next-hop-self", "clear ip bgp 192.0.2.131 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.93"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.93", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.93 next-hop-self", "clear ip bgp 192.0.2.93 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.201"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.201", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.201 next-hop-self", "clear ip bgp 192.0.2.201 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.33"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.33", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.33 next-hop-self", "clear ip bgp 10.0.0.33 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.162"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.162", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.162 next-hop-self", "clear ip bgp 10.0.0.162 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::106"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::106", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::106 activate", " exit-address-family", "clear ip bgp 2001:db8::106 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::61"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::61", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::61 activate", " exit-address-family", "clear ip bgp 2001:db8::61 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::133"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::133", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::133 activate", " exit-address-family", "clear ip bgp 2001:db8::133 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.164"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.164", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.164 next-hop-self", "clear ip bgp 192.0.2.164 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::168"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::168", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::168 activate", " exit-address-family", "clear ip bgp 2001:db8::168 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::165"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::165", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::165 activate", " exit-address-family", "clear ip bgp 2001:db8::165 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::85", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::85 activate", " exit-address-family", "clear ip bgp 2001:db8::85 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.102"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.102", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.102 next-hop-self", "clear ip bgp 10.0.0.102 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.97"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.97", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.97 next-hop-self", "clear ip bgp 192.0.2.97 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.89 next-hop-self", "clear ip bgp 192.0.2.89 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.126"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.126", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.126 next-hop-self", "clear ip bgp 192.0.2.126 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::189"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::189", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::189 activate", " exit-address-family", "clear ip bgp 2001:db8::189 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.162"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.162", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.162 next-hop-self", "clear ip bgp 10.0.0.162 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.143"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.143", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.143 next-hop-self", "clear ip bgp 10.0.0.143 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::176"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::176", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::176 activate", " exit-address-family", "clear ip bgp 2001:db8::176 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.244", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.244 next-hop-self", "clear ip bgp 192.0.2.244 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::106"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::106", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::106 activate", " exit-address-family", "clear ip bgp 2001:db8::106 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.49"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.49", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.49 next-hop-self", "clear ip bgp 10.0.0.49 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::10"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::10", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::10 activate", " exit-address-family", "clear ip bgp 2001:db8::10 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.155"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.155", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.155 next-hop-self", "clear ip bgp 10.0.0.155 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::126"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::126", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::126 activate", " exit-address-family", "clear ip bgp 2001:db8::126 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.39", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.39 next-hop-self", "clear ip bgp 192.0.2.39 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::69"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::69", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::69 activate", " exit-address-family", "clear ip bgp 2001:db8::69 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.190", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.190 next-hop-self", "clear ip bgp 192.0.2.190 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.161"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.161", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.161 next-hop-self", "clear ip bgp 10.0.0.161 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.124"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.124", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.124 next-hop-self", "clear ip bgp 10.0.0.124 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.133"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.133", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.133 next-hop-self", "clear ip bgp 10.0.0.133 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.92"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.92", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.92 next-hop-self", "clear ip bgp 10.0.0.92 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.243"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.243", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.243 next-hop-self", "clear ip bgp 10.0.0.243 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::39"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::39", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::39 activate", " exit-address-family", "clear ip bgp 2001:db8::39 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::134", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::134 activate", " exit-address-family", "clear ip bgp 2001:db8::134 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.114"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.114 next-hop-self", "clear ip bgp 192.0.2.114 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::51"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::51", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::51 activate", " exit-address-family", "clear ip bgp 2001:db8::51 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::71"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::71", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::71 activate", " exit-address-family", "clear ip bgp 2001:db8::71 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::111"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::111", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::111 activate", " exit-address-family", "clear ip bgp 2001:db8::111 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::134", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::134 activate", " exit-address-family", "clear ip bgp 2001:db8::134 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::143"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::143", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::143 activate", " exit-address-family", "clear ip bgp 2001:db8::143 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.25", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.25 next-hop-self", "clear ip bgp 192.0.2.25 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.21"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.21", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.21 next-hop-self", "clear ip bgp 10.0.0.21 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.58"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.58", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.58 next-hop-self", "clear ip bgp 10.0.0.58 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.102"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.102", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.102 next-hop-self", "clear ip bgp 10.0.0.102 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.162"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.162", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.162 next-hop-self", "clear ip bgp 192.0.2.162 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.166"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.166", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.166 next-hop-self", "clear ip bgp 192.0.2.166 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.125"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.125", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.125 next-hop-self", "clear ip bgp 192.0.2.125 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.231 next-hop-self", "clear ip bgp 192.0.2.231 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.33"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.33", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.33 next-hop-self", "clear ip bgp 10.0.0.33 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::104"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::104", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::104 activate", " exit-address-family", "clear ip bgp 2001:db8::104 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.109 next-hop-self", "clear ip bgp 192.0.2.109 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.73"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.73", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.73 next-hop-self", "clear ip bgp 192.0.2.73 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.169", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.169 next-hop-self", "clear ip bgp 192.0.2.169 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.159"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.159", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.159 next-hop-self", "clear ip bgp 10.0.0.159 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.212"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.212 next-hop-self", "clear ip bgp 192.0.2.212 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.140"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.140 next-hop-self", "clear ip bgp 192.0.2.140 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::101"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::101", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::101 activate", " exit-address-family", "clear ip bgp 2001:db8::101 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.25", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.25 next-hop-self", "clear ip bgp 192.0.2.25 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.235"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.235", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.235 next-hop-self", "clear ip bgp 10.0.0.235 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.35 next-hop-self", "clear ip bgp 192.0.2.35 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.179"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.179", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.179 next-hop-self", "clear ip bgp 192.0.2.179 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::136"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::136", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::136 activate", " exit-address-family", "clear ip bgp 2001:db8::136 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::5"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::5", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::5 activate", " exit-address-family", "clear ip bgp 2001:db8::5 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.109"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.109", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.109 next-hop-self", "clear ip bgp 10.0.0.109 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.52"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.52", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.52 next-hop-self", "clear ip bgp 10.0.0.52 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.143"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.143", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.143 next-hop-self", "clear ip bgp 192.0.2.143 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.46"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.46", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.46 next-hop-self", "clear ip bgp 10.0.0.46 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::1"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::1", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::1 activate", " exit-address-family", "clear ip bgp 2001:db8::1 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.239"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.239", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.239 next-hop-self", "clear ip bgp 10.0.0.239 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::113"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::113", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::113 activate", " exit-address-family", "clear ip bgp 2001:db8::113 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.199", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.199 next-hop-self", "clear ip bgp 192.0.2.199 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.238"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.238", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.238 next-hop-self", "clear ip bgp 192.0.2.238 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.223"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.223 next-hop-self", "clear ip bgp 192.0.2.223 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.92"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.92", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.92 next-hop-self", "clear ip bgp 10.0.0.92 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::88"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::88", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::88 activate", " exit-address-family", "clear ip bgp 2001:db8::88 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::72"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::72", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::72 activate", " exit-address-family", "clear ip bgp 2001:db8::72 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.38"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.38", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.38 next-hop-self", "clear ip bgp 10.0.0.38 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.93"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.93", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.93 next-hop-self", "clear ip bgp 10.0.0.93 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.182"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.182", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.182 next-hop-self", "clear ip bgp 192.0.2.182 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.43"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.43", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.43 next-hop-self", "clear ip bgp 192.0.2.43 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.69"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.69", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.69 next-hop-self", "clear ip bgp 192.0.2.69 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::149"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::149", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::149 activate", " exit-address-family", "clear ip bgp 2001:db8::149 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.41"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.41", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.41 next-hop-self", "clear ip bgp 10.0.0.41 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.121"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.121", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.121 next-hop-self", "clear ip bgp 192.0.2.121 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.34"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.34", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.34 next-hop-self", "clear ip bgp 10.0.0.34 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::89"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::89", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::89 activate", " exit-address-family", "clear ip bgp 2001:db8::89 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.102"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.102", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.102 next-hop-self", "clear ip bgp 192.0.2.102 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.32"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.32", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.32 next-hop-self", "clear ip bgp 192.0.2.32 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.236"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.236", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.236 next-hop-self", "clear ip bgp 192.0.2.236 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::85", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::85 activate", " exit-address-family", "clear ip bgp 2001:db8::85 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.85", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.85 next-hop-self", "clear ip bgp 192.0.2.85 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.237"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.237", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.237 next-hop-self", "clear ip bgp 192.0.2.237 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.159"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.159", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.159 next-hop-self", "clear ip bgp 192.0.2.159 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.7 next-hop-self", "clear ip bgp 192.0.2.7 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::111"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::111", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::111 activate", " exit-address-family", "clear ip bgp 2001:db8::111 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.193"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.193", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.193 next-hop-self", "clear ip bgp 192.0.2.193 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.131"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.131", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.131 next-hop-self", "clear ip bgp 192.0.2.131 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.162"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.162", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.162 next-hop-self", "clear ip bgp 10.0.0.162 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.116"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.116", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.116 next-hop-self", "clear ip bgp 10.0.0.116 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.102"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.102", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.102 next-hop-self", "clear ip bgp 192.0.2.102 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.66"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.66", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.66 next-hop-self", "clear ip bgp 10.0.0.66 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.188"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.188", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.188 next-hop-self", "clear ip bgp 192.0.2.188 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::196"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::196", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::196 activate", " exit-address-family", "clear ip bgp 2001:db8::196 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.29"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.29 next-hop-self", "clear ip bgp 192.0.2.29 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.116 next-hop-self", "clear ip bgp 192.0.2.116 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::199"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::199", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::199 activate", " exit-address-family", "clear ip bgp 2001:db8::199 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::125"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::125", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::125 activate", " exit-address-family", "clear ip bgp 2001:db8::125 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.90"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.90", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.90 next-hop-self", "clear ip bgp 192.0.2.90 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::166"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::166", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::166 activate", " exit-address-family", "clear ip bgp 2001:db8::166 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.235"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.235", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.235 next-hop-self", "clear ip bgp 192.0.2.235 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.91", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.91 next-hop-self", "clear ip bgp 192.0.2.91 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.28"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.28", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.28 next-hop-self", "clear ip bgp 192.0.2.28 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.242"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.242 next-hop-self", "clear ip bgp 192.0.2.242 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::154"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::154", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::154 activate", " exit-address-family", "clear ip bgp 2001:db8::154 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::14"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::14", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::14 activate", " exit-address-family", "clear ip bgp 2001:db8::14 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::59"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::59", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::59 activate", " exit-address-family", "clear ip bgp 2001:db8::59 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::76"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::76", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::76 activate", " exit-address-family", "clear ip bgp 2001:db8::76 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.59", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::129", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::129 activate", " exit-address-family", "clear ip bgp 2001:db8::129 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.148"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.148", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.148 next-hop-self", "clear ip bgp 10.0.0.148 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.91"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.91", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.91 next-hop-self", "clear ip bgp 10.0.0.91 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.163"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.163", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.163 next-hop-self", "clear ip bgp 10.0.0.163 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::118"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::118", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::118 activate", " exit-address-family", "clear ip bgp 2001:db8::118 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::59"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::59", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::59 activate", " exit-address-family", "clear ip bgp 2001:db8::59 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.120"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.120", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.120 next-hop-self", "clear ip bgp 10.0.0.120 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::196"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::196", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::196 activate", " exit-address-family", "clear ip bgp 2001:db8::196 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.164"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.164", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.164 next-hop-self", "clear ip bgp 10.0.0.164 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.96"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.96", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.96 next-hop-self", "clear ip bgp 10.0.0.96 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.197 next-hop-self", "clear ip bgp 192.0.2.197 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.8", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.8 next-hop-self", "clear ip bgp 192.0.2.8 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.144"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.144", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.144 next-hop-self", "clear ip bgp 192.0.2.144 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.161"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.161", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.161 next-hop-self", "clear ip bgp 10.0.0.161 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.175"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.175", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.175 next-hop-self", "clear ip bgp 192.0.2.175 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::15"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::15", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::15 activate", " exit-address-family", "clear ip bgp 2001:db8::15 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.46"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.46", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.46 next-hop-self", "clear ip bgp 192.0.2.46 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.5"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.5", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.5 next-hop-self", "clear ip bgp 192.0.2.5 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.38"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.38", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.38 next-hop-self", "clear ip bgp 10.0.0.38 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.5"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.5", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.5 next-hop-self", "clear ip bgp 192.0.2.5 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.23 next-hop-self", "clear ip bgp 192.0.2.23 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.84"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.84", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.84 next-hop-self", "clear ip bgp 10.0.0.84 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.179"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.179", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.179 next-hop-self", "clear ip bgp 10.0.0.179 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.80 next-hop-self", "clear ip bgp 192.0.2.80 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.20"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.20", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.20 next-hop-self", "clear ip bgp 10.0.0.20 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::147"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::147", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::147 activate", " exit-address-family", "clear ip bgp 2001:db8::147 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::48"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::48", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::48 activate", " exit-address-family", "clear ip bgp 2001:db8::48 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.100"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.100", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.100 next-hop-self", "clear ip bgp 192.0.2.100 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.161 next-hop-self", "clear ip bgp 192.0.2.161 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::142"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::142", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::142 activate", " exit-address-family", "clear ip bgp 2001:db8::142 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.140"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.140", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.140 next-hop-self", "clear ip bgp 192.0.2.140 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.43"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.43 next-hop-self", "clear ip bgp 192.0.2.43 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.42"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.42", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.42 next-hop-self", "clear ip bgp 10.0.0.42 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::147"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::147", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::147 activate", " exit-address-family", "clear ip bgp 2001:db8::147 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.175"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.175", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.175 next-hop-self", "clear ip bgp 10.0.0.175 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.12"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.12", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.12 next-hop-self", "clear ip bgp 10.0.0.12 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::63"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::63", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::63 activate", " exit-address-family", "clear ip bgp 2001:db8::63 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.50 next-hop-self", "clear ip bgp 192.0.2.50 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::196"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::196", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::196 activate", " exit-address-family", "clear ip bgp 2001:db8::196 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::174"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::174", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::174 activate", " exit-address-family", "clear ip bgp 2001:db8::174 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.24"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.24", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.24 next-hop-self", "clear ip bgp 10.0.0.24 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::34"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::34", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::34 activate", " exit-address-family", "clear ip bgp 2001:db8::34 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.216 next-hop-self", "clear ip bgp 192.0.2.216 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.113"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.113 next-hop-self", "clear ip bgp 192.0.2.113 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.219"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.219", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.219 next-hop-self", "clear ip bgp 10.0.0.219 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.19 next-hop-self", "clear ip bgp 192.0.2.19 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.152"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.152", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.152 next-hop-self", "clear ip bgp 10.0.0.152 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.82"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.82", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.82 next-hop-self", "clear ip bgp 10.0.0.82 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.193"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.193", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.193 next-hop-self", "clear ip bgp 192.0.2.193 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.122", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.122 next-hop-self", "clear ip bgp 192.0.2.122 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::195"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::195", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::195 activate", " exit-address-family", "clear ip bgp 2001:db8::195 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.25"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.25", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.25 next-hop-self", "clear ip bgp 10.0.0.25 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.105 next-hop-self", "clear ip bgp 192.0.2.105 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::187"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::187", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::187 activate", " exit-address-family", "clear ip bgp 2001:db8::187 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.94 next-hop-self", "clear ip bgp 192.0.2.94 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::50"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::50", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::50 activate", " exit-address-family", "clear ip bgp 2001:db8::50 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::115"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::115", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::115 activate", " exit-address-family", "clear ip bgp 2001:db8::115 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::170"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::170", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::170 activate", " exit-address-family", "clear ip bgp 2001:db8::170 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::70"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::70", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::70 activate", " exit-address-family", "clear ip bgp 2001:db8::70 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.65"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.65", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.65 next-hop-self", "clear ip bgp 10.0.0.65 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::111"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::111", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::111 activate", " exit-address-family", "clear ip bgp 2001:db8::111 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.144"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.144", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.144 next-hop-self", "clear ip bgp 192.0.2.144 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.239"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.239", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.239 next-hop-self", "clear ip bgp 192.0.2.239 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.110", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.110 next-hop-self", "clear ip bgp 192.0.2.110 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.158"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.158 next-hop-self", "clear ip bgp 192.0.2.158 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.84"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.84", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.84 next-hop-self", "clear ip bgp 10.0.0.84 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.183"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.183", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.183 next-hop-self", "clear ip bgp 10.0.0.183 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.28"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.28", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.28 next-hop-self", "clear ip bgp 10.0.0.28 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::12"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::12", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::12 activate", " exit-address-family", "clear ip bgp 2001:db8::12 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.103", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.103 next-hop-self", "clear ip bgp 192.0.2.103 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::198"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::198", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::198 activate", " exit-address-family", "clear ip bgp 2001:db8::198 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.119"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.119", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.119 next-hop-self", "clear ip bgp 10.0.0.119 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.224"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.224", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.224 next-hop-self", "clear ip bgp 192.0.2.224 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.140"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.140", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.140 next-hop-self", "clear ip bgp 10.0.0.140 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.22"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.22", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.22 next-hop-self", "clear ip bgp 10.0.0.22 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::69"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::69", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::69 activate", " exit-address-family", "clear ip bgp 2001:db8::69 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.246 next-hop-self", "clear ip bgp 192.0.2.246 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.131"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.131", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.131 next-hop-self", "clear ip bgp 10.0.0.131 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.87"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.87", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.87 next-hop-self", "clear ip bgp 10.0.0.87 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.102"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.102", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.102 next-hop-self", "clear ip bgp 10.0.0.102 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.13"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.13", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.13 next-hop-self", "clear ip bgp 10.0.0.13 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.229"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.229", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.229 next-hop-self", "clear ip bgp 192.0.2.229 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.67"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.67", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.67 next-hop-self", "clear ip bgp 10.0.0.67 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.211"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.211", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.211 next-hop-self", "clear ip bgp 10.0.0.211 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.84"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.84", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.84 next-hop-self", "clear ip bgp 10.0.0.84 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::105"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::105", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::105 activate", " exit-address-family", "clear ip bgp 2001:db8::105 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.185"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.185", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.185 next-hop-self", "clear ip bgp 10.0.0.185 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.43"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.43", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.43 next-hop-self", "clear ip bgp 10.0.0.43 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.198"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.198", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.198 next-hop-self", "clear ip bgp 192.0.2.198 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::79", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::79 activate", " exit-address-family", "clear ip bgp 2001:db8::79 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.230"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.230", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.230 next-hop-self", "clear ip bgp 10.0.0.230 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.80 next-hop-self", "clear ip bgp 192.0.2.80 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.13"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.13", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.13 next-hop-self", "clear ip bgp 192.0.2.13 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.141"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.141", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.141 next-hop-self", "clear ip bgp 10.0.0.141 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.135"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.135", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.135 next-hop-self", "clear ip bgp 192.0.2.135 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::132"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::132", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::132 activate", " exit-address-family", "clear ip bgp 2001:db8::132 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.226"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.226", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.226 next-hop-self", "clear ip bgp 10.0.0.226 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.100"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.100", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.100 next-hop-self", "clear ip bgp 192.0.2.100 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.42"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.42", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.42 next-hop-self", "clear ip bgp 10.0.0.42 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.144"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.144", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.144 next-hop-self", "clear ip bgp 10.0.0.144 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::164"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::164", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::164 activate", " exit-address-family", "clear ip bgp 2001:db8::164 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::151", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::151 activate", " exit-address-family", "clear ip bgp 2001:db8::151 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.14"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.14 next-hop-self", "clear ip bgp 192.0.2.14 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.107"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.107", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.107 next-hop-self", "clear ip bgp 192.0.2.107 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.207", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.207 next-hop-self", "clear ip bgp 192.0.2.207 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::158"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::158", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::158 activate", " exit-address-family", "clear ip bgp 2001:db8::158 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::114"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::114", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::114 activate", " exit-address-family", "clear ip bgp 2001:db8::114 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::178"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::178", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::178 activate", " exit-address-family", "clear ip bgp 2001:db8::178 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.245"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.245", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.245 next-hop-self", "clear ip bgp 10.0.0.245 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.48"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.48", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.48 next-hop-self", "clear ip bgp 10.0.0.48 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.134"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.134", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.134 next-hop-self", "clear ip bgp 10.0.0.134 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.45"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.45", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.45 next-hop-self", "clear ip bgp 192.0.2.45 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::5"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::5", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::5 activate", " exit-address-family", "clear ip bgp 2001:db8::5 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::175"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::175", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::175 activate", " exit-address-family", "clear ip bgp 2001:db8::175 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.233"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.233", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.233 next-hop-self", "clear ip bgp 192.0.2.233 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.213"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.213", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.213 next-hop-self", "clear ip bgp 192.0.2.213 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.126"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.126", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.126 next-hop-self", "clear ip bgp 192.0.2.126 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::179"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::179", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::179 activate", " exit-address-family", "clear ip bgp 2001:db8::179 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.166"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.166", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.166 next-hop-self", "clear ip bgp 10.0.0.166 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::50"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::50", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::50 activate", " exit-address-family", "clear ip bgp 2001:db8::50 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.70"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.70", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.70 next-hop-self", "clear ip bgp 10.0.0.70 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.245"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.245", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.245 next-hop-self", "clear ip bgp 10.0.0.245 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.102"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.102", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.102 next-hop-self", "clear ip bgp 10.0.0.102 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.239"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.239", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.239 next-hop-self", "clear ip bgp 10.0.0.239 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.196"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.196", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.196 next-hop-self", "clear ip bgp 192.0.2.196 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::156"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::156", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::156 activate", " exit-address-family", "clear ip bgp 2001:db8::156 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.54"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.54", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.54 next-hop-self", "clear ip bgp 10.0.0.54 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.244"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.244", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.244 next-hop-self", "clear ip bgp 10.0.0.244 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.254"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.254", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.254 next-hop-self", "clear ip bgp 192.0.2.254 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.158"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.158", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.158 next-hop-self", "clear ip bgp 10.0.0.158 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::97"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::97", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::97 activate", " exit-address-family", "clear ip bgp 2001:db8::97 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::16"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::16", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::16 activate", " exit-address-family", "clear ip bgp 2001:db8::16 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.233"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.233", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.233 next-hop-self", "clear ip bgp 192.0.2.233 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.158"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.158", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.158 next-hop-self", "clear ip bgp 10.0.0.158 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.91"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.91 next-hop-self", "clear ip bgp 192.0.2.91 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.253"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.253 next-hop-self", "clear ip bgp 192.0.2.253 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.169"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.169", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.169 next-hop-self", "clear ip bgp 10.0.0.169 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.166"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.166", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.166 next-hop-self", "clear ip bgp 192.0.2.166 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::108"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::108", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::108 activate", " exit-address-family", "clear ip bgp 2001:db8::108 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::179"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::179", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::179 activate", " exit-address-family", "clear ip bgp 2001:db8::179 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.114"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.114", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.114 next-hop-self", "clear ip bgp 10.0.0.114 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.35"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.35", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.35 next-hop-self", "clear ip bgp 10.0.0.35 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.103", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.103 next-hop-self", "clear ip bgp 192.0.2.103 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::194"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::194", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::194 activate", " exit-address-family", "clear ip bgp 2001:db8::194 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.2"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.2", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.2 next-hop-self", "clear ip bgp 192.0.2.2 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.29"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.29", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.29 next-hop-self", "clear ip bgp 10.0.0.29 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::198"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::198", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::198 activate", " exit-address-family", "clear ip bgp 2001:db8::198 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::31"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::31", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::31 activate", " exit-address-family", "clear ip bgp 2001:db8::31 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.230"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.230", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.230 next-hop-self", "clear ip bgp 10.0.0.230 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::65"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::65", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::65 activate", " exit-address-family", "clear ip bgp 2001:db8::65 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.245"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.245", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.245 next-hop-self", "clear ip bgp 10.0.0.245 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.192"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.192", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.192 next-hop-self", "clear ip bgp 192.0.2.192 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.251"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.251", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.251 next-hop-self", "clear ip bgp 10.0.0.251 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.89 next-hop-self", "clear ip bgp 192.0.2.89 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::18"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::18", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::18 activate", " exit-address-family", "clear ip bgp 2001:db8::18 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::94"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::94", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::94 activate", " exit-address-family", "clear ip bgp 2001:db8::94 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.147"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.147", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.147 next-hop-self", "clear ip bgp 10.0.0.147 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.180"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.180", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.180 next-hop-self", "clear ip bgp 192.0.2.180 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::92"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::92", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::92 activate", " exit-address-family", "clear ip bgp 2001:db8::92 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.18", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.18 next-hop-self", "clear ip bgp 192.0.2.18 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.9", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.9 next-hop-self", "clear ip bgp 192.0.2.9 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.175"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.175", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.175 next-hop-self", "clear ip bgp 10.0.0.175 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.143"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.143", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.143 next-hop-self", "clear ip bgp 192.0.2.143 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::120"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::120", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::120 activate", " exit-address-family", "clear ip bgp 2001:db8::120 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.82"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.82", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.82 next-hop-self", "clear ip bgp 192.0.2.82 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.52", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.52 next-hop-self", "clear ip bgp 192.0.2.52 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::83"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::83", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::83 activate", " exit-address-family", "clear ip bgp 2001:db8::83 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.125"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.125 next-hop-self", "clear ip bgp 192.0.2.125 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.190"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.190", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.190 next-hop-self", "clear ip bgp 10.0.0.190 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.219"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.219", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.219 next-hop-self", "clear ip bgp 10.0.0.219 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.140"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.140", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.140 next-hop-self", "clear ip bgp 10.0.0.140 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.243"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.243", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.243 next-hop-self", "clear ip bgp 10.0.0.243 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.176"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.176", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.176 next-hop-self", "clear ip bgp 192.0.2.176 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::134", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::134 activate", " exit-address-family", "clear ip bgp 2001:db8::134 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.34"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.34 next-hop-self", "clear ip bgp 192.0.2.34 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::181", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::181 activate", " exit-address-family", "clear ip bgp 2001:db8::181 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.198"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.198", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.198 next-hop-self", "clear ip bgp 192.0.2.198 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.225"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.225", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.225 next-hop-self", "clear ip bgp 10.0.0.225 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::121"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::121", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::121 activate", " exit-address-family", "clear ip bgp 2001:db8::121 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.41"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.41", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.41 next-hop-self", "clear ip bgp 192.0.2.41 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::75"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::75", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::75 activate", " exit-address-family", "clear ip bgp 2001:db8::75 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::47"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::47", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::47 activate", " exit-address-family", "clear ip bgp 2001:db8::47 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::66"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::66", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::66 activate", " exit-address-family", "clear ip bgp 2001:db8::66 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.85"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.85", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.85 next-hop-self", "clear ip bgp 10.0.0.85 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.148"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.148", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.148 next-hop-self", "clear ip bgp 192.0.2.148 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.151", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.151 next-hop-self", "clear ip bgp 192.0.2.151 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::136"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::136", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::136 activate", " exit-address-family", "clear ip bgp 2001:db8::136 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.243"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.243", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.243 next-hop-self", "clear ip bgp 10.0.0.243 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.2"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.2", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.2 next-hop-self", "clear ip bgp 192.0.2.2 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.33"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.33", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.33 next-hop-self", "clear ip bgp 10.0.0.33 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.18"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.18", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.18 next-hop-self", "clear ip bgp 10.0.0.18 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::140"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::140", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::140 activate", " exit-address-family", "clear ip bgp 2001:db8::140 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.137"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.137", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.137 next-hop-self", "clear ip bgp 10.0.0.137 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.16"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.16", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.16 next-hop-self", "clear ip bgp 10.0.0.16 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.194"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.194", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.194 next-hop-self", "clear ip bgp 10.0.0.194 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.201"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.201 next-hop-self", "clear ip bgp 192.0.2.201 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::140"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::140", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::140 activate", " exit-address-family", "clear ip bgp 2001:db8::140 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.114"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.114", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.114 next-hop-self", "clear ip bgp 10.0.0.114 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.182"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.182", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.182 next-hop-self", "clear ip bgp 10.0.0.182 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.57"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.57", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.57 next-hop-self", "clear ip bgp 192.0.2.57 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.107"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.107 next-hop-self", "clear ip bgp 192.0.2.107 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.94", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.94 next-hop-self", "clear ip bgp 192.0.2.94 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.83", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.83 next-hop-self", "clear ip bgp 192.0.2.83 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::81"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::81", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::81 activate", " exit-address-family", "clear ip bgp 2001:db8::81 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::102"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::102", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::102 activate", " exit-address-family", "clear ip bgp 2001:db8::102 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::117"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::117", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::117 activate", " exit-address-family", "clear ip bgp 2001:db8::117 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::114"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::114", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::114 activate", " exit-address-family", "clear ip bgp 2001:db8::114 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::175"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::175", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::175 activate", " exit-address-family", "clear ip bgp 2001:db8::175 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::30"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::30", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::30 activate", " exit-address-family", "clear ip bgp 2001:db8::30 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.122", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.122 next-hop-self", "clear ip bgp 192.0.2.122 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.67"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.67", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.67 next-hop-self", "clear ip bgp 10.0.0.67 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.46"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.46", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.46 next-hop-self", "clear ip bgp 192.0.2.46 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.31"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.31", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.31 next-hop-self", "clear ip bgp 192.0.2.31 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::147"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::147", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::147 activate", " exit-address-family", "clear ip bgp 2001:db8::147 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.223"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.223", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.223 next-hop-self", "clear ip bgp 192.0.2.223 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.238"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.238", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.238 next-hop-self", "clear ip bgp 10.0.0.238 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.182"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.182", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.182 next-hop-self", "clear ip bgp 192.0.2.182 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.143"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.143", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.143 next-hop-self", "clear ip bgp 10.0.0.143 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.181"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.181", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.181 next-hop-self", "clear ip bgp 10.0.0.181 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::134", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::134 activate", " exit-address-family", "clear ip bgp 2001:db8::134 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::150"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::150", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::150 activate", " exit-address-family", "clear ip bgp 2001:db8::150 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::65"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::65", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::65 activate", " exit-address-family", "clear ip bgp 2001:db8::65 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::96"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::96", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::96 activate", " exit-address-family", "clear ip bgp 2001:db8::96 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.70"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.70", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.70 next-hop-self", "clear ip bgp 192.0.2.70 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.157"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.157", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.157 next-hop-self", "clear ip bgp 192.0.2.157 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::180"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::180", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::180 activate", " exit-address-family", "clear ip bgp 2001:db8::180 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.40", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.40 next-hop-self", "clear ip bgp 192.0.2.40 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::176"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::176", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::176 activate", " exit-address-family", "clear ip bgp 2001:db8::176 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.177"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.177", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.177 next-hop-self", "clear ip bgp 192.0.2.177 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.157"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.157", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.157 next-hop-self", "clear ip bgp 10.0.0.157 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.38"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.38", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.38 next-hop-self", "clear ip bgp 10.0.0.38 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.231"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.231", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.231 next-hop-self", "clear ip bgp 10.0.0.231 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.184", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.184 next-hop-self", "clear ip bgp 192.0.2.184 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.52", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.52 next-hop-self", "clear ip bgp 192.0.2.52 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.72"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.72", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.72 next-hop-self", "clear ip bgp 10.0.0.72 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.31"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.31", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.31 next-hop-self", "clear ip bgp 10.0.0.31 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::52"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::52", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::52 activate", " exit-address-family", "clear ip bgp 2001:db8::52 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.193"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.193", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.193 next-hop-self", "clear ip bgp 192.0.2.193 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.24"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.24", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.24 next-hop-self", "clear ip bgp 10.0.0.24 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::133"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::133", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::133 activate", " exit-address-family", "clear ip bgp 2001:db8::133 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.65"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.65", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.65 next-hop-self", "clear ip bgp 10.0.0.65 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.192"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.192", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.192 next-hop-self", "clear ip bgp 192.0.2.192 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::107"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::107", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::107 activate", " exit-address-family", "clear ip bgp 2001:db8::107 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.213"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.213", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.213 next-hop-self", "clear ip bgp 10.0.0.213 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.201"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.201 next-hop-self", "clear ip bgp 192.0.2.201 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::82"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::82", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::82 activate", " exit-address-family", "clear ip bgp 2001:db8::82 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::68"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::68", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::68 activate", " exit-address-family", "clear ip bgp 2001:db8::68 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.38"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.38", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.38 next-hop-self", "clear ip bgp 10.0.0.38 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.35 next-hop-self", "clear ip bgp 192.0.2.35 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.45"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.45", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.45 next-hop-self", "clear ip bgp 10.0.0.45 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.130"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.130", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.130 next-hop-self", "clear ip bgp 10.0.0.130 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.204"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.204", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.204 next-hop-self", "clear ip bgp 10.0.0.204 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.120"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.120", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.120 next-hop-self", "clear ip bgp 10.0.0.120 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::144"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::144", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::144 activate", " exit-address-family", "clear ip bgp 2001:db8::144 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.45"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.45", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.45 next-hop-self", "clear ip bgp 10.0.0.45 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::27"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::27", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::27 activate", " exit-address-family", "clear ip bgp 2001:db8::27 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.25"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.25", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.25 next-hop-self", "clear ip bgp 10.0.0.25 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.138 next-hop-self", "clear ip bgp 192.0.2.138 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.112"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.112", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.112 next-hop-self", "clear ip bgp 192.0.2.112 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.18", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.18 next-hop-self", "clear ip bgp 192.0.2.18 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.249 next-hop-self", "clear ip bgp 192.0.2.249 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::151", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::151 activate", " exit-address-family", "clear ip bgp 2001:db8::151 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::143"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::143", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::143 activate", " exit-address-family", "clear ip bgp 2001:db8::143 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.175"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.175", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.175 next-hop-self", "clear ip bgp 192.0.2.175 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.153"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.153", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.153 next-hop-self", "clear ip bgp 10.0.0.153 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.165"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.165", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.165 next-hop-self", "clear ip bgp 192.0.2.165 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.70"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.70", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.70 next-hop-self", "clear ip bgp 192.0.2.70 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.201"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.201", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.201 next-hop-self", "clear ip bgp 192.0.2.201 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.104 next-hop-self", "clear ip bgp 192.0.2.104 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::138", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::138 activate", " exit-address-family", "clear ip bgp 2001:db8::138 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::119"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::119", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::119 activate", " exit-address-family", "clear ip bgp 2001:db8::119 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.254"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.254", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.254 next-hop-self", "clear ip bgp 10.0.0.254 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::199"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::199", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::199 activate", " exit-address-family", "clear ip bgp 2001:db8::199 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::62"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::62", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::62 activate", " exit-address-family", "clear ip bgp 2001:db8::62 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.89 next-hop-self", "clear ip bgp 192.0.2.89 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::153"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::153", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::153 activate", " exit-address-family", "clear ip bgp 2001:db8::153 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.20"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.20", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.20 next-hop-self", "clear ip bgp 10.0.0.20 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.142"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.142", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.142 next-hop-self", "clear ip bgp 10.0.0.142 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.37"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.37", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.37 next-hop-self", "clear ip bgp 10.0.0.37 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.117"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.117", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.117 next-hop-self", "clear ip bgp 192.0.2.117 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.59", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.88", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.88 next-hop-self", "clear ip bgp 192.0.2.88 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.128"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.128", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.128 next-hop-self", "clear ip bgp 10.0.0.128 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.64"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.64", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.64 next-hop-self", "clear ip bgp 10.0.0.64 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.192"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.192", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.192 next-hop-self", "clear ip bgp 192.0.2.192 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::75"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::75", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::75 activate", " exit-address-family", "clear ip bgp 2001:db8::75 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::156"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::156", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::156 activate", " exit-address-family", "clear ip bgp 2001:db8::156 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.171"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.171", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.171 next-hop-self", "clear ip bgp 10.0.0.171 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::88"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::88", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::88 activate", " exit-address-family", "clear ip bgp 2001:db8::88 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.222"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.222", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.222 next-hop-self", "clear ip bgp 10.0.0.222 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.182"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.182", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.182 next-hop-self", "clear ip bgp 10.0.0.182 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::27"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::27", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::27 activate", " exit-address-family", "clear ip bgp 2001:db8::27 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.164"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.164", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.164 next-hop-self", "clear ip bgp 10.0.0.164 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::118"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::118", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::118 activate", " exit-address-family", "clear ip bgp 2001:db8::118 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.227"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.227", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.227 next-hop-self", "clear ip bgp 10.0.0.227 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.149"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.149 next-hop-self", "clear ip bgp 192.0.2.149 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.20"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.20", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.20 next-hop-self", "clear ip bgp 10.0.0.20 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.83", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.83 next-hop-self", "clear ip bgp 192.0.2.83 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::97"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::97", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::97 activate", " exit-address-family", "clear ip bgp 2001:db8::97 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.90"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.90", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.90 next-hop-self", "clear ip bgp 192.0.2.90 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::182"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::182", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::182 activate", " exit-address-family", "clear ip bgp 2001:db8::182 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.18"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.18", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.18 next-hop-self", "clear ip bgp 192.0.2.18 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.66"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.66", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.66 next-hop-self", "clear ip bgp 192.0.2.66 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::192"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::192", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::192 activate", " exit-address-family", "clear ip bgp 2001:db8::192 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.128 next-hop-self", "clear ip bgp 192.0.2.128 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.160"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.160", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.160 next-hop-self", "clear ip bgp 192.0.2.160 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::87"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::87", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::87 activate", " exit-address-family", "clear ip bgp 2001:db8::87 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::148"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::148", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::148 activate", " exit-address-family", "clear ip bgp 2001:db8::148 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::35", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::35 activate", " exit-address-family", "clear ip bgp 2001:db8::35 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::127"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::127", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::127 activate", " exit-address-family", "clear ip bgp 2001:db8::127 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.200"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.200", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.200 next-hop-self", "clear ip bgp 192.0.2.200 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::176"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::176", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::176 activate", " exit-address-family", "clear ip bgp 2001:db8::176 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.53"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.53", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.53 next-hop-self", "clear ip bgp 192.0.2.53 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::50"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::50", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::50 activate", " exit-address-family", "clear ip bgp 2001:db8::50 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.107"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.107", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.107 next-hop-self", "clear ip bgp 192.0.2.107 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.212"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.212", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.212 next-hop-self", "clear ip bgp 192.0.2.212 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.21", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.21 next-hop-self", "clear ip bgp 192.0.2.21 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.191"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.191", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.191 next-hop-self", "clear ip bgp 192.0.2.191 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.215", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.215 next-hop-self", "clear ip bgp 192.0.2.215 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.242"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.242 next-hop-self", "clear ip bgp 192.0.2.242 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::141"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::141", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::141 activate", " exit-address-family", "clear ip bgp 2001:db8::141 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.120", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.120 next-hop-self", "clear ip bgp 192.0.2.120 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::123"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::123", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::123 activate", " exit-address-family", "clear ip bgp 2001:db8::123 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.80 next-hop-self", "clear ip bgp 192.0.2.80 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::67"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::67", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::67 activate", " exit-address-family", "clear ip bgp 2001:db8::67 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.84"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.84", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.84 next-hop-self", "clear ip bgp 192.0.2.84 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.250"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.250", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.250 next-hop-self", "clear ip bgp 192.0.2.250 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::64"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::64", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::64 activate", " exit-address-family", "clear ip bgp 2001:db8::64 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.241 next-hop-self", "clear ip bgp 192.0.2.241 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.58", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.58 next-hop-self", "clear ip bgp 192.0.2.58 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.187"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.187", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.187 next-hop-self", "clear ip bgp 10.0.0.187 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.195"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.195", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.195 next-hop-self", "clear ip bgp 10.0.0.195 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.243"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.243", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.243 next-hop-self", "clear ip bgp 10.0.0.243 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.204"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.204", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.204 next-hop-self", "clear ip bgp 10.0.0.204 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.150"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.150", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.150 next-hop-self", "clear ip bgp 192.0.2.150 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::55", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::55 activate", " exit-address-family", "clear ip bgp 2001:db8::55 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.40", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.40 next-hop-self", "clear ip bgp 192.0.2.40 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.62", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.62 next-hop-self", "clear ip bgp 192.0.2.62 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.139"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.139", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.139 next-hop-self", "clear ip bgp 192.0.2.139 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.25"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.25", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.25 next-hop-self", "clear ip bgp 192.0.2.25 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.152"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.152", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.152 next-hop-self", "clear ip bgp 10.0.0.152 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.45"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.45", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.45 next-hop-self", "clear ip bgp 192.0.2.45 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.43"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.43 next-hop-self", "clear ip bgp 192.0.2.43 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.228"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.228", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.228 next-hop-self", "clear ip bgp 10.0.0.228 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.146"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.146 next-hop-self", "clear ip bgp 192.0.2.146 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.123"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.123", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.123 next-hop-self", "clear ip bgp 10.0.0.123 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.162"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.162 next-hop-self", "clear ip bgp 192.0.2.162 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.253"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.253", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.253 next-hop-self", "clear ip bgp 10.0.0.253 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.6"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.6", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.6 next-hop-self", "clear ip bgp 10.0.0.6 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.215", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.215 next-hop-self", "clear ip bgp 192.0.2.215 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::81"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::81", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::81 activate", " exit-address-family", "clear ip bgp 2001:db8::81 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::155"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::155", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::155 activate", " exit-address-family", "clear ip bgp 2001:db8::155 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.165"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.165", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.165 next-hop-self", "clear ip bgp 10.0.0.165 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::138", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::138 activate", " exit-address-family", "clear ip bgp 2001:db8::138 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.83"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.83", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.83 next-hop-self", "clear ip bgp 10.0.0.83 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.49"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.49", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.49 next-hop-self", "clear ip bgp 192.0.2.49 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.45"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.45", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.45 next-hop-self", "clear ip bgp 10.0.0.45 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::169"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::169", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::169 activate", " exit-address-family", "clear ip bgp 2001:db8::169 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.58"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.58", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.58 next-hop-self", "clear ip bgp 10.0.0.58 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.8"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.8", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.8 next-hop-self", "clear ip bgp 10.0.0.8 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.123"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.123", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.123 next-hop-self", "clear ip bgp 192.0.2.123 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.1"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.1", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.1 next-hop-self", "clear ip bgp 192.0.2.1 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.123"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.123", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.123 next-hop-self", "clear ip bgp 10.0.0.123 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::175"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::175", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::175 activate", " exit-address-family", "clear ip bgp 2001:db8::175 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.218"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.218", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.218 next-hop-self", "clear ip bgp 10.0.0.218 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::159"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::159", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::159 activate", " exit-address-family", "clear ip bgp 2001:db8::159 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.165"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.165", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.165 next-hop-self", "clear ip bgp 10.0.0.165 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.6"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.6", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.6 next-hop-self", "clear ip bgp 10.0.0.6 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.186"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.186 next-hop-self", "clear ip bgp 192.0.2.186 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.236"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.236", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.236 next-hop-self", "clear ip bgp 192.0.2.236 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.97"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.97", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.97 next-hop-self", "clear ip bgp 10.0.0.97 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::90"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::90", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::90 activate", " exit-address-family", "clear ip bgp 2001:db8::90 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::130"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::130", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::130 activate", " exit-address-family", "clear ip bgp 2001:db8::130 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.115"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.115 next-hop-self", "clear ip bgp 192.0.2.115 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.55"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.55 next-hop-self", "clear ip bgp 192.0.2.55 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.14"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.14", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.14 next-hop-self", "clear ip bgp 192.0.2.14 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.218"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.218", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.218 next-hop-self", "clear ip bgp 192.0.2.218 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::10"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::10", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::10 activate", " exit-address-family", "clear ip bgp 2001:db8::10 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.154", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.154 next-hop-self", "clear ip bgp 192.0.2.154 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::151", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::151 activate", " exit-address-family", "clear ip bgp 2001:db8::151 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.152"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.152", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.152 next-hop-self", "clear ip bgp 192.0.2.152 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::123"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::123", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::123 activate", " exit-address-family", "clear ip bgp 2001:db8::123 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.77"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.77", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.77 next-hop-self", "clear ip bgp 10.0.0.77 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::16"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::16", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::16 activate", " exit-address-family", "clear ip bgp 2001:db8::16 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.228", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.228 next-hop-self", "clear ip bgp 192.0.2.228 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.215"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.215", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.215 next-hop-self", "clear ip bgp 10.0.0.215 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.126"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.126", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.126 next-hop-self", "clear ip bgp 10.0.0.126 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::110"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::110", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::110 activate", " exit-address-family", "clear ip bgp 2001:db8::110 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.39", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.39 next-hop-self", "clear ip bgp 192.0.2.39 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::47"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::47", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::47 activate", " exit-address-family", "clear ip bgp 2001:db8::47 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.21 next-hop-self", "clear ip bgp 192.0.2.21 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.43"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.43", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.43 next-hop-self", "clear ip bgp 10.0.0.43 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.3"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.3 next-hop-self", "clear ip bgp 192.0.2.3 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.41"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.41", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.41 next-hop-self", "clear ip bgp 192.0.2.41 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.179"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.179", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.179 next-hop-self", "clear ip bgp 10.0.0.179 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::90"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::90", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::90 activate", " exit-address-family", "clear ip bgp 2001:db8::90 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.25"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.25", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.25 next-hop-self", "clear ip bgp 10.0.0.25 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.25"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.25", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.25 next-hop-self", "clear ip bgp 10.0.0.25 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.43"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.43", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.43 next-hop-self", "clear ip bgp 192.0.2.43 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.209"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.209", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.209 next-hop-self", "clear ip bgp 10.0.0.209 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.58", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.58 next-hop-self", "clear ip bgp 192.0.2.58 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.32"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.32", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.32 next-hop-self", "clear ip bgp 192.0.2.32 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.11"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.11", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.11 next-hop-self", "clear ip bgp 192.0.2.11 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.8"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.8", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.8 next-hop-self", "clear ip bgp 10.0.0.8 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.187", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.187 next-hop-self", "clear ip bgp 192.0.2.187 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.245"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.245", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.245 next-hop-self", "clear ip bgp 10.0.0.245 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::129", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::129 activate", " exit-address-family", "clear ip bgp 2001:db8::129 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::88"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::88", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::88 activate", " exit-address-family", "clear ip bgp 2001:db8::88 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.85"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.85", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.85 next-hop-self", "clear ip bgp 10.0.0.85 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::110"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::110", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::110 activate", " exit-address-family", "clear ip bgp 2001:db8::110 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.115"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.115", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.115 next-hop-self", "clear ip bgp 192.0.2.115 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::113"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::113", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::113 activate", " exit-address-family", "clear ip bgp 2001:db8::113 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::92"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::92", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::92 activate", " exit-address-family", "clear ip bgp 2001:db8::92 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.98"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.98", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.98 next-hop-self", "clear ip bgp 192.0.2.98 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.106"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.106 next-hop-self", "clear ip bgp 192.0.2.106 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.166"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.166", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.166 next-hop-self", "clear ip bgp 10.0.0.166 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::136"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::136", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::136 activate", " exit-address-family", "clear ip bgp 2001:db8::136 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.134"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.134", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.134 next-hop-self", "clear ip bgp 192.0.2.134 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.235"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.235", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.235 next-hop-self", "clear ip bgp 192.0.2.235 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.62"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.62", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.62 next-hop-self", "clear ip bgp 10.0.0.62 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::57"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::57", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::57 activate", " exit-address-family", "clear ip bgp 2001:db8::57 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.50 next-hop-self", "clear ip bgp 192.0.2.50 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.222"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.222", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.222 next-hop-self", "clear ip bgp 192.0.2.222 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.62", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.62 next-hop-self", "clear ip bgp 192.0.2.62 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::84"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::84", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::84 activate", " exit-address-family", "clear ip bgp 2001:db8::84 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.211 next-hop-self", "clear ip bgp 192.0.2.211 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::92"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::92", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::92 activate", " exit-address-family", "clear ip bgp 2001:db8::92 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.36"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.36", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.36 next-hop-self", "clear ip bgp 10.0.0.36 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::31"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::31", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::31 activate", " exit-address-family", "clear ip bgp 2001:db8::31 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.149"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.149", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.149 next-hop-self", "clear ip bgp 10.0.0.149 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.207 next-hop-self", "clear ip bgp 192.0.2.207 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::15"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::15", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::15 activate", " exit-address-family", "clear ip bgp 2001:db8::15 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.74"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.74", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.74 next-hop-self", "clear ip bgp 10.0.0.74 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.231"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.231", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.231 next-hop-self", "clear ip bgp 10.0.0.231 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.227"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.227", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.227 next-hop-self", "clear ip bgp 192.0.2.227 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::51"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::51", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::51 activate", " exit-address-family", "clear ip bgp 2001:db8::51 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::122", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::122 activate", " exit-address-family", "clear ip bgp 2001:db8::122 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.241"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.241", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.241 next-hop-self", "clear ip bgp 10.0.0.241 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.22"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.22", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.22 next-hop-self", "clear ip bgp 10.0.0.22 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.26"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.26", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.26 next-hop-self", "clear ip bgp 192.0.2.26 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::169"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::169", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::169 activate", " exit-address-family", "clear ip bgp 2001:db8::169 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.99"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.99", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.99 next-hop-self", "clear ip bgp 10.0.0.99 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.211", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.211 next-hop-self", "clear ip bgp 192.0.2.211 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.239"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.239", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.239 next-hop-self", "clear ip bgp 192.0.2.239 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.242"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.242", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.242 next-hop-self", "clear ip bgp 10.0.0.242 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::157"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::157", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::157 activate", " exit-address-family", "clear ip bgp 2001:db8::157 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::151"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::151", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::151 activate", " exit-address-family", "clear ip bgp 2001:db8::151 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.87", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.87 next-hop-self", "clear ip bgp 192.0.2.87 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::171"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::171", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::171 activate", " exit-address-family", "clear ip bgp 2001:db8::171 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.202"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.202", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.202 next-hop-self", "clear ip bgp 10.0.0.202 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.80"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.80 next-hop-self", "clear ip bgp 192.0.2.80 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.42 next-hop-self", "clear ip bgp 192.0.2.42 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.135"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.135", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.135 next-hop-self", "clear ip bgp 10.0.0.135 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.79"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.79", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.79 next-hop-self", "clear ip bgp 10.0.0.79 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::80"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::80", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::80 activate", " exit-address-family", "clear ip bgp 2001:db8::80 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.147"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.147", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.147 next-hop-self", "clear ip bgp 192.0.2.147 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::104"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::104", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::104 activate", " exit-address-family", "clear ip bgp 2001:db8::104 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.108", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.108 next-hop-self", "clear ip bgp 192.0.2.108 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.133"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.133", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.133 next-hop-self", "clear ip bgp 10.0.0.133 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.24"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.24", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.24 next-hop-self", "clear ip bgp 10.0.0.24 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.200"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.200", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.200 next-hop-self", "clear ip bgp 10.0.0.200 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.109"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.109", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.109 next-hop-self", "clear ip bgp 10.0.0.109 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.120 next-hop-self", "clear ip bgp 192.0.2.120 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.71"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.71", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.71 next-hop-self", "clear ip bgp 192.0.2.71 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::199"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::199", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::199 activate", " exit-address-family", "clear ip bgp 2001:db8::199 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.20"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.20", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.20 next-hop-self", "clear ip bgp 10.0.0.20 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.117"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.117", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.117 next-hop-self", "clear ip bgp 10.0.0.117 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::23"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::23", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::23 activate", " exit-address-family", "clear ip bgp 2001:db8::23 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::189"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::189", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::189 activate", " exit-address-family", "clear ip bgp 2001:db8::189 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.251"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.251", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.251 next-hop-self", "clear ip bgp 10.0.0.251 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.134"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.134", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.134 next-hop-self", "clear ip bgp 192.0.2.134 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::10"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::10", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::10 activate", " exit-address-family", "clear ip bgp 2001:db8::10 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.59", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::107"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::107", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::107 activate", " exit-address-family", "clear ip bgp 2001:db8::107 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.12"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.12", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.12 next-hop-self", "clear ip bgp 10.0.0.12 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.139"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.139", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.139 next-hop-self", "clear ip bgp 10.0.0.139 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.232 next-hop-self", "clear ip bgp 192.0.2.232 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.245", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.245 next-hop-self", "clear ip bgp 192.0.2.245 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.44"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.44", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.44 next-hop-self", "clear ip bgp 192.0.2.44 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.10"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.10", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.10 next-hop-self", "clear ip bgp 10.0.0.10 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.216"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.216", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.216 next-hop-self", "clear ip bgp 10.0.0.216 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::162"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::162", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::162 activate", " exit-address-family", "clear ip bgp 2001:db8::162 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.4"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.4 next-hop-self", "clear ip bgp 192.0.2.4 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::75"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::75", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::75 activate", " exit-address-family", "clear ip bgp 2001:db8::75 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.28"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.28", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.28 next-hop-self", "clear ip bgp 192.0.2.28 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.244", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.244 next-hop-self", "clear ip bgp 192.0.2.244 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.246 next-hop-self", "clear ip bgp 192.0.2.246 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::49"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::49", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::49 activate", " exit-address-family", "clear ip bgp 2001:db8::49 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.191"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.191", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.191 next-hop-self", "clear ip bgp 10.0.0.191 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.176"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.176", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.176 next-hop-self", "clear ip bgp 192.0.2.176 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::29"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::29", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::29 activate", " exit-address-family", "clear ip bgp 2001:db8::29 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::121"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::121", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::121 activate", " exit-address-family", "clear ip bgp 2001:db8::121 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::84"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::84", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::84 activate", " exit-address-family", "clear ip bgp 2001:db8::84 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.155"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.155", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.155 next-hop-self", "clear ip bgp 192.0.2.155 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.35 next-hop-self", "clear ip bgp 192.0.2.35 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.109", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.109 next-hop-self", "clear ip bgp 192.0.2.109 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.42 next-hop-self", "clear ip bgp 192.0.2.42 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.27"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.27", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.27 next-hop-self", "clear ip bgp 10.0.0.27 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.49"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.49", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.49 next-hop-self", "clear ip bgp 10.0.0.49 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.172"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.172", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.172 next-hop-self", "clear ip bgp 10.0.0.172 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::124"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::124", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::124 activate", " exit-address-family", "clear ip bgp 2001:db8::124 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.239"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.239", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.239 next-hop-self", "clear ip bgp 10.0.0.239 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.153"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.153", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.153 next-hop-self", "clear ip bgp 192.0.2.153 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::37"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::37", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::37 activate", " exit-address-family", "clear ip bgp 2001:db8::37 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.127"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.127", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.127 next-hop-self", "clear ip bgp 10.0.0.127 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::65"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::65", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::65 activate", " exit-address-family", "clear ip bgp 2001:db8::65 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::99"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::99", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::99 activate", " exit-address-family", "clear ip bgp 2001:db8::99 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::169"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::169", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::169 activate", " exit-address-family", "clear ip bgp 2001:db8::169 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.245"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.245", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.245 next-hop-self", "clear ip bgp 10.0.0.245 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::108"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::108", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::108 activate", " exit-address-family", "clear ip bgp 2001:db8::108 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::92"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::92", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::92 activate", " exit-address-family", "clear ip bgp 2001:db8::92 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::20"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::20", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::20 activate", " exit-address-family", "clear ip bgp 2001:db8::20 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::124"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::124", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::124 activate", " exit-address-family", "clear ip bgp 2001:db8::124 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::180"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::180", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::180 activate", " exit-address-family", "clear ip bgp 2001:db8::180 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.215", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.215 next-hop-self", "clear ip bgp 192.0.2.215 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::146"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::146", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::146 activate", " exit-address-family", "clear ip bgp 2001:db8::146 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.254"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.254", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.254 next-hop-self", "clear ip bgp 192.0.2.254 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.53"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.53", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.53 next-hop-self", "clear ip bgp 10.0.0.53 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.229"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.229", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.229 next-hop-self", "clear ip bgp 10.0.0.229 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.227"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.227", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.227 next-hop-self", "clear ip bgp 192.0.2.227 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.194"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.194", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.194 next-hop-self", "clear ip bgp 192.0.2.194 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::112"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::112", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::112 activate", " exit-address-family", "clear ip bgp 2001:db8::112 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.237"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.237", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.237 next-hop-self", "clear ip bgp 10.0.0.237 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.125"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.125 next-hop-self", "clear ip bgp 192.0.2.125 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::7"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::7", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::7 activate", " exit-address-family", "clear ip bgp 2001:db8::7 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.109"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.109 next-hop-self", "clear ip bgp 192.0.2.109 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.220"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "10.0.0.220", "ibgp": true}], "cli_fix": ["router bgp 65002", "neighbor 10.0.0.220 next-hop-self", "clear ip bgp 10.0.0.220 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.180"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.180", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.180 next-hop-self", "clear ip bgp 10.0.0.180 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.252"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.252", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.252 next-hop-self", "clear ip bgp 10.0.0.252 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::80"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::80", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::80 activate", " exit-address-family", "clear ip bgp 2001:db8::80 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.149"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.149 next-hop-self", "clear ip bgp 192.0.2.149 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.55"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.55 next-hop-self", "clear ip bgp 192.0.2.55 soft out"]}
+{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["For next-hop self issues, ALWAYS configure neighbor next-hop-self", "Followed by a soft outbound reset", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "10.0.0.230"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "10.0.0.230", "ibgp": true}], "cli_fix": ["router bgp 65001", "neighbor 10.0.0.230 next-hop-self", "clear ip bgp 10.0.0.230 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::28"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::28", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::28 activate", " exit-address-family", "clear ip bgp 2001:db8::28 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.197 next-hop-self", "clear ip bgp 192.0.2.197 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.134"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.134", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.134 next-hop-self", "clear ip bgp 192.0.2.134 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::122", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::122 activate", " exit-address-family", "clear ip bgp 2001:db8::122 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.63", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.63 next-hop-self", "clear ip bgp 192.0.2.63 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::78"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::78", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::78 activate", " exit-address-family", "clear ip bgp 2001:db8::78 soft out"]}
+{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["If a BGP route is missing from RIB, you MUST resolve next-hop reachability", "Clearing BGP alone is NOT sufficient", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.230", "rib_failure": "next-hop unreachable"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.230 next-hop-self", "clear ip bgp 192.0.2.230 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::77"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::77", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::77 activate", " exit-address-family", "clear ip bgp 2001:db8::77 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::88"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "2001:db8::88", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", " neighbor 2001:db8::88 activate", " exit-address-family", "clear ip bgp 2001:db8::88 soft out"]}
+{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP AFI/SAFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Neighbor activation MUST be inside address-family", "NEVER activate neighbor outside address-family", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "2001:db8::199"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "2001:db8::199", "afi": "ipv6", "safi": "unicast"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", " neighbor 2001:db8::199 activate", " exit-address-family", "clear ip bgp 2001:db8::199 soft out"]}