diff --git "a/datasets/network_context_4000.jsonl" "b/datasets/network_context_4000.jsonl"
new file mode 100644--- /dev/null
+++ "b/datasets/network_context_4000.jsonl"
@@ -0,0 +1,2000 @@
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.231.33.11 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.231.33.0.0.0.255 area 0\naccess-list 147 permit ip 192.168.221.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.231.33.11/24 (down)", "Routing: OSPF enabled on 10.231.33.0/24 area 0", "ACL 147: permit traffic from 192.168.221.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.231.33.11/24 is down, and ACL 147 permits traffic from 192.168.221.114."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.213.156.29 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.213.156.0.0.0.255 area 0\naccess-list 167 permit ip 192.168.216.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.213.156.29/24 (up)", "Routing: OSPF enabled on 10.213.156.0/24 area 0", "ACL 167: permit traffic from 192.168.216.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.213.156.29/24 is up, and ACL 167 permits traffic from 192.168.216.234."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.202.35.105 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.202.35.10.0.0.255 area 0\naccess-list 103 permit ip 192.168.220.205 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.202.35.105/24 (up)", "Routing: OSPF enabled on 10.202.35.10/24 area 0", "ACL 103: permit traffic from 192.168.220.205"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.202.35.105/24 is up, and ACL 103 permits traffic from 192.168.220.205."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.50.138.243 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.50.138.20.0.0.255 area 0\naccess-list 147 deny ip 192.168.198.231 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.50.138.243/24 (down)", "Routing: OSPF enabled on 10.50.138.20/24 area 0", "ACL 147: deny traffic from 192.168.198.231"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.50.138.243/24 is down, and ACL 147 denys traffic from 192.168.198.231."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.12.213.72 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.12.213.0.0.0.255 area 0\naccess-list 196 deny ip 192.168.197.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.12.213.72/24 (up)", "Routing: OSPF enabled on 10.12.213.0/24 area 0", "ACL 196: deny traffic from 192.168.197.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.12.213.72/24 is up, and ACL 196 denys traffic from 192.168.197.230."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.130.140.23 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.130.140.0.0.0.255 area 0\naccess-list 150 permit ip 192.168.229.42 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.130.140.23/24 (up)", "Routing: OSPF enabled on 10.130.140.0/24 area 0", "ACL 150: permit traffic from 192.168.229.42"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.130.140.23/24 is up, and ACL 150 permits traffic from 192.168.229.42."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.11.63.175 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.11.63.10.0.0.255 area 0\naccess-list 155 deny ip 192.168.63.34 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.11.63.175/24 (down)", "Routing: OSPF enabled on 10.11.63.10/24 area 0", "ACL 155: deny traffic from 192.168.63.34"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.11.63.175/24 is down, and ACL 155 denys traffic from 192.168.63.34."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.143.45.10 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.143.45.0.0.0.255 area 0\naccess-list 163 permit ip 192.168.15.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.143.45.10/24 (up)", "Routing: OSPF enabled on 10.143.45.0/24 area 0", "ACL 163: permit traffic from 192.168.15.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.143.45.10/24 is up, and ACL 163 permits traffic from 192.168.15.154."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.211.67.145 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.211.67.10.0.0.255 area 0\naccess-list 100 deny ip 192.168.109.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.211.67.145/24 (up)", "Routing: OSPF enabled on 10.211.67.10/24 area 0", "ACL 100: deny traffic from 192.168.109.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.211.67.145/24 is up, and ACL 100 denys traffic from 192.168.109.120."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.103.135.244 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.103.135.20.0.0.255 area 0\naccess-list 193 permit ip 192.168.12.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.103.135.244/24 (up)", "Routing: OSPF enabled on 10.103.135.20/24 area 0", "ACL 193: permit traffic from 192.168.12.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.103.135.244/24 is up, and ACL 193 permits traffic from 192.168.12.113."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.165.44.167 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.165.44.10.0.0.255 area 0\naccess-list 138 deny ip 192.168.84.7 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.165.44.167/24 (up)", "Routing: OSPF enabled on 10.165.44.10/24 area 0", "ACL 138: deny traffic from 192.168.84.7"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.165.44.167/24 is up, and ACL 138 denys traffic from 192.168.84.7."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.93.190.27 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.93.190.0.0.0.255 area 0\naccess-list 144 permit ip 192.168.107.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.93.190.27/24 (down)", "Routing: OSPF enabled on 10.93.190.0/24 area 0", "ACL 144: permit traffic from 192.168.107.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.93.190.27/24 is down, and ACL 144 permits traffic from 192.168.107.69."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.139.136.142 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.139.136.10.0.0.255 area 0\naccess-list 142 deny ip 192.168.215.21 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.139.136.142/24 (up)", "Routing: OSPF enabled on 10.139.136.10/24 area 0", "ACL 142: deny traffic from 192.168.215.21"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.139.136.142/24 is up, and ACL 142 denys traffic from 192.168.215.21."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.215.48.153 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.215.48.10.0.0.255 area 0\naccess-list 179 permit ip 192.168.230.125 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.215.48.153/24 (up)", "Routing: OSPF enabled on 10.215.48.10/24 area 0", "ACL 179: permit traffic from 192.168.230.125"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.215.48.153/24 is up, and ACL 179 permits traffic from 192.168.230.125."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.96.122.16 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.96.122.0.0.0.255 area 0\naccess-list 194 deny ip 192.168.175.97 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.96.122.16/24 (down)", "Routing: OSPF enabled on 10.96.122.0/24 area 0", "ACL 194: deny traffic from 192.168.175.97"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.96.122.16/24 is down, and ACL 194 denys traffic from 192.168.175.97."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.83.240.126 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.83.240.10.0.0.255 area 0\naccess-list 114 permit ip 192.168.173.147 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.83.240.126/24 (up)", "Routing: OSPF enabled on 10.83.240.10/24 area 0", "ACL 114: permit traffic from 192.168.173.147"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.83.240.126/24 is up, and ACL 114 permits traffic from 192.168.173.147."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.0.78.33 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.0.78.0.0.0.255 area 0\naccess-list 171 deny ip 192.168.21.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.0.78.33/24 (down)", "Routing: OSPF enabled on 10.0.78.0/24 area 0", "ACL 171: deny traffic from 192.168.21.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.0.78.33/24 is down, and ACL 171 denys traffic from 192.168.21.220."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.179.110.36 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.179.110.0.0.0.255 area 0\naccess-list 119 permit ip 192.168.205.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.179.110.36/24 (down)", "Routing: OSPF enabled on 10.179.110.0/24 area 0", "ACL 119: permit traffic from 192.168.205.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.179.110.36/24 is down, and ACL 119 permits traffic from 192.168.205.233."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.239.50.10 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.239.50.0.0.0.255 area 0\naccess-list 144 deny ip 192.168.128.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.239.50.10/24 (up)", "Routing: OSPF enabled on 10.239.50.0/24 area 0", "ACL 144: deny traffic from 192.168.128.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.239.50.10/24 is up, and ACL 144 denys traffic from 192.168.128.25."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.101.50.245 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.101.50.20.0.0.255 area 0\naccess-list 109 deny ip 192.168.240.22 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.101.50.245/24 (up)", "Routing: OSPF enabled on 10.101.50.20/24 area 0", "ACL 109: deny traffic from 192.168.240.22"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.101.50.245/24 is up, and ACL 109 denys traffic from 192.168.240.22."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.90.170.21 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.90.170.0.0.0.255 area 0\naccess-list 110 permit ip 192.168.240.252 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.90.170.21/24 (up)", "Routing: OSPF enabled on 10.90.170.0/24 area 0", "ACL 110: permit traffic from 192.168.240.252"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.90.170.21/24 is up, and ACL 110 permits traffic from 192.168.240.252."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.17.56.150 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.17.56.10.0.0.255 area 0\naccess-list 163 deny ip 192.168.24.253 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.17.56.150/24 (down)", "Routing: OSPF enabled on 10.17.56.10/24 area 0", "ACL 163: deny traffic from 192.168.24.253"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.17.56.150/24 is down, and ACL 163 denys traffic from 192.168.24.253."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.78.156.28 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.78.156.0.0.0.255 area 0\naccess-list 123 permit ip 192.168.0.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.78.156.28/24 (up)", "Routing: OSPF enabled on 10.78.156.0/24 area 0", "ACL 123: permit traffic from 192.168.0.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.78.156.28/24 is up, and ACL 123 permits traffic from 192.168.0.77."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.27.29.228 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.27.29.20.0.0.255 area 0\naccess-list 163 permit ip 192.168.183.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.27.29.228/24 (up)", "Routing: OSPF enabled on 10.27.29.20/24 area 0", "ACL 163: permit traffic from 192.168.183.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.27.29.228/24 is up, and ACL 163 permits traffic from 192.168.183.95."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.12.194.75 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.12.194.0.0.0.255 area 0\naccess-list 160 deny ip 192.168.200.167 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.12.194.75/24 (up)", "Routing: OSPF enabled on 10.12.194.0/24 area 0", "ACL 160: deny traffic from 192.168.200.167"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.12.194.75/24 is up, and ACL 160 denys traffic from 192.168.200.167."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.59.100.192 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.59.100.10.0.0.255 area 0\naccess-list 107 permit ip 192.168.96.34 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.59.100.192/24 (down)", "Routing: OSPF enabled on 10.59.100.10/24 area 0", "ACL 107: permit traffic from 192.168.96.34"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.59.100.192/24 is down, and ACL 107 permits traffic from 192.168.96.34."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.38.192.204 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.38.192.20.0.0.255 area 0\naccess-list 177 permit ip 192.168.48.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.38.192.204/24 (down)", "Routing: OSPF enabled on 10.38.192.20/24 area 0", "ACL 177: permit traffic from 192.168.48.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.38.192.204/24 is down, and ACL 177 permits traffic from 192.168.48.85."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.206.164.96 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.206.164.0.0.0.255 area 0\naccess-list 112 deny ip 192.168.68.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.206.164.96/24 (down)", "Routing: OSPF enabled on 10.206.164.0/24 area 0", "ACL 112: deny traffic from 192.168.68.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.206.164.96/24 is down, and ACL 112 denys traffic from 192.168.68.9."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.151.33.186 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.151.33.10.0.0.255 area 0\naccess-list 134 permit ip 192.168.158.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.151.33.186/24 (up)", "Routing: OSPF enabled on 10.151.33.10/24 area 0", "ACL 134: permit traffic from 192.168.158.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.151.33.186/24 is up, and ACL 134 permits traffic from 192.168.158.85."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.28.48.34 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.28.48.0.0.0.255 area 0\naccess-list 158 permit ip 192.168.64.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.28.48.34/24 (up)", "Routing: OSPF enabled on 10.28.48.0/24 area 0", "ACL 158: permit traffic from 192.168.64.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.28.48.34/24 is up, and ACL 158 permits traffic from 192.168.64.11."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.12.135.110 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.12.135.10.0.0.255 area 0\naccess-list 103 permit ip 192.168.134.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.12.135.110/24 (up)", "Routing: OSPF enabled on 10.12.135.10/24 area 0", "ACL 103: permit traffic from 192.168.134.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.12.135.110/24 is up, and ACL 103 permits traffic from 192.168.134.193."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.140.12.92 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.140.12.0.0.0.255 area 0\naccess-list 138 deny ip 192.168.78.90 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.140.12.92/24 (down)", "Routing: OSPF enabled on 10.140.12.0/24 area 0", "ACL 138: deny traffic from 192.168.78.90"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.140.12.92/24 is down, and ACL 138 denys traffic from 192.168.78.90."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.200.75.187 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.200.75.10.0.0.255 area 0\naccess-list 117 permit ip 192.168.150.197 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.200.75.187/24 (up)", "Routing: OSPF enabled on 10.200.75.10/24 area 0", "ACL 117: permit traffic from 192.168.150.197"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.200.75.187/24 is up, and ACL 117 permits traffic from 192.168.150.197."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.1.0.248 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.1.0.20.0.0.255 area 0\naccess-list 178 permit ip 192.168.66.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.1.0.248/24 (up)", "Routing: OSPF enabled on 10.1.0.20/24 area 0", "ACL 178: permit traffic from 192.168.66.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.1.0.248/24 is up, and ACL 178 permits traffic from 192.168.66.146."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.249.176.155 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.249.176.10.0.0.255 area 0\naccess-list 145 permit ip 192.168.102.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.249.176.155/24 (up)", "Routing: OSPF enabled on 10.249.176.10/24 area 0", "ACL 145: permit traffic from 192.168.102.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.249.176.155/24 is up, and ACL 145 permits traffic from 192.168.102.37."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.186.89.178 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.186.89.10.0.0.255 area 0\naccess-list 173 permit ip 192.168.211.30 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.186.89.178/24 (down)", "Routing: OSPF enabled on 10.186.89.10/24 area 0", "ACL 173: permit traffic from 192.168.211.30"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.186.89.178/24 is down, and ACL 173 permits traffic from 192.168.211.30."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.131.157.1 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.131.1570.0.0.255 area 0\naccess-list 161 deny ip 192.168.246.174 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.131.157.1/24 (up)", "Routing: OSPF enabled on 10.131.1570/24 area 0", "ACL 161: deny traffic from 192.168.246.174"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.131.157.1/24 is up, and ACL 161 denys traffic from 192.168.246.174."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.90.113.172 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.90.113.10.0.0.255 area 0\naccess-list 123 deny ip 192.168.78.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.90.113.172/24 (down)", "Routing: OSPF enabled on 10.90.113.10/24 area 0", "ACL 123: deny traffic from 192.168.78.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.90.113.172/24 is down, and ACL 123 denys traffic from 192.168.78.95."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.10.198.26 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.10.198.0.0.0.255 area 0\naccess-list 158 permit ip 192.168.170.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.10.198.26/24 (down)", "Routing: OSPF enabled on 10.10.198.0/24 area 0", "ACL 158: permit traffic from 192.168.170.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.10.198.26/24 is down, and ACL 158 permits traffic from 192.168.170.20."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.7.12.123 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.7.12.10.0.0.255 area 0\naccess-list 166 deny ip 192.168.108.178 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.7.12.123/24 (up)", "Routing: OSPF enabled on 10.7.12.10/24 area 0", "ACL 166: deny traffic from 192.168.108.178"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.7.12.123/24 is up, and ACL 166 denys traffic from 192.168.108.178."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.53.43.223 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.53.43.20.0.0.255 area 0\naccess-list 167 permit ip 192.168.77.210 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.53.43.223/24 (down)", "Routing: OSPF enabled on 10.53.43.20/24 area 0", "ACL 167: permit traffic from 192.168.77.210"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.53.43.223/24 is down, and ACL 167 permits traffic from 192.168.77.210."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.214.244.128 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.214.244.10.0.0.255 area 0\naccess-list 109 permit ip 192.168.33.51 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.214.244.128/24 (up)", "Routing: OSPF enabled on 10.214.244.10/24 area 0", "ACL 109: permit traffic from 192.168.33.51"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.214.244.128/24 is up, and ACL 109 permits traffic from 192.168.33.51."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.171.50.173 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.171.50.10.0.0.255 area 0\naccess-list 149 permit ip 192.168.33.189 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.171.50.173/24 (down)", "Routing: OSPF enabled on 10.171.50.10/24 area 0", "ACL 149: permit traffic from 192.168.33.189"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.171.50.173/24 is down, and ACL 149 permits traffic from 192.168.33.189."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.212.160.228 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.212.160.20.0.0.255 area 0\naccess-list 163 permit ip 192.168.206.197 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.212.160.228/24 (up)", "Routing: OSPF enabled on 10.212.160.20/24 area 0", "ACL 163: permit traffic from 192.168.206.197"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.212.160.228/24 is up, and ACL 163 permits traffic from 192.168.206.197."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.93.67.77 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.93.67.0.0.0.255 area 0\naccess-list 106 deny ip 192.168.51.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.93.67.77/24 (up)", "Routing: OSPF enabled on 10.93.67.0/24 area 0", "ACL 106: deny traffic from 192.168.51.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.93.67.77/24 is up, and ACL 106 denys traffic from 192.168.51.120."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.101.55.186 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.101.55.10.0.0.255 area 0\naccess-list 178 deny ip 192.168.119.73 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.101.55.186/24 (up)", "Routing: OSPF enabled on 10.101.55.10/24 area 0", "ACL 178: deny traffic from 192.168.119.73"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.101.55.186/24 is up, and ACL 178 denys traffic from 192.168.119.73."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.162.17.22 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.162.17.0.0.0.255 area 0\naccess-list 104 deny ip 192.168.170.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.162.17.22/24 (down)", "Routing: OSPF enabled on 10.162.17.0/24 area 0", "ACL 104: deny traffic from 192.168.170.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.162.17.22/24 is down, and ACL 104 denys traffic from 192.168.170.204."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.50.31.236 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.50.31.20.0.0.255 area 0\naccess-list 177 permit ip 192.168.74.198 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.50.31.236/24 (down)", "Routing: OSPF enabled on 10.50.31.20/24 area 0", "ACL 177: permit traffic from 192.168.74.198"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.50.31.236/24 is down, and ACL 177 permits traffic from 192.168.74.198."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.64.119.223 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.64.119.20.0.0.255 area 0\naccess-list 131 deny ip 192.168.31.124 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.64.119.223/24 (down)", "Routing: OSPF enabled on 10.64.119.20/24 area 0", "ACL 131: deny traffic from 192.168.31.124"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.64.119.223/24 is down, and ACL 131 denys traffic from 192.168.31.124."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.132.211.147 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.132.211.10.0.0.255 area 0\naccess-list 109 deny ip 192.168.4.89 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.132.211.147/24 (up)", "Routing: OSPF enabled on 10.132.211.10/24 area 0", "ACL 109: deny traffic from 192.168.4.89"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.132.211.147/24 is up, and ACL 109 denys traffic from 192.168.4.89."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.136.74.92 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.136.74.0.0.0.255 area 0\naccess-list 181 permit ip 192.168.164.213 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.136.74.92/24 (down)", "Routing: OSPF enabled on 10.136.74.0/24 area 0", "ACL 181: permit traffic from 192.168.164.213"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.136.74.92/24 is down, and ACL 181 permits traffic from 192.168.164.213."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.234.102.47 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.234.102.0.0.0.255 area 0\naccess-list 168 permit ip 192.168.1.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.234.102.47/24 (down)", "Routing: OSPF enabled on 10.234.102.0/24 area 0", "ACL 168: permit traffic from 192.168.1.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.234.102.47/24 is down, and ACL 168 permits traffic from 192.168.1.242."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.12.76.71 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.12.76.0.0.0.255 area 0\naccess-list 188 deny ip 192.168.82.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.12.76.71/24 (up)", "Routing: OSPF enabled on 10.12.76.0/24 area 0", "ACL 188: deny traffic from 192.168.82.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.12.76.71/24 is up, and ACL 188 denys traffic from 192.168.82.148."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.131.191.44 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.131.191.0.0.0.255 area 0\naccess-list 101 deny ip 192.168.254.89 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.131.191.44/24 (down)", "Routing: OSPF enabled on 10.131.191.0/24 area 0", "ACL 101: deny traffic from 192.168.254.89"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.131.191.44/24 is down, and ACL 101 denys traffic from 192.168.254.89."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.205.248.238 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.205.248.20.0.0.255 area 0\naccess-list 121 permit ip 192.168.185.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.205.248.238/24 (up)", "Routing: OSPF enabled on 10.205.248.20/24 area 0", "ACL 121: permit traffic from 192.168.185.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.205.248.238/24 is up, and ACL 121 permits traffic from 192.168.185.157."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.203.215.177 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.203.215.10.0.0.255 area 0\naccess-list 198 permit ip 192.168.10.216 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.203.215.177/24 (down)", "Routing: OSPF enabled on 10.203.215.10/24 area 0", "ACL 198: permit traffic from 192.168.10.216"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.203.215.177/24 is down, and ACL 198 permits traffic from 192.168.10.216."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.205.108.193 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.205.108.10.0.0.255 area 0\naccess-list 139 permit ip 192.168.126.44 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.205.108.193/24 (down)", "Routing: OSPF enabled on 10.205.108.10/24 area 0", "ACL 139: permit traffic from 192.168.126.44"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.205.108.193/24 is down, and ACL 139 permits traffic from 192.168.126.44."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.176.173.142 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.176.173.10.0.0.255 area 0\naccess-list 190 deny ip 192.168.28.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.176.173.142/24 (down)", "Routing: OSPF enabled on 10.176.173.10/24 area 0", "ACL 190: deny traffic from 192.168.28.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.176.173.142/24 is down, and ACL 190 denys traffic from 192.168.28.199."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.173.34.167 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.173.34.10.0.0.255 area 0\naccess-list 186 deny ip 192.168.136.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.173.34.167/24 (up)", "Routing: OSPF enabled on 10.173.34.10/24 area 0", "ACL 186: deny traffic from 192.168.136.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.173.34.167/24 is up, and ACL 186 denys traffic from 192.168.136.208."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.227.83.54 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.227.83.0.0.0.255 area 0\naccess-list 168 deny ip 192.168.190.147 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.227.83.54/24 (up)", "Routing: OSPF enabled on 10.227.83.0/24 area 0", "ACL 168: deny traffic from 192.168.190.147"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.227.83.54/24 is up, and ACL 168 denys traffic from 192.168.190.147."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.221.15.115 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.221.15.10.0.0.255 area 0\naccess-list 111 deny ip 192.168.247.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.221.15.115/24 (up)", "Routing: OSPF enabled on 10.221.15.10/24 area 0", "ACL 111: deny traffic from 192.168.247.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.221.15.115/24 is up, and ACL 111 denys traffic from 192.168.247.78."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.225.33.247 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.225.33.20.0.0.255 area 0\naccess-list 120 deny ip 192.168.242.132 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.225.33.247/24 (up)", "Routing: OSPF enabled on 10.225.33.20/24 area 0", "ACL 120: deny traffic from 192.168.242.132"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.225.33.247/24 is up, and ACL 120 denys traffic from 192.168.242.132."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.172.47.78 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.172.47.0.0.0.255 area 0\naccess-list 113 deny ip 192.168.201.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.172.47.78/24 (up)", "Routing: OSPF enabled on 10.172.47.0/24 area 0", "ACL 113: deny traffic from 192.168.201.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.172.47.78/24 is up, and ACL 113 denys traffic from 192.168.201.95."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.25.1.231 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.25.1.20.0.0.255 area 0\naccess-list 131 permit ip 192.168.80.162 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.25.1.231/24 (down)", "Routing: OSPF enabled on 10.25.1.20/24 area 0", "ACL 131: permit traffic from 192.168.80.162"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.25.1.231/24 is down, and ACL 131 permits traffic from 192.168.80.162."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.217.9.31 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.217.9.0.0.0.255 area 0\naccess-list 137 permit ip 192.168.52.205 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.217.9.31/24 (down)", "Routing: OSPF enabled on 10.217.9.0/24 area 0", "ACL 137: permit traffic from 192.168.52.205"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.217.9.31/24 is down, and ACL 137 permits traffic from 192.168.52.205."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.101.175.26 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.101.175.0.0.0.255 area 0\naccess-list 114 deny ip 192.168.100.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.101.175.26/24 (down)", "Routing: OSPF enabled on 10.101.175.0/24 area 0", "ACL 114: deny traffic from 192.168.100.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.101.175.26/24 is down, and ACL 114 denys traffic from 192.168.100.126."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.74.96.205 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.74.96.20.0.0.255 area 0\naccess-list 155 permit ip 192.168.157.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.74.96.205/24 (down)", "Routing: OSPF enabled on 10.74.96.20/24 area 0", "ACL 155: permit traffic from 192.168.157.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.74.96.205/24 is down, and ACL 155 permits traffic from 192.168.157.67."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.248.148.116 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.248.148.10.0.0.255 area 0\naccess-list 142 permit ip 192.168.113.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.248.148.116/24 (up)", "Routing: OSPF enabled on 10.248.148.10/24 area 0", "ACL 142: permit traffic from 192.168.113.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.248.148.116/24 is up, and ACL 142 permits traffic from 192.168.113.105."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.108.225.54 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.108.225.0.0.0.255 area 0\naccess-list 151 deny ip 192.168.66.74 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.108.225.54/24 (up)", "Routing: OSPF enabled on 10.108.225.0/24 area 0", "ACL 151: deny traffic from 192.168.66.74"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.108.225.54/24 is up, and ACL 151 denys traffic from 192.168.66.74."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.254.80.218 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.254.80.20.0.0.255 area 0\naccess-list 136 deny ip 192.168.59.93 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.254.80.218/24 (down)", "Routing: OSPF enabled on 10.254.80.20/24 area 0", "ACL 136: deny traffic from 192.168.59.93"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.254.80.218/24 is down, and ACL 136 denys traffic from 192.168.59.93."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.151.234.238 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.151.234.20.0.0.255 area 0\naccess-list 129 deny ip 192.168.209.14 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.151.234.238/24 (down)", "Routing: OSPF enabled on 10.151.234.20/24 area 0", "ACL 129: deny traffic from 192.168.209.14"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.151.234.238/24 is down, and ACL 129 denys traffic from 192.168.209.14."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.138.223.216 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.138.223.20.0.0.255 area 0\naccess-list 179 permit ip 192.168.34.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.138.223.216/24 (up)", "Routing: OSPF enabled on 10.138.223.20/24 area 0", "ACL 179: permit traffic from 192.168.34.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.138.223.216/24 is up, and ACL 179 permits traffic from 192.168.34.160."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.109.220.218 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.109.220.20.0.0.255 area 0\naccess-list 179 deny ip 192.168.135.167 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.109.220.218/24 (up)", "Routing: OSPF enabled on 10.109.220.20/24 area 0", "ACL 179: deny traffic from 192.168.135.167"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.109.220.218/24 is up, and ACL 179 denys traffic from 192.168.135.167."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.244.244.241 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.244.244.20.0.0.255 area 0\naccess-list 149 deny ip 192.168.117.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.244.244.241/24 (up)", "Routing: OSPF enabled on 10.244.244.20/24 area 0", "ACL 149: deny traffic from 192.168.117.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.244.244.241/24 is up, and ACL 149 denys traffic from 192.168.117.254."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.14.85.3 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.14.850.0.0.255 area 0\naccess-list 147 deny ip 192.168.212.101 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.14.85.3/24 (down)", "Routing: OSPF enabled on 10.14.850/24 area 0", "ACL 147: deny traffic from 192.168.212.101"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.14.85.3/24 is down, and ACL 147 denys traffic from 192.168.212.101."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.99.131.184 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.99.131.10.0.0.255 area 0\naccess-list 183 permit ip 192.168.30.63 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.99.131.184/24 (down)", "Routing: OSPF enabled on 10.99.131.10/24 area 0", "ACL 183: permit traffic from 192.168.30.63"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.99.131.184/24 is down, and ACL 183 permits traffic from 192.168.30.63."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.235.71.85 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.235.71.0.0.0.255 area 0\naccess-list 135 deny ip 192.168.179.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.235.71.85/24 (down)", "Routing: OSPF enabled on 10.235.71.0/24 area 0", "ACL 135: deny traffic from 192.168.179.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.235.71.85/24 is down, and ACL 135 denys traffic from 192.168.179.148."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.145.234.107 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.145.234.10.0.0.255 area 0\naccess-list 148 permit ip 192.168.27.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.145.234.107/24 (up)", "Routing: OSPF enabled on 10.145.234.10/24 area 0", "ACL 148: permit traffic from 192.168.27.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.145.234.107/24 is up, and ACL 148 permits traffic from 192.168.27.220."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.7.121.18 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.7.121.0.0.0.255 area 0\naccess-list 160 permit ip 192.168.115.232 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.7.121.18/24 (up)", "Routing: OSPF enabled on 10.7.121.0/24 area 0", "ACL 160: permit traffic from 192.168.115.232"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.7.121.18/24 is up, and ACL 160 permits traffic from 192.168.115.232."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.82.23.68 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.82.23.0.0.0.255 area 0\naccess-list 116 deny ip 192.168.247.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.82.23.68/24 (down)", "Routing: OSPF enabled on 10.82.23.0/24 area 0", "ACL 116: deny traffic from 192.168.247.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.82.23.68/24 is down, and ACL 116 denys traffic from 192.168.247.254."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.189.112.37 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.189.112.0.0.0.255 area 0\naccess-list 156 permit ip 192.168.115.144 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.189.112.37/24 (up)", "Routing: OSPF enabled on 10.189.112.0/24 area 0", "ACL 156: permit traffic from 192.168.115.144"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.189.112.37/24 is up, and ACL 156 permits traffic from 192.168.115.144."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.248.199.184 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.248.199.10.0.0.255 area 0\naccess-list 112 deny ip 192.168.240.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.248.199.184/24 (down)", "Routing: OSPF enabled on 10.248.199.10/24 area 0", "ACL 112: deny traffic from 192.168.240.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.248.199.184/24 is down, and ACL 112 denys traffic from 192.168.240.116."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.238.138.170 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.238.138.10.0.0.255 area 0\naccess-list 155 deny ip 192.168.175.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.238.138.170/24 (down)", "Routing: OSPF enabled on 10.238.138.10/24 area 0", "ACL 155: deny traffic from 192.168.175.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.238.138.170/24 is down, and ACL 155 denys traffic from 192.168.175.95."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.203.199.135 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.203.199.10.0.0.255 area 0\naccess-list 159 permit ip 192.168.190.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.203.199.135/24 (down)", "Routing: OSPF enabled on 10.203.199.10/24 area 0", "ACL 159: permit traffic from 192.168.190.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.203.199.135/24 is down, and ACL 159 permits traffic from 192.168.190.157."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.136.245.4 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.136.2450.0.0.255 area 0\naccess-list 108 deny ip 192.168.168.248 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.136.245.4/24 (down)", "Routing: OSPF enabled on 10.136.2450/24 area 0", "ACL 108: deny traffic from 192.168.168.248"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.136.245.4/24 is down, and ACL 108 denys traffic from 192.168.168.248."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.99.162.68 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.99.162.0.0.0.255 area 0\naccess-list 173 permit ip 192.168.180.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.99.162.68/24 (down)", "Routing: OSPF enabled on 10.99.162.0/24 area 0", "ACL 173: permit traffic from 192.168.180.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.99.162.68/24 is down, and ACL 173 permits traffic from 192.168.180.136."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.163.180.160 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.163.180.10.0.0.255 area 0\naccess-list 141 deny ip 192.168.41.34 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.163.180.160/24 (up)", "Routing: OSPF enabled on 10.163.180.10/24 area 0", "ACL 141: deny traffic from 192.168.41.34"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.163.180.160/24 is up, and ACL 141 denys traffic from 192.168.41.34."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.190.106.63 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.190.106.0.0.0.255 area 0\naccess-list 174 permit ip 192.168.142.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.190.106.63/24 (up)", "Routing: OSPF enabled on 10.190.106.0/24 area 0", "ACL 174: permit traffic from 192.168.142.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.190.106.63/24 is up, and ACL 174 permits traffic from 192.168.142.25."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.182.195.8 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.182.1950.0.0.255 area 0\naccess-list 110 permit ip 192.168.6.177 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.182.195.8/24 (up)", "Routing: OSPF enabled on 10.182.1950/24 area 0", "ACL 110: permit traffic from 192.168.6.177"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.182.195.8/24 is up, and ACL 110 permits traffic from 192.168.6.177."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.188.140.205 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.188.140.20.0.0.255 area 0\naccess-list 161 deny ip 192.168.252.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.188.140.205/24 (up)", "Routing: OSPF enabled on 10.188.140.20/24 area 0", "ACL 161: deny traffic from 192.168.252.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.188.140.205/24 is up, and ACL 161 denys traffic from 192.168.252.13."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.104.120.237 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.104.120.20.0.0.255 area 0\naccess-list 186 deny ip 192.168.254.202 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.104.120.237/24 (down)", "Routing: OSPF enabled on 10.104.120.20/24 area 0", "ACL 186: deny traffic from 192.168.254.202"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.104.120.237/24 is down, and ACL 186 denys traffic from 192.168.254.202."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.200.76.178 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.200.76.10.0.0.255 area 0\naccess-list 133 permit ip 192.168.72.252 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.200.76.178/24 (up)", "Routing: OSPF enabled on 10.200.76.10/24 area 0", "ACL 133: permit traffic from 192.168.72.252"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.200.76.178/24 is up, and ACL 133 permits traffic from 192.168.72.252."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.230.16.75 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.230.16.0.0.0.255 area 0\naccess-list 134 permit ip 192.168.17.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.230.16.75/24 (up)", "Routing: OSPF enabled on 10.230.16.0/24 area 0", "ACL 134: permit traffic from 192.168.17.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.230.16.75/24 is up, and ACL 134 permits traffic from 192.168.17.109."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.89.211.161 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.89.211.10.0.0.255 area 0\naccess-list 186 permit ip 192.168.152.47 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.89.211.161/24 (up)", "Routing: OSPF enabled on 10.89.211.10/24 area 0", "ACL 186: permit traffic from 192.168.152.47"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.89.211.161/24 is up, and ACL 186 permits traffic from 192.168.152.47."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.40.144.245 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.40.144.20.0.0.255 area 0\naccess-list 184 permit ip 192.168.223.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.40.144.245/24 (up)", "Routing: OSPF enabled on 10.40.144.20/24 area 0", "ACL 184: permit traffic from 192.168.223.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.40.144.245/24 is up, and ACL 184 permits traffic from 192.168.223.172."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.129.78.37 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.129.78.0.0.0.255 area 0\naccess-list 181 deny ip 192.168.173.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.129.78.37/24 (down)", "Routing: OSPF enabled on 10.129.78.0/24 area 0", "ACL 181: deny traffic from 192.168.173.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.129.78.37/24 is down, and ACL 181 denys traffic from 192.168.173.53."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.60.164.194 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.60.164.10.0.0.255 area 0\naccess-list 129 deny ip 192.168.169.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.60.164.194/24 (down)", "Routing: OSPF enabled on 10.60.164.10/24 area 0", "ACL 129: deny traffic from 192.168.169.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.60.164.194/24 is down, and ACL 129 denys traffic from 192.168.169.208."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.114.42.106 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.114.42.10.0.0.255 area 0\naccess-list 111 permit ip 192.168.161.44 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.114.42.106/24 (down)", "Routing: OSPF enabled on 10.114.42.10/24 area 0", "ACL 111: permit traffic from 192.168.161.44"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.114.42.106/24 is down, and ACL 111 permits traffic from 192.168.161.44."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.175.96.241 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.175.96.20.0.0.255 area 0\naccess-list 161 deny ip 192.168.235.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.175.96.241/24 (up)", "Routing: OSPF enabled on 10.175.96.20/24 area 0", "ACL 161: deny traffic from 192.168.235.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.175.96.241/24 is up, and ACL 161 denys traffic from 192.168.235.146."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.76.11.125 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.76.11.10.0.0.255 area 0\naccess-list 111 deny ip 192.168.86.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.76.11.125/24 (down)", "Routing: OSPF enabled on 10.76.11.10/24 area 0", "ACL 111: deny traffic from 192.168.86.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.76.11.125/24 is down, and ACL 111 denys traffic from 192.168.86.155."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.225.23.37 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.225.23.0.0.0.255 area 0\naccess-list 136 permit ip 192.168.4.156 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.225.23.37/24 (down)", "Routing: OSPF enabled on 10.225.23.0/24 area 0", "ACL 136: permit traffic from 192.168.4.156"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.225.23.37/24 is down, and ACL 136 permits traffic from 192.168.4.156."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.129.154.249 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.129.154.20.0.0.255 area 0\naccess-list 122 deny ip 192.168.59.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.129.154.249/24 (up)", "Routing: OSPF enabled on 10.129.154.20/24 area 0", "ACL 122: deny traffic from 192.168.59.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.129.154.249/24 is up, and ACL 122 denys traffic from 192.168.59.77."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.94.40.134 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.94.40.10.0.0.255 area 0\naccess-list 161 deny ip 192.168.230.143 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.94.40.134/24 (down)", "Routing: OSPF enabled on 10.94.40.10/24 area 0", "ACL 161: deny traffic from 192.168.230.143"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.94.40.134/24 is down, and ACL 161 denys traffic from 192.168.230.143."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.7.13.249 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.7.13.20.0.0.255 area 0\naccess-list 134 permit ip 192.168.175.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.7.13.249/24 (up)", "Routing: OSPF enabled on 10.7.13.20/24 area 0", "ACL 134: permit traffic from 192.168.175.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.7.13.249/24 is up, and ACL 134 permits traffic from 192.168.175.10."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.117.111.131 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.117.111.10.0.0.255 area 0\naccess-list 181 deny ip 192.168.182.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.117.111.131/24 (down)", "Routing: OSPF enabled on 10.117.111.10/24 area 0", "ACL 181: deny traffic from 192.168.182.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.117.111.131/24 is down, and ACL 181 denys traffic from 192.168.182.59."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.120.229.247 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.120.229.20.0.0.255 area 0\naccess-list 180 permit ip 192.168.26.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.120.229.247/24 (up)", "Routing: OSPF enabled on 10.120.229.20/24 area 0", "ACL 180: permit traffic from 192.168.26.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.120.229.247/24 is up, and ACL 180 permits traffic from 192.168.26.254."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.66.141.196 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.66.141.10.0.0.255 area 0\naccess-list 135 permit ip 192.168.121.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.66.141.196/24 (up)", "Routing: OSPF enabled on 10.66.141.10/24 area 0", "ACL 135: permit traffic from 192.168.121.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.66.141.196/24 is up, and ACL 135 permits traffic from 192.168.121.114."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.240.231.217 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.240.231.20.0.0.255 area 0\naccess-list 175 permit ip 192.168.158.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.240.231.217/24 (up)", "Routing: OSPF enabled on 10.240.231.20/24 area 0", "ACL 175: permit traffic from 192.168.158.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.240.231.217/24 is up, and ACL 175 permits traffic from 192.168.158.38."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.28.61.223 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.28.61.20.0.0.255 area 0\naccess-list 147 permit ip 192.168.76.175 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.28.61.223/24 (up)", "Routing: OSPF enabled on 10.28.61.20/24 area 0", "ACL 147: permit traffic from 192.168.76.175"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.28.61.223/24 is up, and ACL 147 permits traffic from 192.168.76.175."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.13.26.157 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.13.26.10.0.0.255 area 0\naccess-list 111 deny ip 192.168.251.255 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.13.26.157/24 (down)", "Routing: OSPF enabled on 10.13.26.10/24 area 0", "ACL 111: deny traffic from 192.168.251.255"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.13.26.157/24 is down, and ACL 111 denys traffic from 192.168.251.255."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.239.181.45 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.239.181.0.0.0.255 area 0\naccess-list 188 permit ip 192.168.117.151 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.239.181.45/24 (up)", "Routing: OSPF enabled on 10.239.181.0/24 area 0", "ACL 188: permit traffic from 192.168.117.151"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.239.181.45/24 is up, and ACL 188 permits traffic from 192.168.117.151."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.193.63.137 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.193.63.10.0.0.255 area 0\naccess-list 188 permit ip 192.168.201.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.193.63.137/24 (up)", "Routing: OSPF enabled on 10.193.63.10/24 area 0", "ACL 188: permit traffic from 192.168.201.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.193.63.137/24 is up, and ACL 188 permits traffic from 192.168.201.78."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.211.98.246 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.211.98.20.0.0.255 area 0\naccess-list 166 deny ip 192.168.67.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.211.98.246/24 (up)", "Routing: OSPF enabled on 10.211.98.20/24 area 0", "ACL 166: deny traffic from 192.168.67.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.211.98.246/24 is up, and ACL 166 denys traffic from 192.168.67.191."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.35.28.240 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.35.28.20.0.0.255 area 0\naccess-list 171 deny ip 192.168.129.194 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.35.28.240/24 (down)", "Routing: OSPF enabled on 10.35.28.20/24 area 0", "ACL 171: deny traffic from 192.168.129.194"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.35.28.240/24 is down, and ACL 171 denys traffic from 192.168.129.194."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.198.231.251 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.198.231.20.0.0.255 area 0\naccess-list 148 permit ip 192.168.221.91 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.198.231.251/24 (down)", "Routing: OSPF enabled on 10.198.231.20/24 area 0", "ACL 148: permit traffic from 192.168.221.91"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.198.231.251/24 is down, and ACL 148 permits traffic from 192.168.221.91."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.86.57.128 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.86.57.10.0.0.255 area 0\naccess-list 181 deny ip 192.168.43.34 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.86.57.128/24 (up)", "Routing: OSPF enabled on 10.86.57.10/24 area 0", "ACL 181: deny traffic from 192.168.43.34"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.86.57.128/24 is up, and ACL 181 denys traffic from 192.168.43.34."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.210.19.21 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.210.19.0.0.0.255 area 0\naccess-list 143 deny ip 192.168.229.188 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.210.19.21/24 (up)", "Routing: OSPF enabled on 10.210.19.0/24 area 0", "ACL 143: deny traffic from 192.168.229.188"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.210.19.21/24 is up, and ACL 143 denys traffic from 192.168.229.188."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.226.153.210 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.226.153.20.0.0.255 area 0\naccess-list 104 deny ip 192.168.91.76 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.226.153.210/24 (up)", "Routing: OSPF enabled on 10.226.153.20/24 area 0", "ACL 104: deny traffic from 192.168.91.76"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.226.153.210/24 is up, and ACL 104 denys traffic from 192.168.91.76."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.193.1.93 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.193.1.0.0.0.255 area 0\naccess-list 122 deny ip 192.168.170.224 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.193.1.93/24 (down)", "Routing: OSPF enabled on 10.193.1.0/24 area 0", "ACL 122: deny traffic from 192.168.170.224"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.193.1.93/24 is down, and ACL 122 denys traffic from 192.168.170.224."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.255.82.148 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.255.82.10.0.0.255 area 0\naccess-list 139 permit ip 192.168.112.101 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.255.82.148/24 (up)", "Routing: OSPF enabled on 10.255.82.10/24 area 0", "ACL 139: permit traffic from 192.168.112.101"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.255.82.148/24 is up, and ACL 139 permits traffic from 192.168.112.101."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.158.222.208 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.158.222.20.0.0.255 area 0\naccess-list 169 deny ip 192.168.218.140 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.158.222.208/24 (down)", "Routing: OSPF enabled on 10.158.222.20/24 area 0", "ACL 169: deny traffic from 192.168.218.140"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.158.222.208/24 is down, and ACL 169 denys traffic from 192.168.218.140."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.236.23.132 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.236.23.10.0.0.255 area 0\naccess-list 195 permit ip 192.168.145.169 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.236.23.132/24 (up)", "Routing: OSPF enabled on 10.236.23.10/24 area 0", "ACL 195: permit traffic from 192.168.145.169"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.236.23.132/24 is up, and ACL 195 permits traffic from 192.168.145.169."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.107.32.226 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.107.32.20.0.0.255 area 0\naccess-list 144 permit ip 192.168.252.3 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.107.32.226/24 (down)", "Routing: OSPF enabled on 10.107.32.20/24 area 0", "ACL 144: permit traffic from 192.168.252.3"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.107.32.226/24 is down, and ACL 144 permits traffic from 192.168.252.3."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.163.75.13 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.163.75.0.0.0.255 area 0\naccess-list 164 deny ip 192.168.200.184 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.163.75.13/24 (down)", "Routing: OSPF enabled on 10.163.75.0/24 area 0", "ACL 164: deny traffic from 192.168.200.184"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.163.75.13/24 is down, and ACL 164 denys traffic from 192.168.200.184."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.248.168.106 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.248.168.10.0.0.255 area 0\naccess-list 190 permit ip 192.168.96.173 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.248.168.106/24 (up)", "Routing: OSPF enabled on 10.248.168.10/24 area 0", "ACL 190: permit traffic from 192.168.96.173"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.248.168.106/24 is up, and ACL 190 permits traffic from 192.168.96.173."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.59.37.35 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.59.37.0.0.0.255 area 0\naccess-list 154 deny ip 192.168.117.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.59.37.35/24 (down)", "Routing: OSPF enabled on 10.59.37.0/24 area 0", "ACL 154: deny traffic from 192.168.117.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.59.37.35/24 is down, and ACL 154 denys traffic from 192.168.117.67."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.22.63.211 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.22.63.20.0.0.255 area 0\naccess-list 148 deny ip 192.168.90.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.22.63.211/24 (down)", "Routing: OSPF enabled on 10.22.63.20/24 area 0", "ACL 148: deny traffic from 192.168.90.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.22.63.211/24 is down, and ACL 148 denys traffic from 192.168.90.113."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.202.180.16 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.202.180.0.0.0.255 area 0\naccess-list 125 deny ip 192.168.36.241 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.202.180.16/24 (up)", "Routing: OSPF enabled on 10.202.180.0/24 area 0", "ACL 125: deny traffic from 192.168.36.241"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.202.180.16/24 is up, and ACL 125 denys traffic from 192.168.36.241."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.169.67.248 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.169.67.20.0.0.255 area 0\naccess-list 158 deny ip 192.168.71.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.169.67.248/24 (down)", "Routing: OSPF enabled on 10.169.67.20/24 area 0", "ACL 158: deny traffic from 192.168.71.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.169.67.248/24 is down, and ACL 158 denys traffic from 192.168.71.106."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.187.197.11 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.187.197.0.0.0.255 area 0\naccess-list 152 deny ip 192.168.126.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.187.197.11/24 (up)", "Routing: OSPF enabled on 10.187.197.0/24 area 0", "ACL 152: deny traffic from 192.168.126.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.187.197.11/24 is up, and ACL 152 denys traffic from 192.168.126.38."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.61.190.169 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.61.190.10.0.0.255 area 0\naccess-list 145 permit ip 192.168.242.205 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.61.190.169/24 (down)", "Routing: OSPF enabled on 10.61.190.10/24 area 0", "ACL 145: permit traffic from 192.168.242.205"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.61.190.169/24 is down, and ACL 145 permits traffic from 192.168.242.205."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.155.158.65 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.155.158.0.0.0.255 area 0\naccess-list 184 deny ip 192.168.125.159 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.155.158.65/24 (up)", "Routing: OSPF enabled on 10.155.158.0/24 area 0", "ACL 184: deny traffic from 192.168.125.159"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.155.158.65/24 is up, and ACL 184 denys traffic from 192.168.125.159."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.91.238.248 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.91.238.20.0.0.255 area 0\naccess-list 106 permit ip 192.168.193.84 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.91.238.248/24 (up)", "Routing: OSPF enabled on 10.91.238.20/24 area 0", "ACL 106: permit traffic from 192.168.193.84"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.91.238.248/24 is up, and ACL 106 permits traffic from 192.168.193.84."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.107.238.179 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.107.238.10.0.0.255 area 0\naccess-list 162 deny ip 192.168.113.68 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.107.238.179/24 (up)", "Routing: OSPF enabled on 10.107.238.10/24 area 0", "ACL 162: deny traffic from 192.168.113.68"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.107.238.179/24 is up, and ACL 162 denys traffic from 192.168.113.68."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.143.68.221 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.143.68.20.0.0.255 area 0\naccess-list 107 deny ip 192.168.229.169 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.143.68.221/24 (up)", "Routing: OSPF enabled on 10.143.68.20/24 area 0", "ACL 107: deny traffic from 192.168.229.169"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.143.68.221/24 is up, and ACL 107 denys traffic from 192.168.229.169."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.147.167.81 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.147.167.0.0.0.255 area 0\naccess-list 139 deny ip 192.168.47.68 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.147.167.81/24 (down)", "Routing: OSPF enabled on 10.147.167.0/24 area 0", "ACL 139: deny traffic from 192.168.47.68"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.147.167.81/24 is down, and ACL 139 denys traffic from 192.168.47.68."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.186.120.146 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.186.120.10.0.0.255 area 0\naccess-list 164 deny ip 192.168.113.168 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.186.120.146/24 (down)", "Routing: OSPF enabled on 10.186.120.10/24 area 0", "ACL 164: deny traffic from 192.168.113.168"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.186.120.146/24 is down, and ACL 164 denys traffic from 192.168.113.168."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.150.88.124 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.150.88.10.0.0.255 area 0\naccess-list 137 permit ip 192.168.145.194 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.150.88.124/24 (down)", "Routing: OSPF enabled on 10.150.88.10/24 area 0", "ACL 137: permit traffic from 192.168.145.194"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.150.88.124/24 is down, and ACL 137 permits traffic from 192.168.145.194."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.127.136.226 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.127.136.20.0.0.255 area 0\naccess-list 153 deny ip 192.168.17.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.127.136.226/24 (up)", "Routing: OSPF enabled on 10.127.136.20/24 area 0", "ACL 153: deny traffic from 192.168.17.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.127.136.226/24 is up, and ACL 153 denys traffic from 192.168.17.116."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.182.253.24 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.182.253.0.0.0.255 area 0\naccess-list 177 permit ip 192.168.226.212 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.182.253.24/24 (down)", "Routing: OSPF enabled on 10.182.253.0/24 area 0", "ACL 177: permit traffic from 192.168.226.212"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.182.253.24/24 is down, and ACL 177 permits traffic from 192.168.226.212."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.152.224.177 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.152.224.10.0.0.255 area 0\naccess-list 108 permit ip 192.168.145.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.152.224.177/24 (down)", "Routing: OSPF enabled on 10.152.224.10/24 area 0", "ACL 108: permit traffic from 192.168.145.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.152.224.177/24 is down, and ACL 108 permits traffic from 192.168.145.186."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.71.3.177 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.71.3.10.0.0.255 area 0\naccess-list 169 permit ip 192.168.188.119 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.71.3.177/24 (up)", "Routing: OSPF enabled on 10.71.3.10/24 area 0", "ACL 169: permit traffic from 192.168.188.119"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.71.3.177/24 is up, and ACL 169 permits traffic from 192.168.188.119."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.14.129.47 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.14.129.0.0.0.255 area 0\naccess-list 142 deny ip 192.168.228.171 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.14.129.47/24 (down)", "Routing: OSPF enabled on 10.14.129.0/24 area 0", "ACL 142: deny traffic from 192.168.228.171"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.14.129.47/24 is down, and ACL 142 denys traffic from 192.168.228.171."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.88.173.68 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.88.173.0.0.0.255 area 0\naccess-list 119 deny ip 192.168.186.203 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.88.173.68/24 (up)", "Routing: OSPF enabled on 10.88.173.0/24 area 0", "ACL 119: deny traffic from 192.168.186.203"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.88.173.68/24 is up, and ACL 119 denys traffic from 192.168.186.203."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.176.233.136 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.176.233.10.0.0.255 area 0\naccess-list 163 permit ip 192.168.86.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.176.233.136/24 (down)", "Routing: OSPF enabled on 10.176.233.10/24 area 0", "ACL 163: permit traffic from 192.168.86.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.176.233.136/24 is down, and ACL 163 permits traffic from 192.168.86.56."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.48.69.121 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.48.69.10.0.0.255 area 0\naccess-list 179 deny ip 192.168.205.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.48.69.121/24 (up)", "Routing: OSPF enabled on 10.48.69.10/24 area 0", "ACL 179: deny traffic from 192.168.205.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.48.69.121/24 is up, and ACL 179 denys traffic from 192.168.205.69."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.100.92.166 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.100.92.10.0.0.255 area 0\naccess-list 195 deny ip 192.168.188.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.100.92.166/24 (up)", "Routing: OSPF enabled on 10.100.92.10/24 area 0", "ACL 195: deny traffic from 192.168.188.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.100.92.166/24 is up, and ACL 195 denys traffic from 192.168.188.157."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.65.74.52 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.65.74.0.0.0.255 area 0\naccess-list 129 permit ip 192.168.51.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.65.74.52/24 (down)", "Routing: OSPF enabled on 10.65.74.0/24 area 0", "ACL 129: permit traffic from 192.168.51.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.65.74.52/24 is down, and ACL 129 permits traffic from 192.168.51.196."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.121.255.61 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.121.255.0.0.0.255 area 0\naccess-list 140 deny ip 192.168.81.50 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.121.255.61/24 (up)", "Routing: OSPF enabled on 10.121.255.0/24 area 0", "ACL 140: deny traffic from 192.168.81.50"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.121.255.61/24 is up, and ACL 140 denys traffic from 192.168.81.50."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.113.178.87 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.113.178.0.0.0.255 area 0\naccess-list 156 permit ip 192.168.109.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.113.178.87/24 (down)", "Routing: OSPF enabled on 10.113.178.0/24 area 0", "ACL 156: permit traffic from 192.168.109.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.113.178.87/24 is down, and ACL 156 permits traffic from 192.168.109.48."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.55.65.38 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.55.65.0.0.0.255 area 0\naccess-list 199 deny ip 192.168.133.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.55.65.38/24 (down)", "Routing: OSPF enabled on 10.55.65.0/24 area 0", "ACL 199: deny traffic from 192.168.133.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.55.65.38/24 is down, and ACL 199 denys traffic from 192.168.133.199."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.109.61.92 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.109.61.0.0.0.255 area 0\naccess-list 194 permit ip 192.168.187.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.109.61.92/24 (down)", "Routing: OSPF enabled on 10.109.61.0/24 area 0", "ACL 194: permit traffic from 192.168.187.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.109.61.92/24 is down, and ACL 194 permits traffic from 192.168.187.25."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.146.224.37 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.146.224.0.0.0.255 area 0\naccess-list 164 permit ip 192.168.146.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.146.224.37/24 (up)", "Routing: OSPF enabled on 10.146.224.0/24 area 0", "ACL 164: permit traffic from 192.168.146.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.146.224.37/24 is up, and ACL 164 permits traffic from 192.168.146.234."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.242.117.82 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.242.117.0.0.0.255 area 0\naccess-list 184 permit ip 192.168.167.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.242.117.82/24 (up)", "Routing: OSPF enabled on 10.242.117.0/24 area 0", "ACL 184: permit traffic from 192.168.167.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.242.117.82/24 is up, and ACL 184 permits traffic from 192.168.167.48."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.210.138.56 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.210.138.0.0.0.255 area 0\naccess-list 157 deny ip 192.168.241.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.210.138.56/24 (up)", "Routing: OSPF enabled on 10.210.138.0/24 area 0", "ACL 157: deny traffic from 192.168.241.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.210.138.56/24 is up, and ACL 157 denys traffic from 192.168.241.75."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.230.208.13 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.230.208.0.0.0.255 area 0\naccess-list 123 permit ip 192.168.243.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.230.208.13/24 (up)", "Routing: OSPF enabled on 10.230.208.0/24 area 0", "ACL 123: permit traffic from 192.168.243.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.230.208.13/24 is up, and ACL 123 permits traffic from 192.168.243.114."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.161.16.170 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.161.16.10.0.0.255 area 0\naccess-list 140 permit ip 192.168.55.45 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.161.16.170/24 (up)", "Routing: OSPF enabled on 10.161.16.10/24 area 0", "ACL 140: permit traffic from 192.168.55.45"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.161.16.170/24 is up, and ACL 140 permits traffic from 192.168.55.45."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.67.243.129 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.67.243.10.0.0.255 area 0\naccess-list 181 permit ip 192.168.174.76 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.67.243.129/24 (down)", "Routing: OSPF enabled on 10.67.243.10/24 area 0", "ACL 181: permit traffic from 192.168.174.76"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.67.243.129/24 is down, and ACL 181 permits traffic from 192.168.174.76."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.15.226.2 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.15.2260.0.0.255 area 0\naccess-list 159 deny ip 192.168.197.97 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.15.226.2/24 (down)", "Routing: OSPF enabled on 10.15.2260/24 area 0", "ACL 159: deny traffic from 192.168.197.97"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.15.226.2/24 is down, and ACL 159 denys traffic from 192.168.197.97."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.110.2.183 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.110.2.10.0.0.255 area 0\naccess-list 100 deny ip 192.168.93.180 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.110.2.183/24 (up)", "Routing: OSPF enabled on 10.110.2.10/24 area 0", "ACL 100: deny traffic from 192.168.93.180"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.110.2.183/24 is up, and ACL 100 denys traffic from 192.168.93.180."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.202.72.38 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.202.72.0.0.0.255 area 0\naccess-list 138 deny ip 192.168.34.122 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.202.72.38/24 (up)", "Routing: OSPF enabled on 10.202.72.0/24 area 0", "ACL 138: deny traffic from 192.168.34.122"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.202.72.38/24 is up, and ACL 138 denys traffic from 192.168.34.122."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.249.106.145 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.249.106.10.0.0.255 area 0\naccess-list 163 permit ip 192.168.170.212 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.249.106.145/24 (up)", "Routing: OSPF enabled on 10.249.106.10/24 area 0", "ACL 163: permit traffic from 192.168.170.212"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.249.106.145/24 is up, and ACL 163 permits traffic from 192.168.170.212."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.8.182.48 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.8.182.0.0.0.255 area 0\naccess-list 147 permit ip 192.168.79.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.8.182.48/24 (down)", "Routing: OSPF enabled on 10.8.182.0/24 area 0", "ACL 147: permit traffic from 192.168.79.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.8.182.48/24 is down, and ACL 147 permits traffic from 192.168.79.148."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.151.169.63 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.151.169.0.0.0.255 area 0\naccess-list 123 permit ip 192.168.114.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.151.169.63/24 (down)", "Routing: OSPF enabled on 10.151.169.0/24 area 0", "ACL 123: permit traffic from 192.168.114.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.151.169.63/24 is down, and ACL 123 permits traffic from 192.168.114.38."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.32.183.48 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.32.183.0.0.0.255 area 0\naccess-list 144 permit ip 192.168.205.132 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.32.183.48/24 (down)", "Routing: OSPF enabled on 10.32.183.0/24 area 0", "ACL 144: permit traffic from 192.168.205.132"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.32.183.48/24 is down, and ACL 144 permits traffic from 192.168.205.132."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.139.245.186 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.139.245.10.0.0.255 area 0\naccess-list 180 permit ip 192.168.5.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.139.245.186/24 (down)", "Routing: OSPF enabled on 10.139.245.10/24 area 0", "ACL 180: permit traffic from 192.168.5.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.139.245.186/24 is down, and ACL 180 permits traffic from 192.168.5.222."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.72.169.253 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.72.169.20.0.0.255 area 0\naccess-list 180 deny ip 192.168.3.133 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.72.169.253/24 (up)", "Routing: OSPF enabled on 10.72.169.20/24 area 0", "ACL 180: deny traffic from 192.168.3.133"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.72.169.253/24 is up, and ACL 180 denys traffic from 192.168.3.133."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.95.154.181 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.95.154.10.0.0.255 area 0\naccess-list 179 permit ip 192.168.95.86 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.95.154.181/24 (up)", "Routing: OSPF enabled on 10.95.154.10/24 area 0", "ACL 179: permit traffic from 192.168.95.86"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.95.154.181/24 is up, and ACL 179 permits traffic from 192.168.95.86."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.192.214.92 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.192.214.0.0.0.255 area 0\naccess-list 149 permit ip 192.168.52.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.192.214.92/24 (down)", "Routing: OSPF enabled on 10.192.214.0/24 area 0", "ACL 149: permit traffic from 192.168.52.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.192.214.92/24 is down, and ACL 149 permits traffic from 192.168.52.106."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.119.74.1 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.119.740.0.0.255 area 0\naccess-list 121 permit ip 192.168.242.145 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.119.74.1/24 (down)", "Routing: OSPF enabled on 10.119.740/24 area 0", "ACL 121: permit traffic from 192.168.242.145"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.119.74.1/24 is down, and ACL 121 permits traffic from 192.168.242.145."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.206.20.59 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.206.20.0.0.0.255 area 0\naccess-list 184 deny ip 192.168.126.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.206.20.59/24 (down)", "Routing: OSPF enabled on 10.206.20.0/24 area 0", "ACL 184: deny traffic from 192.168.126.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.206.20.59/24 is down, and ACL 184 denys traffic from 192.168.126.108."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.13.18.151 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.13.18.10.0.0.255 area 0\naccess-list 184 deny ip 192.168.177.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.13.18.151/24 (up)", "Routing: OSPF enabled on 10.13.18.10/24 area 0", "ACL 184: deny traffic from 192.168.177.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.13.18.151/24 is up, and ACL 184 denys traffic from 192.168.177.40."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.216.191.225 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.216.191.20.0.0.255 area 0\naccess-list 137 deny ip 192.168.198.253 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.216.191.225/24 (down)", "Routing: OSPF enabled on 10.216.191.20/24 area 0", "ACL 137: deny traffic from 192.168.198.253"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.216.191.225/24 is down, and ACL 137 denys traffic from 192.168.198.253."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.167.138.66 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.167.138.0.0.0.255 area 0\naccess-list 136 permit ip 192.168.23.81 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.167.138.66/24 (down)", "Routing: OSPF enabled on 10.167.138.0/24 area 0", "ACL 136: permit traffic from 192.168.23.81"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.167.138.66/24 is down, and ACL 136 permits traffic from 192.168.23.81."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.123.86.30 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.123.86.0.0.0.255 area 0\naccess-list 198 permit ip 192.168.146.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.123.86.30/24 (down)", "Routing: OSPF enabled on 10.123.86.0/24 area 0", "ACL 198: permit traffic from 192.168.146.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.123.86.30/24 is down, and ACL 198 permits traffic from 192.168.146.250."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.19.184.151 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.19.184.10.0.0.255 area 0\naccess-list 161 deny ip 192.168.211.133 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.19.184.151/24 (up)", "Routing: OSPF enabled on 10.19.184.10/24 area 0", "ACL 161: deny traffic from 192.168.211.133"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.19.184.151/24 is up, and ACL 161 denys traffic from 192.168.211.133."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.142.34.95 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.142.34.0.0.0.255 area 0\naccess-list 181 permit ip 192.168.145.236 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.142.34.95/24 (up)", "Routing: OSPF enabled on 10.142.34.0/24 area 0", "ACL 181: permit traffic from 192.168.145.236"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.142.34.95/24 is up, and ACL 181 permits traffic from 192.168.145.236."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.58.230.126 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.58.230.10.0.0.255 area 0\naccess-list 157 permit ip 192.168.175.168 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.58.230.126/24 (up)", "Routing: OSPF enabled on 10.58.230.10/24 area 0", "ACL 157: permit traffic from 192.168.175.168"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.58.230.126/24 is up, and ACL 157 permits traffic from 192.168.175.168."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.89.29.68 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.89.29.0.0.0.255 area 0\naccess-list 194 permit ip 192.168.175.91 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.89.29.68/24 (down)", "Routing: OSPF enabled on 10.89.29.0/24 area 0", "ACL 194: permit traffic from 192.168.175.91"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.89.29.68/24 is down, and ACL 194 permits traffic from 192.168.175.91."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.41.86.47 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.41.86.0.0.0.255 area 0\naccess-list 146 permit ip 192.168.42.14 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.41.86.47/24 (down)", "Routing: OSPF enabled on 10.41.86.0/24 area 0", "ACL 146: permit traffic from 192.168.42.14"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.41.86.47/24 is down, and ACL 146 permits traffic from 192.168.42.14."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.204.75.101 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.204.75.10.0.0.255 area 0\naccess-list 121 permit ip 192.168.154.144 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.204.75.101/24 (up)", "Routing: OSPF enabled on 10.204.75.10/24 area 0", "ACL 121: permit traffic from 192.168.154.144"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.204.75.101/24 is up, and ACL 121 permits traffic from 192.168.154.144."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.92.12.123 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.92.12.10.0.0.255 area 0\naccess-list 191 permit ip 192.168.3.218 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.92.12.123/24 (up)", "Routing: OSPF enabled on 10.92.12.10/24 area 0", "ACL 191: permit traffic from 192.168.3.218"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.92.12.123/24 is up, and ACL 191 permits traffic from 192.168.3.218."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.28.210.129 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.28.210.10.0.0.255 area 0\naccess-list 162 deny ip 192.168.72.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.28.210.129/24 (up)", "Routing: OSPF enabled on 10.28.210.10/24 area 0", "ACL 162: deny traffic from 192.168.72.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.28.210.129/24 is up, and ACL 162 denys traffic from 192.168.72.40."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.172.115.166 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.172.115.10.0.0.255 area 0\naccess-list 171 permit ip 192.168.84.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.172.115.166/24 (up)", "Routing: OSPF enabled on 10.172.115.10/24 area 0", "ACL 171: permit traffic from 192.168.84.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.172.115.166/24 is up, and ACL 171 permits traffic from 192.168.84.117."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.253.200.21 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.253.200.0.0.0.255 area 0\naccess-list 124 permit ip 192.168.111.219 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.253.200.21/24 (down)", "Routing: OSPF enabled on 10.253.200.0/24 area 0", "ACL 124: permit traffic from 192.168.111.219"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.253.200.21/24 is down, and ACL 124 permits traffic from 192.168.111.219."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.168.149.42 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.168.149.0.0.0.255 area 0\naccess-list 171 deny ip 192.168.213.47 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.168.149.42/24 (up)", "Routing: OSPF enabled on 10.168.149.0/24 area 0", "ACL 171: deny traffic from 192.168.213.47"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.168.149.42/24 is up, and ACL 171 denys traffic from 192.168.213.47."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.192.85.130 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.192.85.10.0.0.255 area 0\naccess-list 160 deny ip 192.168.110.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.192.85.130/24 (down)", "Routing: OSPF enabled on 10.192.85.10/24 area 0", "ACL 160: deny traffic from 192.168.110.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.192.85.130/24 is down, and ACL 160 denys traffic from 192.168.110.155."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.182.192.218 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.182.192.20.0.0.255 area 0\naccess-list 161 deny ip 192.168.38.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.182.192.218/24 (down)", "Routing: OSPF enabled on 10.182.192.20/24 area 0", "ACL 161: deny traffic from 192.168.38.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.182.192.218/24 is down, and ACL 161 denys traffic from 192.168.38.59."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.121.195.183 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.121.195.10.0.0.255 area 0\naccess-list 171 deny ip 192.168.185.215 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.121.195.183/24 (down)", "Routing: OSPF enabled on 10.121.195.10/24 area 0", "ACL 171: deny traffic from 192.168.185.215"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.121.195.183/24 is down, and ACL 171 denys traffic from 192.168.185.215."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.233.11.21 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.233.11.0.0.0.255 area 0\naccess-list 151 permit ip 192.168.101.165 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.233.11.21/24 (down)", "Routing: OSPF enabled on 10.233.11.0/24 area 0", "ACL 151: permit traffic from 192.168.101.165"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.233.11.21/24 is down, and ACL 151 permits traffic from 192.168.101.165."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.16.129.126 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.16.129.10.0.0.255 area 0\naccess-list 116 permit ip 192.168.16.118 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.16.129.126/24 (down)", "Routing: OSPF enabled on 10.16.129.10/24 area 0", "ACL 116: permit traffic from 192.168.16.118"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.16.129.126/24 is down, and ACL 116 permits traffic from 192.168.16.118."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.10.33.99 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.10.33.0.0.0.255 area 0\naccess-list 180 deny ip 192.168.3.231 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.10.33.99/24 (up)", "Routing: OSPF enabled on 10.10.33.0/24 area 0", "ACL 180: deny traffic from 192.168.3.231"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.10.33.99/24 is up, and ACL 180 denys traffic from 192.168.3.231."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.51.100.33 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.51.100.0.0.0.255 area 0\naccess-list 137 permit ip 192.168.14.132 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.51.100.33/24 (up)", "Routing: OSPF enabled on 10.51.100.0/24 area 0", "ACL 137: permit traffic from 192.168.14.132"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.51.100.33/24 is up, and ACL 137 permits traffic from 192.168.14.132."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.194.85.209 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.194.85.20.0.0.255 area 0\naccess-list 102 deny ip 192.168.123.127 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.194.85.209/24 (down)", "Routing: OSPF enabled on 10.194.85.20/24 area 0", "ACL 102: deny traffic from 192.168.123.127"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.194.85.209/24 is down, and ACL 102 denys traffic from 192.168.123.127."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.1.153.252 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.1.153.20.0.0.255 area 0\naccess-list 148 deny ip 192.168.73.58 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.1.153.252/24 (up)", "Routing: OSPF enabled on 10.1.153.20/24 area 0", "ACL 148: deny traffic from 192.168.73.58"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.1.153.252/24 is up, and ACL 148 denys traffic from 192.168.73.58."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.139.205.199 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.139.205.10.0.0.255 area 0\naccess-list 181 deny ip 192.168.249.119 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.139.205.199/24 (up)", "Routing: OSPF enabled on 10.139.205.10/24 area 0", "ACL 181: deny traffic from 192.168.249.119"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.139.205.199/24 is up, and ACL 181 denys traffic from 192.168.249.119."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.48.60.170 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.48.60.10.0.0.255 area 0\naccess-list 148 deny ip 192.168.218.19 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.48.60.170/24 (up)", "Routing: OSPF enabled on 10.48.60.10/24 area 0", "ACL 148: deny traffic from 192.168.218.19"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.48.60.170/24 is up, and ACL 148 denys traffic from 192.168.218.19."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.56.205.168 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.56.205.10.0.0.255 area 0\naccess-list 189 deny ip 192.168.37.88 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.56.205.168/24 (down)", "Routing: OSPF enabled on 10.56.205.10/24 area 0", "ACL 189: deny traffic from 192.168.37.88"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.56.205.168/24 is down, and ACL 189 denys traffic from 192.168.37.88."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.140.46.76 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.140.46.0.0.0.255 area 0\naccess-list 161 permit ip 192.168.128.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.140.46.76/24 (up)", "Routing: OSPF enabled on 10.140.46.0/24 area 0", "ACL 161: permit traffic from 192.168.128.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.140.46.76/24 is up, and ACL 161 permits traffic from 192.168.128.233."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.86.208.63 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.86.208.0.0.0.255 area 0\naccess-list 161 deny ip 192.168.135.237 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.86.208.63/24 (up)", "Routing: OSPF enabled on 10.86.208.0/24 area 0", "ACL 161: deny traffic from 192.168.135.237"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.86.208.63/24 is up, and ACL 161 denys traffic from 192.168.135.237."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.68.5.9 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.68.50.0.0.255 area 0\naccess-list 161 permit ip 192.168.228.166 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.68.5.9/24 (up)", "Routing: OSPF enabled on 10.68.50/24 area 0", "ACL 161: permit traffic from 192.168.228.166"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.68.5.9/24 is up, and ACL 161 permits traffic from 192.168.228.166."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.118.220.75 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.118.220.0.0.0.255 area 0\naccess-list 102 deny ip 192.168.189.207 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.118.220.75/24 (down)", "Routing: OSPF enabled on 10.118.220.0/24 area 0", "ACL 102: deny traffic from 192.168.189.207"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.118.220.75/24 is down, and ACL 102 denys traffic from 192.168.189.207."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.233.128.34 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.233.128.0.0.0.255 area 0\naccess-list 175 deny ip 192.168.91.24 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.233.128.34/24 (up)", "Routing: OSPF enabled on 10.233.128.0/24 area 0", "ACL 175: deny traffic from 192.168.91.24"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.233.128.34/24 is up, and ACL 175 denys traffic from 192.168.91.24."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.28.215.212 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.28.215.20.0.0.255 area 0\naccess-list 159 deny ip 192.168.179.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.28.215.212/24 (up)", "Routing: OSPF enabled on 10.28.215.20/24 area 0", "ACL 159: deny traffic from 192.168.179.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.28.215.212/24 is up, and ACL 159 denys traffic from 192.168.179.69."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.95.114.216 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.95.114.20.0.0.255 area 0\naccess-list 101 deny ip 192.168.170.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.95.114.216/24 (down)", "Routing: OSPF enabled on 10.95.114.20/24 area 0", "ACL 101: deny traffic from 192.168.170.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.95.114.216/24 is down, and ACL 101 denys traffic from 192.168.170.254."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.21.161.79 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.21.161.0.0.0.255 area 0\naccess-list 100 permit ip 192.168.90.239 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.21.161.79/24 (up)", "Routing: OSPF enabled on 10.21.161.0/24 area 0", "ACL 100: permit traffic from 192.168.90.239"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.21.161.79/24 is up, and ACL 100 permits traffic from 192.168.90.239."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.157.63.7 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.157.630.0.0.255 area 0\naccess-list 135 deny ip 192.168.60.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.157.63.7/24 (down)", "Routing: OSPF enabled on 10.157.630/24 area 0", "ACL 135: deny traffic from 192.168.60.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.157.63.7/24 is down, and ACL 135 denys traffic from 192.168.60.67."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.17.213.29 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.17.213.0.0.0.255 area 0\naccess-list 141 permit ip 192.168.65.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.17.213.29/24 (down)", "Routing: OSPF enabled on 10.17.213.0/24 area 0", "ACL 141: permit traffic from 192.168.65.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.17.213.29/24 is down, and ACL 141 permits traffic from 192.168.65.238."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.94.15.232 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.94.15.20.0.0.255 area 0\naccess-list 114 deny ip 192.168.240.226 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.94.15.232/24 (down)", "Routing: OSPF enabled on 10.94.15.20/24 area 0", "ACL 114: deny traffic from 192.168.240.226"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.94.15.232/24 is down, and ACL 114 denys traffic from 192.168.240.226."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.24.98.148 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.24.98.10.0.0.255 area 0\naccess-list 149 deny ip 192.168.44.52 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.24.98.148/24 (up)", "Routing: OSPF enabled on 10.24.98.10/24 area 0", "ACL 149: deny traffic from 192.168.44.52"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.24.98.148/24 is up, and ACL 149 denys traffic from 192.168.44.52."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.177.4.22 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.177.4.0.0.0.255 area 0\naccess-list 195 deny ip 192.168.50.188 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.177.4.22/24 (down)", "Routing: OSPF enabled on 10.177.4.0/24 area 0", "ACL 195: deny traffic from 192.168.50.188"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.177.4.22/24 is down, and ACL 195 denys traffic from 192.168.50.188."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.30.242.165 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.30.242.10.0.0.255 area 0\naccess-list 156 permit ip 192.168.12.110 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.30.242.165/24 (up)", "Routing: OSPF enabled on 10.30.242.10/24 area 0", "ACL 156: permit traffic from 192.168.12.110"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.30.242.165/24 is up, and ACL 156 permits traffic from 192.168.12.110."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.37.3.36 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.37.3.0.0.0.255 area 0\naccess-list 146 permit ip 192.168.50.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.37.3.36/24 (up)", "Routing: OSPF enabled on 10.37.3.0/24 area 0", "ACL 146: permit traffic from 192.168.50.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.37.3.36/24 is up, and ACL 146 permits traffic from 192.168.50.121."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.44.11.134 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.44.11.10.0.0.255 area 0\naccess-list 181 deny ip 192.168.212.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.44.11.134/24 (up)", "Routing: OSPF enabled on 10.44.11.10/24 area 0", "ACL 181: deny traffic from 192.168.212.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.44.11.134/24 is up, and ACL 181 denys traffic from 192.168.212.126."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.187.90.249 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.187.90.20.0.0.255 area 0\naccess-list 135 deny ip 192.168.177.177 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.187.90.249/24 (down)", "Routing: OSPF enabled on 10.187.90.20/24 area 0", "ACL 135: deny traffic from 192.168.177.177"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.187.90.249/24 is down, and ACL 135 denys traffic from 192.168.177.177."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.88.105.185 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.88.105.10.0.0.255 area 0\naccess-list 107 permit ip 192.168.121.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.88.105.185/24 (up)", "Routing: OSPF enabled on 10.88.105.10/24 area 0", "ACL 107: permit traffic from 192.168.121.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.88.105.185/24 is up, and ACL 107 permits traffic from 192.168.121.40."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.171.118.224 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.171.118.20.0.0.255 area 0\naccess-list 126 permit ip 192.168.173.80 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.171.118.224/24 (up)", "Routing: OSPF enabled on 10.171.118.20/24 area 0", "ACL 126: permit traffic from 192.168.173.80"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.171.118.224/24 is up, and ACL 126 permits traffic from 192.168.173.80."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.23.226.108 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.23.226.10.0.0.255 area 0\naccess-list 196 deny ip 192.168.87.84 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.23.226.108/24 (up)", "Routing: OSPF enabled on 10.23.226.10/24 area 0", "ACL 196: deny traffic from 192.168.87.84"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.23.226.108/24 is up, and ACL 196 denys traffic from 192.168.87.84."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.162.135.91 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.162.135.0.0.0.255 area 0\naccess-list 115 permit ip 192.168.240.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.162.135.91/24 (up)", "Routing: OSPF enabled on 10.162.135.0/24 area 0", "ACL 115: permit traffic from 192.168.240.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.162.135.91/24 is up, and ACL 115 permits traffic from 192.168.240.220."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.140.180.210 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.140.180.20.0.0.255 area 0\naccess-list 160 deny ip 192.168.192.200 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.140.180.210/24 (down)", "Routing: OSPF enabled on 10.140.180.20/24 area 0", "ACL 160: deny traffic from 192.168.192.200"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.140.180.210/24 is down, and ACL 160 denys traffic from 192.168.192.200."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.215.25.177 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.215.25.10.0.0.255 area 0\naccess-list 135 deny ip 192.168.21.135 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.215.25.177/24 (down)", "Routing: OSPF enabled on 10.215.25.10/24 area 0", "ACL 135: deny traffic from 192.168.21.135"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.215.25.177/24 is down, and ACL 135 denys traffic from 192.168.21.135."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.51.20.152 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.51.20.10.0.0.255 area 0\naccess-list 160 permit ip 192.168.80.72 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.51.20.152/24 (down)", "Routing: OSPF enabled on 10.51.20.10/24 area 0", "ACL 160: permit traffic from 192.168.80.72"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.51.20.152/24 is down, and ACL 160 permits traffic from 192.168.80.72."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.98.121.212 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.98.121.20.0.0.255 area 0\naccess-list 145 permit ip 192.168.119.203 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.98.121.212/24 (down)", "Routing: OSPF enabled on 10.98.121.20/24 area 0", "ACL 145: permit traffic from 192.168.119.203"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.98.121.212/24 is down, and ACL 145 permits traffic from 192.168.119.203."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.68.33.83 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.68.33.0.0.0.255 area 0\naccess-list 153 deny ip 192.168.128.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.68.33.83/24 (up)", "Routing: OSPF enabled on 10.68.33.0/24 area 0", "ACL 153: deny traffic from 192.168.128.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.68.33.83/24 is up, and ACL 153 denys traffic from 192.168.128.49."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.140.21.109 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.140.21.10.0.0.255 area 0\naccess-list 135 permit ip 192.168.223.22 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.140.21.109/24 (up)", "Routing: OSPF enabled on 10.140.21.10/24 area 0", "ACL 135: permit traffic from 192.168.223.22"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.140.21.109/24 is up, and ACL 135 permits traffic from 192.168.223.22."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.128.211.189 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.128.211.10.0.0.255 area 0\naccess-list 126 permit ip 192.168.55.247 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.128.211.189/24 (down)", "Routing: OSPF enabled on 10.128.211.10/24 area 0", "ACL 126: permit traffic from 192.168.55.247"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.128.211.189/24 is down, and ACL 126 permits traffic from 192.168.55.247."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.216.209.196 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.216.209.10.0.0.255 area 0\naccess-list 117 deny ip 192.168.93.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.216.209.196/24 (down)", "Routing: OSPF enabled on 10.216.209.10/24 area 0", "ACL 117: deny traffic from 192.168.93.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.216.209.196/24 is down, and ACL 117 denys traffic from 192.168.93.220."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.137.126.125 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.137.126.10.0.0.255 area 0\naccess-list 141 permit ip 192.168.141.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.137.126.125/24 (down)", "Routing: OSPF enabled on 10.137.126.10/24 area 0", "ACL 141: permit traffic from 192.168.141.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.137.126.125/24 is down, and ACL 141 permits traffic from 192.168.141.154."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.9.70.202 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.9.70.20.0.0.255 area 0\naccess-list 145 permit ip 192.168.60.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.9.70.202/24 (down)", "Routing: OSPF enabled on 10.9.70.20/24 area 0", "ACL 145: permit traffic from 192.168.60.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.9.70.202/24 is down, and ACL 145 permits traffic from 192.168.60.85."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.140.253.163 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.140.253.10.0.0.255 area 0\naccess-list 140 permit ip 192.168.63.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.140.253.163/24 (down)", "Routing: OSPF enabled on 10.140.253.10/24 area 0", "ACL 140: permit traffic from 192.168.63.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.140.253.163/24 is down, and ACL 140 permits traffic from 192.168.63.134."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.253.211.59 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.253.211.0.0.0.255 area 0\naccess-list 162 deny ip 192.168.145.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.253.211.59/24 (down)", "Routing: OSPF enabled on 10.253.211.0/24 area 0", "ACL 162: deny traffic from 192.168.145.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.253.211.59/24 is down, and ACL 162 denys traffic from 192.168.145.155."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.245.37.188 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.245.37.10.0.0.255 area 0\naccess-list 156 permit ip 192.168.218.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.245.37.188/24 (up)", "Routing: OSPF enabled on 10.245.37.10/24 area 0", "ACL 156: permit traffic from 192.168.218.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.245.37.188/24 is up, and ACL 156 permits traffic from 192.168.218.94."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.144.28.20 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.144.28.0.0.0.255 area 0\naccess-list 189 deny ip 192.168.147.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.144.28.20/24 (down)", "Routing: OSPF enabled on 10.144.28.0/24 area 0", "ACL 189: deny traffic from 192.168.147.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.144.28.20/24 is down, and ACL 189 denys traffic from 192.168.147.126."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.76.184.96 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.76.184.0.0.0.255 area 0\naccess-list 118 permit ip 192.168.123.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.76.184.96/24 (up)", "Routing: OSPF enabled on 10.76.184.0/24 area 0", "ACL 118: permit traffic from 192.168.123.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.76.184.96/24 is up, and ACL 118 permits traffic from 192.168.123.56."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.55.128.246 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.55.128.20.0.0.255 area 0\naccess-list 134 deny ip 192.168.117.14 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.55.128.246/24 (up)", "Routing: OSPF enabled on 10.55.128.20/24 area 0", "ACL 134: deny traffic from 192.168.117.14"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.55.128.246/24 is up, and ACL 134 denys traffic from 192.168.117.14."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.207.153.21 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.207.153.0.0.0.255 area 0\naccess-list 112 permit ip 192.168.66.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.207.153.21/24 (down)", "Routing: OSPF enabled on 10.207.153.0/24 area 0", "ACL 112: permit traffic from 192.168.66.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.207.153.21/24 is down, and ACL 112 permits traffic from 192.168.66.120."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.91.44.118 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.91.44.10.0.0.255 area 0\naccess-list 179 deny ip 192.168.76.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.91.44.118/24 (up)", "Routing: OSPF enabled on 10.91.44.10/24 area 0", "ACL 179: deny traffic from 192.168.76.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.91.44.118/24 is up, and ACL 179 denys traffic from 192.168.76.78."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.114.146.64 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.114.146.0.0.0.255 area 0\naccess-list 133 permit ip 192.168.194.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.114.146.64/24 (down)", "Routing: OSPF enabled on 10.114.146.0/24 area 0", "ACL 133: permit traffic from 192.168.194.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.114.146.64/24 is down, and ACL 133 permits traffic from 192.168.194.186."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.194.93.159 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.194.93.10.0.0.255 area 0\naccess-list 189 permit ip 192.168.62.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.194.93.159/24 (down)", "Routing: OSPF enabled on 10.194.93.10/24 area 0", "ACL 189: permit traffic from 192.168.62.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.194.93.159/24 is down, and ACL 189 permits traffic from 192.168.62.40."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.6.179.142 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.6.179.10.0.0.255 area 0\naccess-list 176 deny ip 192.168.132.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.6.179.142/24 (up)", "Routing: OSPF enabled on 10.6.179.10/24 area 0", "ACL 176: deny traffic from 192.168.132.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.6.179.142/24 is up, and ACL 176 denys traffic from 192.168.132.222."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.22.54.206 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.22.54.20.0.0.255 area 0\naccess-list 192 deny ip 192.168.14.141 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.22.54.206/24 (down)", "Routing: OSPF enabled on 10.22.54.20/24 area 0", "ACL 192: deny traffic from 192.168.14.141"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.22.54.206/24 is down, and ACL 192 denys traffic from 192.168.14.141."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.245.30.180 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.245.30.10.0.0.255 area 0\naccess-list 109 deny ip 192.168.63.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.245.30.180/24 (up)", "Routing: OSPF enabled on 10.245.30.10/24 area 0", "ACL 109: deny traffic from 192.168.63.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.245.30.180/24 is up, and ACL 109 denys traffic from 192.168.63.92."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.133.87.67 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.133.87.0.0.0.255 area 0\naccess-list 189 deny ip 192.168.6.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.133.87.67/24 (down)", "Routing: OSPF enabled on 10.133.87.0/24 area 0", "ACL 189: deny traffic from 192.168.6.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.133.87.67/24 is down, and ACL 189 denys traffic from 192.168.6.37."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.242.76.146 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.242.76.10.0.0.255 area 0\naccess-list 178 deny ip 192.168.23.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.242.76.146/24 (down)", "Routing: OSPF enabled on 10.242.76.10/24 area 0", "ACL 178: deny traffic from 192.168.23.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.242.76.146/24 is down, and ACL 178 denys traffic from 192.168.23.222."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.168.211.88 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.168.211.0.0.0.255 area 0\naccess-list 179 deny ip 192.168.169.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.168.211.88/24 (up)", "Routing: OSPF enabled on 10.168.211.0/24 area 0", "ACL 179: deny traffic from 192.168.169.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.168.211.88/24 is up, and ACL 179 denys traffic from 192.168.169.10."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.27.232.86 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.27.232.0.0.0.255 area 0\naccess-list 132 permit ip 192.168.135.24 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.27.232.86/24 (up)", "Routing: OSPF enabled on 10.27.232.0/24 area 0", "ACL 132: permit traffic from 192.168.135.24"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.27.232.86/24 is up, and ACL 132 permits traffic from 192.168.135.24."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.156.19.16 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.156.19.0.0.0.255 area 0\naccess-list 137 deny ip 192.168.161.153 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.156.19.16/24 (up)", "Routing: OSPF enabled on 10.156.19.0/24 area 0", "ACL 137: deny traffic from 192.168.161.153"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.156.19.16/24 is up, and ACL 137 denys traffic from 192.168.161.153."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.168.181.88 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.168.181.0.0.0.255 area 0\naccess-list 189 deny ip 192.168.17.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.168.181.88/24 (down)", "Routing: OSPF enabled on 10.168.181.0/24 area 0", "ACL 189: deny traffic from 192.168.17.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.168.181.88/24 is down, and ACL 189 denys traffic from 192.168.17.126."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.194.77.250 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.194.77.20.0.0.255 area 0\naccess-list 142 permit ip 192.168.9.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.194.77.250/24 (up)", "Routing: OSPF enabled on 10.194.77.20/24 area 0", "ACL 142: permit traffic from 192.168.9.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.194.77.250/24 is up, and ACL 142 permits traffic from 192.168.9.56."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.56.208.53 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.56.208.0.0.0.255 area 0\naccess-list 169 deny ip 192.168.245.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.56.208.53/24 (up)", "Routing: OSPF enabled on 10.56.208.0/24 area 0", "ACL 169: deny traffic from 192.168.245.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.56.208.53/24 is up, and ACL 169 denys traffic from 192.168.245.234."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.111.5.87 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.111.5.0.0.0.255 area 0\naccess-list 172 deny ip 192.168.246.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.111.5.87/24 (up)", "Routing: OSPF enabled on 10.111.5.0/24 area 0", "ACL 172: deny traffic from 192.168.246.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.111.5.87/24 is up, and ACL 172 denys traffic from 192.168.246.191."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.231.43.41 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.231.43.0.0.0.255 area 0\naccess-list 128 deny ip 192.168.45.179 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.231.43.41/24 (down)", "Routing: OSPF enabled on 10.231.43.0/24 area 0", "ACL 128: deny traffic from 192.168.45.179"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.231.43.41/24 is down, and ACL 128 denys traffic from 192.168.45.179."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.182.185.224 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.182.185.20.0.0.255 area 0\naccess-list 163 deny ip 192.168.184.150 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.182.185.224/24 (up)", "Routing: OSPF enabled on 10.182.185.20/24 area 0", "ACL 163: deny traffic from 192.168.184.150"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.182.185.224/24 is up, and ACL 163 denys traffic from 192.168.184.150."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.115.253.235 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.115.253.20.0.0.255 area 0\naccess-list 156 permit ip 192.168.100.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.115.253.235/24 (down)", "Routing: OSPF enabled on 10.115.253.20/24 area 0", "ACL 156: permit traffic from 192.168.100.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.115.253.235/24 is down, and ACL 156 permits traffic from 192.168.100.129."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.198.222.232 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.198.222.20.0.0.255 area 0\naccess-list 187 permit ip 192.168.155.62 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.198.222.232/24 (up)", "Routing: OSPF enabled on 10.198.222.20/24 area 0", "ACL 187: permit traffic from 192.168.155.62"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.198.222.232/24 is up, and ACL 187 permits traffic from 192.168.155.62."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.21.105.106 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.21.105.10.0.0.255 area 0\naccess-list 137 deny ip 192.168.10.227 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.21.105.106/24 (up)", "Routing: OSPF enabled on 10.21.105.10/24 area 0", "ACL 137: deny traffic from 192.168.10.227"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.21.105.106/24 is up, and ACL 137 denys traffic from 192.168.10.227."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.51.15.227 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.51.15.20.0.0.255 area 0\naccess-list 125 permit ip 192.168.228.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.51.15.227/24 (down)", "Routing: OSPF enabled on 10.51.15.20/24 area 0", "ACL 125: permit traffic from 192.168.228.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.51.15.227/24 is down, and ACL 125 permits traffic from 192.168.228.126."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.27.93.231 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.27.93.20.0.0.255 area 0\naccess-list 135 deny ip 192.168.157.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.27.93.231/24 (down)", "Routing: OSPF enabled on 10.27.93.20/24 area 0", "ACL 135: deny traffic from 192.168.157.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.27.93.231/24 is down, and ACL 135 denys traffic from 192.168.157.254."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.8.235.11 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.8.235.0.0.0.255 area 0\naccess-list 169 deny ip 192.168.223.235 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.8.235.11/24 (up)", "Routing: OSPF enabled on 10.8.235.0/24 area 0", "ACL 169: deny traffic from 192.168.223.235"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.8.235.11/24 is up, and ACL 169 denys traffic from 192.168.223.235."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.114.109.12 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.114.109.0.0.0.255 area 0\naccess-list 143 permit ip 192.168.235.118 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.114.109.12/24 (up)", "Routing: OSPF enabled on 10.114.109.0/24 area 0", "ACL 143: permit traffic from 192.168.235.118"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.114.109.12/24 is up, and ACL 143 permits traffic from 192.168.235.118."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.238.130.53 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.238.130.0.0.0.255 area 0\naccess-list 119 deny ip 192.168.220.7 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.238.130.53/24 (up)", "Routing: OSPF enabled on 10.238.130.0/24 area 0", "ACL 119: deny traffic from 192.168.220.7"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.238.130.53/24 is up, and ACL 119 denys traffic from 192.168.220.7."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.107.57.196 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.107.57.10.0.0.255 area 0\naccess-list 131 permit ip 192.168.201.210 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.107.57.196/24 (up)", "Routing: OSPF enabled on 10.107.57.10/24 area 0", "ACL 131: permit traffic from 192.168.201.210"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.107.57.196/24 is up, and ACL 131 permits traffic from 192.168.201.210."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.156.125.248 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.156.125.20.0.0.255 area 0\naccess-list 120 deny ip 192.168.92.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.156.125.248/24 (up)", "Routing: OSPF enabled on 10.156.125.20/24 area 0", "ACL 120: deny traffic from 192.168.92.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.156.125.248/24 is up, and ACL 120 denys traffic from 192.168.92.114."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.60.186.149 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.60.186.10.0.0.255 area 0\naccess-list 175 permit ip 192.168.70.169 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.60.186.149/24 (up)", "Routing: OSPF enabled on 10.60.186.10/24 area 0", "ACL 175: permit traffic from 192.168.70.169"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.60.186.149/24 is up, and ACL 175 permits traffic from 192.168.70.169."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.150.99.36 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.150.99.0.0.0.255 area 0\naccess-list 176 permit ip 192.168.226.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.150.99.36/24 (down)", "Routing: OSPF enabled on 10.150.99.0/24 area 0", "ACL 176: permit traffic from 192.168.226.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.150.99.36/24 is down, and ACL 176 permits traffic from 192.168.226.75."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.109.108.71 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.109.108.0.0.0.255 area 0\naccess-list 136 permit ip 192.168.236.19 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.109.108.71/24 (up)", "Routing: OSPF enabled on 10.109.108.0/24 area 0", "ACL 136: permit traffic from 192.168.236.19"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.109.108.71/24 is up, and ACL 136 permits traffic from 192.168.236.19."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.255.211.81 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.255.211.0.0.0.255 area 0\naccess-list 168 deny ip 192.168.215.142 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.255.211.81/24 (down)", "Routing: OSPF enabled on 10.255.211.0/24 area 0", "ACL 168: deny traffic from 192.168.215.142"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.255.211.81/24 is down, and ACL 168 denys traffic from 192.168.215.142."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.154.208.19 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.154.208.0.0.0.255 area 0\naccess-list 119 deny ip 192.168.149.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.154.208.19/24 (up)", "Routing: OSPF enabled on 10.154.208.0/24 area 0", "ACL 119: deny traffic from 192.168.149.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.154.208.19/24 is up, and ACL 119 denys traffic from 192.168.149.106."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.57.212.87 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.57.212.0.0.0.255 area 0\naccess-list 180 deny ip 192.168.153.66 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.57.212.87/24 (down)", "Routing: OSPF enabled on 10.57.212.0/24 area 0", "ACL 180: deny traffic from 192.168.153.66"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.57.212.87/24 is down, and ACL 180 denys traffic from 192.168.153.66."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.38.201.211 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.38.201.20.0.0.255 area 0\naccess-list 185 permit ip 192.168.85.249 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.38.201.211/24 (up)", "Routing: OSPF enabled on 10.38.201.20/24 area 0", "ACL 185: permit traffic from 192.168.85.249"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.38.201.211/24 is up, and ACL 185 permits traffic from 192.168.85.249."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.149.241.12 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.149.241.0.0.0.255 area 0\naccess-list 178 deny ip 192.168.55.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.149.241.12/24 (up)", "Routing: OSPF enabled on 10.149.241.0/24 area 0", "ACL 178: deny traffic from 192.168.55.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.149.241.12/24 is up, and ACL 178 denys traffic from 192.168.55.157."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.192.67.140 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.192.67.10.0.0.255 area 0\naccess-list 136 deny ip 192.168.78.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.192.67.140/24 (up)", "Routing: OSPF enabled on 10.192.67.10/24 area 0", "ACL 136: deny traffic from 192.168.78.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.192.67.140/24 is up, and ACL 136 denys traffic from 192.168.78.108."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.150.214.189 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.150.214.10.0.0.255 area 0\naccess-list 111 permit ip 192.168.242.183 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.150.214.189/24 (up)", "Routing: OSPF enabled on 10.150.214.10/24 area 0", "ACL 111: permit traffic from 192.168.242.183"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.150.214.189/24 is up, and ACL 111 permits traffic from 192.168.242.183."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.5.233.135 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.5.233.10.0.0.255 area 0\naccess-list 180 deny ip 192.168.102.74 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.5.233.135/24 (up)", "Routing: OSPF enabled on 10.5.233.10/24 area 0", "ACL 180: deny traffic from 192.168.102.74"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.5.233.135/24 is up, and ACL 180 denys traffic from 192.168.102.74."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.10.158.185 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.10.158.10.0.0.255 area 0\naccess-list 100 deny ip 192.168.206.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.10.158.185/24 (up)", "Routing: OSPF enabled on 10.10.158.10/24 area 0", "ACL 100: deny traffic from 192.168.206.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.10.158.185/24 is up, and ACL 100 denys traffic from 192.168.206.199."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.242.117.51 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.242.117.0.0.0.255 area 0\naccess-list 132 deny ip 192.168.111.197 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.242.117.51/24 (up)", "Routing: OSPF enabled on 10.242.117.0/24 area 0", "ACL 132: deny traffic from 192.168.111.197"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.242.117.51/24 is up, and ACL 132 denys traffic from 192.168.111.197."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.178.226.77 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.178.226.0.0.0.255 area 0\naccess-list 100 deny ip 192.168.182.209 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.178.226.77/24 (down)", "Routing: OSPF enabled on 10.178.226.0/24 area 0", "ACL 100: deny traffic from 192.168.182.209"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.178.226.77/24 is down, and ACL 100 denys traffic from 192.168.182.209."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.4.36.171 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.4.36.10.0.0.255 area 0\naccess-list 120 permit ip 192.168.55.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.4.36.171/24 (up)", "Routing: OSPF enabled on 10.4.36.10/24 area 0", "ACL 120: permit traffic from 192.168.55.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.4.36.171/24 is up, and ACL 120 permits traffic from 192.168.55.250."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.3.51.244 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.3.51.20.0.0.255 area 0\naccess-list 199 deny ip 192.168.214.142 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.3.51.244/24 (down)", "Routing: OSPF enabled on 10.3.51.20/24 area 0", "ACL 199: deny traffic from 192.168.214.142"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.3.51.244/24 is down, and ACL 199 denys traffic from 192.168.214.142."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.40.132.251 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.40.132.20.0.0.255 area 0\naccess-list 125 permit ip 192.168.112.82 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.40.132.251/24 (up)", "Routing: OSPF enabled on 10.40.132.20/24 area 0", "ACL 125: permit traffic from 192.168.112.82"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.40.132.251/24 is up, and ACL 125 permits traffic from 192.168.112.82."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.255.42.226 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.255.42.20.0.0.255 area 0\naccess-list 137 deny ip 192.168.195.24 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.255.42.226/24 (up)", "Routing: OSPF enabled on 10.255.42.20/24 area 0", "ACL 137: deny traffic from 192.168.195.24"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.255.42.226/24 is up, and ACL 137 denys traffic from 192.168.195.24."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.22.183.89 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.22.183.0.0.0.255 area 0\naccess-list 178 permit ip 192.168.145.159 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.22.183.89/24 (down)", "Routing: OSPF enabled on 10.22.183.0/24 area 0", "ACL 178: permit traffic from 192.168.145.159"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.22.183.89/24 is down, and ACL 178 permits traffic from 192.168.145.159."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.118.6.73 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.118.6.0.0.0.255 area 0\naccess-list 131 permit ip 192.168.191.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.118.6.73/24 (down)", "Routing: OSPF enabled on 10.118.6.0/24 area 0", "ACL 131: permit traffic from 192.168.191.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.118.6.73/24 is down, and ACL 131 permits traffic from 192.168.191.49."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.40.120.205 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.40.120.20.0.0.255 area 0\naccess-list 152 deny ip 192.168.192.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.40.120.205/24 (down)", "Routing: OSPF enabled on 10.40.120.20/24 area 0", "ACL 152: deny traffic from 192.168.192.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.40.120.205/24 is down, and ACL 152 denys traffic from 192.168.192.10."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.96.225.39 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.96.225.0.0.0.255 area 0\naccess-list 102 deny ip 192.168.33.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.96.225.39/24 (up)", "Routing: OSPF enabled on 10.96.225.0/24 area 0", "ACL 102: deny traffic from 192.168.33.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.96.225.39/24 is up, and ACL 102 denys traffic from 192.168.33.106."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.43.208.126 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.43.208.10.0.0.255 area 0\naccess-list 141 permit ip 192.168.228.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.43.208.126/24 (down)", "Routing: OSPF enabled on 10.43.208.10/24 area 0", "ACL 141: permit traffic from 192.168.228.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.43.208.126/24 is down, and ACL 141 permits traffic from 192.168.228.129."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.21.62.178 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.21.62.10.0.0.255 area 0\naccess-list 144 permit ip 192.168.211.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.21.62.178/24 (down)", "Routing: OSPF enabled on 10.21.62.10/24 area 0", "ACL 144: permit traffic from 192.168.211.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.21.62.178/24 is down, and ACL 144 permits traffic from 192.168.211.116."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.121.161.71 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.121.161.0.0.0.255 area 0\naccess-list 118 deny ip 192.168.243.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.121.161.71/24 (up)", "Routing: OSPF enabled on 10.121.161.0/24 area 0", "ACL 118: deny traffic from 192.168.243.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.121.161.71/24 is up, and ACL 118 denys traffic from 192.168.243.186."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.40.175.251 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.40.175.20.0.0.255 area 0\naccess-list 191 deny ip 192.168.153.32 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.40.175.251/24 (down)", "Routing: OSPF enabled on 10.40.175.20/24 area 0", "ACL 191: deny traffic from 192.168.153.32"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.40.175.251/24 is down, and ACL 191 denys traffic from 192.168.153.32."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.238.235.166 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.238.235.10.0.0.255 area 0\naccess-list 113 deny ip 192.168.91.64 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.238.235.166/24 (down)", "Routing: OSPF enabled on 10.238.235.10/24 area 0", "ACL 113: deny traffic from 192.168.91.64"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.238.235.166/24 is down, and ACL 113 denys traffic from 192.168.91.64."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.33.14.15 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.33.14.0.0.0.255 area 0\naccess-list 110 deny ip 192.168.2.223 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.33.14.15/24 (down)", "Routing: OSPF enabled on 10.33.14.0/24 area 0", "ACL 110: deny traffic from 192.168.2.223"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.33.14.15/24 is down, and ACL 110 denys traffic from 192.168.2.223."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.255.65.105 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.255.65.10.0.0.255 area 0\naccess-list 181 permit ip 192.168.166.62 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.255.65.105/24 (down)", "Routing: OSPF enabled on 10.255.65.10/24 area 0", "ACL 181: permit traffic from 192.168.166.62"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.255.65.105/24 is down, and ACL 181 permits traffic from 192.168.166.62."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.197.82.112 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.197.82.10.0.0.255 area 0\naccess-list 110 deny ip 192.168.209.168 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.197.82.112/24 (up)", "Routing: OSPF enabled on 10.197.82.10/24 area 0", "ACL 110: deny traffic from 192.168.209.168"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.197.82.112/24 is up, and ACL 110 denys traffic from 192.168.209.168."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.146.55.183 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.146.55.10.0.0.255 area 0\naccess-list 155 permit ip 192.168.15.58 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.146.55.183/24 (down)", "Routing: OSPF enabled on 10.146.55.10/24 area 0", "ACL 155: permit traffic from 192.168.15.58"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.146.55.183/24 is down, and ACL 155 permits traffic from 192.168.15.58."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.86.225.75 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.86.225.0.0.0.255 area 0\naccess-list 113 deny ip 192.168.71.198 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.86.225.75/24 (down)", "Routing: OSPF enabled on 10.86.225.0/24 area 0", "ACL 113: deny traffic from 192.168.71.198"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.86.225.75/24 is down, and ACL 113 denys traffic from 192.168.71.198."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.96.13.191 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.96.13.10.0.0.255 area 0\naccess-list 133 permit ip 192.168.106.29 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.96.13.191/24 (down)", "Routing: OSPF enabled on 10.96.13.10/24 area 0", "ACL 133: permit traffic from 192.168.106.29"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.96.13.191/24 is down, and ACL 133 permits traffic from 192.168.106.29."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.184.199.132 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.184.199.10.0.0.255 area 0\naccess-list 185 deny ip 192.168.122.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.184.199.132/24 (down)", "Routing: OSPF enabled on 10.184.199.10/24 area 0", "ACL 185: deny traffic from 192.168.122.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.184.199.132/24 is down, and ACL 185 denys traffic from 192.168.122.106."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.165.247.57 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.165.247.0.0.0.255 area 0\naccess-list 132 permit ip 192.168.233.50 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.165.247.57/24 (down)", "Routing: OSPF enabled on 10.165.247.0/24 area 0", "ACL 132: permit traffic from 192.168.233.50"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.165.247.57/24 is down, and ACL 132 permits traffic from 192.168.233.50."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.153.94.17 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.153.94.0.0.0.255 area 0\naccess-list 139 permit ip 192.168.167.214 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.153.94.17/24 (down)", "Routing: OSPF enabled on 10.153.94.0/24 area 0", "ACL 139: permit traffic from 192.168.167.214"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.153.94.17/24 is down, and ACL 139 permits traffic from 192.168.167.214."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.146.14.34 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.146.14.0.0.0.255 area 0\naccess-list 165 permit ip 192.168.48.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.146.14.34/24 (down)", "Routing: OSPF enabled on 10.146.14.0/24 area 0", "ACL 165: permit traffic from 192.168.48.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.146.14.34/24 is down, and ACL 165 permits traffic from 192.168.48.107."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.62.220.198 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.62.220.10.0.0.255 area 0\naccess-list 156 deny ip 192.168.193.57 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.62.220.198/24 (up)", "Routing: OSPF enabled on 10.62.220.10/24 area 0", "ACL 156: deny traffic from 192.168.193.57"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.62.220.198/24 is up, and ACL 156 denys traffic from 192.168.193.57."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.155.219.146 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.155.219.10.0.0.255 area 0\naccess-list 155 permit ip 192.168.104.162 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.155.219.146/24 (down)", "Routing: OSPF enabled on 10.155.219.10/24 area 0", "ACL 155: permit traffic from 192.168.104.162"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.155.219.146/24 is down, and ACL 155 permits traffic from 192.168.104.162."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.193.42.114 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.193.42.10.0.0.255 area 0\naccess-list 135 deny ip 192.168.135.255 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.193.42.114/24 (down)", "Routing: OSPF enabled on 10.193.42.10/24 area 0", "ACL 135: deny traffic from 192.168.135.255"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.193.42.114/24 is down, and ACL 135 denys traffic from 192.168.135.255."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.101.231.114 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.101.231.10.0.0.255 area 0\naccess-list 145 permit ip 192.168.170.158 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.101.231.114/24 (down)", "Routing: OSPF enabled on 10.101.231.10/24 area 0", "ACL 145: permit traffic from 192.168.170.158"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.101.231.114/24 is down, and ACL 145 permits traffic from 192.168.170.158."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.211.26.152 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.211.26.10.0.0.255 area 0\naccess-list 183 permit ip 192.168.22.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.211.26.152/24 (up)", "Routing: OSPF enabled on 10.211.26.10/24 area 0", "ACL 183: permit traffic from 192.168.22.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.211.26.152/24 is up, and ACL 183 permits traffic from 192.168.22.245."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.97.158.19 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.97.158.0.0.0.255 area 0\naccess-list 125 permit ip 192.168.86.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.97.158.19/24 (down)", "Routing: OSPF enabled on 10.97.158.0/24 area 0", "ACL 125: permit traffic from 192.168.86.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.97.158.19/24 is down, and ACL 125 permits traffic from 192.168.86.148."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.227.72.179 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.227.72.10.0.0.255 area 0\naccess-list 142 deny ip 192.168.48.30 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.227.72.179/24 (down)", "Routing: OSPF enabled on 10.227.72.10/24 area 0", "ACL 142: deny traffic from 192.168.48.30"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.227.72.179/24 is down, and ACL 142 denys traffic from 192.168.48.30."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.10.52.200 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.10.52.20.0.0.255 area 0\naccess-list 114 permit ip 192.168.175.147 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.10.52.200/24 (down)", "Routing: OSPF enabled on 10.10.52.20/24 area 0", "ACL 114: permit traffic from 192.168.175.147"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.10.52.200/24 is down, and ACL 114 permits traffic from 192.168.175.147."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.41.82.130 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.41.82.10.0.0.255 area 0\naccess-list 183 deny ip 192.168.133.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.41.82.130/24 (down)", "Routing: OSPF enabled on 10.41.82.10/24 area 0", "ACL 183: deny traffic from 192.168.133.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.41.82.130/24 is down, and ACL 183 denys traffic from 192.168.133.230."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.8.146.116 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.8.146.10.0.0.255 area 0\naccess-list 159 deny ip 192.168.78.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.8.146.116/24 (down)", "Routing: OSPF enabled on 10.8.146.10/24 area 0", "ACL 159: deny traffic from 192.168.78.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.8.146.116/24 is down, and ACL 159 denys traffic from 192.168.78.155."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.32.180.234 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.32.180.20.0.0.255 area 0\naccess-list 192 permit ip 192.168.77.139 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.32.180.234/24 (down)", "Routing: OSPF enabled on 10.32.180.20/24 area 0", "ACL 192: permit traffic from 192.168.77.139"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.32.180.234/24 is down, and ACL 192 permits traffic from 192.168.77.139."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.77.142.197 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.77.142.10.0.0.255 area 0\naccess-list 156 deny ip 192.168.152.84 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.77.142.197/24 (down)", "Routing: OSPF enabled on 10.77.142.10/24 area 0", "ACL 156: deny traffic from 192.168.152.84"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.77.142.197/24 is down, and ACL 156 denys traffic from 192.168.152.84."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.52.205.100 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.52.205.10.0.0.255 area 0\naccess-list 120 deny ip 192.168.131.133 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.52.205.100/24 (down)", "Routing: OSPF enabled on 10.52.205.10/24 area 0", "ACL 120: deny traffic from 192.168.131.133"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.52.205.100/24 is down, and ACL 120 denys traffic from 192.168.131.133."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.138.11.145 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.138.11.10.0.0.255 area 0\naccess-list 192 deny ip 192.168.141.184 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.138.11.145/24 (up)", "Routing: OSPF enabled on 10.138.11.10/24 area 0", "ACL 192: deny traffic from 192.168.141.184"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.138.11.145/24 is up, and ACL 192 denys traffic from 192.168.141.184."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.81.54.56 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.81.54.0.0.0.255 area 0\naccess-list 162 deny ip 192.168.252.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.81.54.56/24 (down)", "Routing: OSPF enabled on 10.81.54.0/24 area 0", "ACL 162: deny traffic from 192.168.252.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.81.54.56/24 is down, and ACL 162 denys traffic from 192.168.252.121."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.141.15.218 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.141.15.20.0.0.255 area 0\naccess-list 157 deny ip 192.168.64.101 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.141.15.218/24 (down)", "Routing: OSPF enabled on 10.141.15.20/24 area 0", "ACL 157: deny traffic from 192.168.64.101"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.141.15.218/24 is down, and ACL 157 denys traffic from 192.168.64.101."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.15.12.207 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.15.12.20.0.0.255 area 0\naccess-list 171 deny ip 192.168.123.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.15.12.207/24 (up)", "Routing: OSPF enabled on 10.15.12.20/24 area 0", "ACL 171: deny traffic from 192.168.123.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.15.12.207/24 is up, and ACL 171 denys traffic from 192.168.123.192."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.157.91.223 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.157.91.20.0.0.255 area 0\naccess-list 179 deny ip 192.168.251.74 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.157.91.223/24 (up)", "Routing: OSPF enabled on 10.157.91.20/24 area 0", "ACL 179: deny traffic from 192.168.251.74"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.157.91.223/24 is up, and ACL 179 denys traffic from 192.168.251.74."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.223.63.57 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.223.63.0.0.0.255 area 0\naccess-list 130 permit ip 192.168.24.19 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.223.63.57/24 (down)", "Routing: OSPF enabled on 10.223.63.0/24 area 0", "ACL 130: permit traffic from 192.168.24.19"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.223.63.57/24 is down, and ACL 130 permits traffic from 192.168.24.19."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.112.41.197 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.112.41.10.0.0.255 area 0\naccess-list 168 deny ip 192.168.177.241 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.112.41.197/24 (up)", "Routing: OSPF enabled on 10.112.41.10/24 area 0", "ACL 168: deny traffic from 192.168.177.241"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.112.41.197/24 is up, and ACL 168 denys traffic from 192.168.177.241."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.140.252.234 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.140.252.20.0.0.255 area 0\naccess-list 126 deny ip 192.168.7.7 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.140.252.234/24 (down)", "Routing: OSPF enabled on 10.140.252.20/24 area 0", "ACL 126: deny traffic from 192.168.7.7"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.140.252.234/24 is down, and ACL 126 denys traffic from 192.168.7.7."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.67.36.204 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.67.36.20.0.0.255 area 0\naccess-list 168 permit ip 192.168.103.82 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.67.36.204/24 (down)", "Routing: OSPF enabled on 10.67.36.20/24 area 0", "ACL 168: permit traffic from 192.168.103.82"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.67.36.204/24 is down, and ACL 168 permits traffic from 192.168.103.82."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.155.80.145 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.155.80.10.0.0.255 area 0\naccess-list 109 deny ip 192.168.12.36 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.155.80.145/24 (up)", "Routing: OSPF enabled on 10.155.80.10/24 area 0", "ACL 109: deny traffic from 192.168.12.36"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.155.80.145/24 is up, and ACL 109 denys traffic from 192.168.12.36."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.88.100.175 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.88.100.10.0.0.255 area 0\naccess-list 155 deny ip 192.168.247.89 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.88.100.175/24 (down)", "Routing: OSPF enabled on 10.88.100.10/24 area 0", "ACL 155: deny traffic from 192.168.247.89"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.88.100.175/24 is down, and ACL 155 denys traffic from 192.168.247.89."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.125.91.207 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.125.91.20.0.0.255 area 0\naccess-list 141 permit ip 192.168.144.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.125.91.207/24 (down)", "Routing: OSPF enabled on 10.125.91.20/24 area 0", "ACL 141: permit traffic from 192.168.144.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.125.91.207/24 is down, and ACL 141 permits traffic from 192.168.144.10."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.39.115.130 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.39.115.10.0.0.255 area 0\naccess-list 192 deny ip 192.168.207.122 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.39.115.130/24 (down)", "Routing: OSPF enabled on 10.39.115.10/24 area 0", "ACL 192: deny traffic from 192.168.207.122"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.39.115.130/24 is down, and ACL 192 denys traffic from 192.168.207.122."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.13.204.156 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.13.204.10.0.0.255 area 0\naccess-list 182 deny ip 192.168.218.195 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.13.204.156/24 (up)", "Routing: OSPF enabled on 10.13.204.10/24 area 0", "ACL 182: deny traffic from 192.168.218.195"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.13.204.156/24 is up, and ACL 182 denys traffic from 192.168.218.195."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.200.76.25 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.200.76.0.0.0.255 area 0\naccess-list 118 deny ip 192.168.172.241 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.200.76.25/24 (up)", "Routing: OSPF enabled on 10.200.76.0/24 area 0", "ACL 118: deny traffic from 192.168.172.241"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.200.76.25/24 is up, and ACL 118 denys traffic from 192.168.172.241."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.93.115.59 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.93.115.0.0.0.255 area 0\naccess-list 103 permit ip 192.168.72.235 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.93.115.59/24 (down)", "Routing: OSPF enabled on 10.93.115.0/24 area 0", "ACL 103: permit traffic from 192.168.72.235"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.93.115.59/24 is down, and ACL 103 permits traffic from 192.168.72.235."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.194.225.50 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.194.225.0.0.0.255 area 0\naccess-list 196 deny ip 192.168.152.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.194.225.50/24 (up)", "Routing: OSPF enabled on 10.194.225.0/24 area 0", "ACL 196: deny traffic from 192.168.152.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.194.225.50/24 is up, and ACL 196 denys traffic from 192.168.152.154."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.137.159.186 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.137.159.10.0.0.255 area 0\naccess-list 113 permit ip 192.168.118.124 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.137.159.186/24 (up)", "Routing: OSPF enabled on 10.137.159.10/24 area 0", "ACL 113: permit traffic from 192.168.118.124"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.137.159.186/24 is up, and ACL 113 permits traffic from 192.168.118.124."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.97.40.234 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.97.40.20.0.0.255 area 0\naccess-list 177 deny ip 192.168.167.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.97.40.234/24 (up)", "Routing: OSPF enabled on 10.97.40.20/24 area 0", "ACL 177: deny traffic from 192.168.167.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.97.40.234/24 is up, and ACL 177 denys traffic from 192.168.167.25."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.214.62.200 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.214.62.20.0.0.255 area 0\naccess-list 147 deny ip 192.168.179.6 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.214.62.200/24 (down)", "Routing: OSPF enabled on 10.214.62.20/24 area 0", "ACL 147: deny traffic from 192.168.179.6"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.214.62.200/24 is down, and ACL 147 denys traffic from 192.168.179.6."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.252.122.105 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.252.122.10.0.0.255 area 0\naccess-list 132 deny ip 192.168.162.182 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.252.122.105/24 (up)", "Routing: OSPF enabled on 10.252.122.10/24 area 0", "ACL 132: deny traffic from 192.168.162.182"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.252.122.105/24 is up, and ACL 132 denys traffic from 192.168.162.182."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.133.13.224 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.133.13.20.0.0.255 area 0\naccess-list 152 deny ip 192.168.181.87 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.133.13.224/24 (up)", "Routing: OSPF enabled on 10.133.13.20/24 area 0", "ACL 152: deny traffic from 192.168.181.87"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.133.13.224/24 is up, and ACL 152 denys traffic from 192.168.181.87."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.216.182.252 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.216.182.20.0.0.255 area 0\naccess-list 147 deny ip 192.168.15.79 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.216.182.252/24 (down)", "Routing: OSPF enabled on 10.216.182.20/24 area 0", "ACL 147: deny traffic from 192.168.15.79"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.216.182.252/24 is down, and ACL 147 denys traffic from 192.168.15.79."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.161.177.149 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.161.177.10.0.0.255 area 0\naccess-list 164 permit ip 192.168.148.131 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.161.177.149/24 (down)", "Routing: OSPF enabled on 10.161.177.10/24 area 0", "ACL 164: permit traffic from 192.168.148.131"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.161.177.149/24 is down, and ACL 164 permits traffic from 192.168.148.131."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.152.221.127 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.152.221.10.0.0.255 area 0\naccess-list 198 permit ip 192.168.43.58 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.152.221.127/24 (up)", "Routing: OSPF enabled on 10.152.221.10/24 area 0", "ACL 198: permit traffic from 192.168.43.58"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.152.221.127/24 is up, and ACL 198 permits traffic from 192.168.43.58."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.115.204.114 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.115.204.10.0.0.255 area 0\naccess-list 107 permit ip 192.168.18.97 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.115.204.114/24 (down)", "Routing: OSPF enabled on 10.115.204.10/24 area 0", "ACL 107: permit traffic from 192.168.18.97"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.115.204.114/24 is down, and ACL 107 permits traffic from 192.168.18.97."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.31.148.200 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.31.148.20.0.0.255 area 0\naccess-list 134 permit ip 192.168.182.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.31.148.200/24 (up)", "Routing: OSPF enabled on 10.31.148.20/24 area 0", "ACL 134: permit traffic from 192.168.182.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.31.148.200/24 is up, and ACL 134 permits traffic from 192.168.182.67."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.30.202.244 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.30.202.20.0.0.255 area 0\naccess-list 168 permit ip 192.168.118.162 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.30.202.244/24 (down)", "Routing: OSPF enabled on 10.30.202.20/24 area 0", "ACL 168: permit traffic from 192.168.118.162"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.30.202.244/24 is down, and ACL 168 permits traffic from 192.168.118.162."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.46.188.181 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.46.188.10.0.0.255 area 0\naccess-list 110 deny ip 192.168.82.203 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.46.188.181/24 (down)", "Routing: OSPF enabled on 10.46.188.10/24 area 0", "ACL 110: deny traffic from 192.168.82.203"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.46.188.181/24 is down, and ACL 110 denys traffic from 192.168.82.203."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.62.122.133 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.62.122.10.0.0.255 area 0\naccess-list 117 deny ip 192.168.215.70 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.62.122.133/24 (up)", "Routing: OSPF enabled on 10.62.122.10/24 area 0", "ACL 117: deny traffic from 192.168.215.70"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.62.122.133/24 is up, and ACL 117 denys traffic from 192.168.215.70."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.66.76.75 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.66.76.0.0.0.255 area 0\naccess-list 117 deny ip 192.168.44.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.66.76.75/24 (down)", "Routing: OSPF enabled on 10.66.76.0/24 area 0", "ACL 117: deny traffic from 192.168.44.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.66.76.75/24 is down, and ACL 117 denys traffic from 192.168.44.120."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.26.6.188 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.26.6.10.0.0.255 area 0\naccess-list 118 deny ip 192.168.151.124 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.26.6.188/24 (down)", "Routing: OSPF enabled on 10.26.6.10/24 area 0", "ACL 118: deny traffic from 192.168.151.124"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.26.6.188/24 is down, and ACL 118 denys traffic from 192.168.151.124."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.58.185.91 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.58.185.0.0.0.255 area 0\naccess-list 136 deny ip 192.168.171.209 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.58.185.91/24 (down)", "Routing: OSPF enabled on 10.58.185.0/24 area 0", "ACL 136: deny traffic from 192.168.171.209"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.58.185.91/24 is down, and ACL 136 denys traffic from 192.168.171.209."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.196.178.149 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.196.178.10.0.0.255 area 0\naccess-list 154 permit ip 192.168.158.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.196.178.149/24 (up)", "Routing: OSPF enabled on 10.196.178.10/24 area 0", "ACL 154: permit traffic from 192.168.158.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.196.178.149/24 is up, and ACL 154 permits traffic from 192.168.158.233."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.24.106.241 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.24.106.20.0.0.255 area 0\naccess-list 179 deny ip 192.168.56.34 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.24.106.241/24 (down)", "Routing: OSPF enabled on 10.24.106.20/24 area 0", "ACL 179: deny traffic from 192.168.56.34"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.24.106.241/24 is down, and ACL 179 denys traffic from 192.168.56.34."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.132.147.43 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.132.147.0.0.0.255 area 0\naccess-list 193 permit ip 192.168.5.112 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.132.147.43/24 (down)", "Routing: OSPF enabled on 10.132.147.0/24 area 0", "ACL 193: permit traffic from 192.168.5.112"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.132.147.43/24 is down, and ACL 193 permits traffic from 192.168.5.112."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.175.221.114 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.175.221.10.0.0.255 area 0\naccess-list 152 deny ip 192.168.107.168 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.175.221.114/24 (down)", "Routing: OSPF enabled on 10.175.221.10/24 area 0", "ACL 152: deny traffic from 192.168.107.168"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.175.221.114/24 is down, and ACL 152 denys traffic from 192.168.107.168."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.68.95.33 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.68.95.0.0.0.255 area 0\naccess-list 114 deny ip 192.168.7.214 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.68.95.33/24 (up)", "Routing: OSPF enabled on 10.68.95.0/24 area 0", "ACL 114: deny traffic from 192.168.7.214"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.68.95.33/24 is up, and ACL 114 denys traffic from 192.168.7.214."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.176.138.233 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.176.138.20.0.0.255 area 0\naccess-list 186 deny ip 192.168.142.207 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.176.138.233/24 (up)", "Routing: OSPF enabled on 10.176.138.20/24 area 0", "ACL 186: deny traffic from 192.168.142.207"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.176.138.233/24 is up, and ACL 186 denys traffic from 192.168.142.207."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.24.62.189 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.24.62.10.0.0.255 area 0\naccess-list 163 permit ip 192.168.215.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.24.62.189/24 (up)", "Routing: OSPF enabled on 10.24.62.10/24 area 0", "ACL 163: permit traffic from 192.168.215.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.24.62.189/24 is up, and ACL 163 permits traffic from 192.168.215.254."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.171.143.33 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.171.143.0.0.0.255 area 0\naccess-list 153 permit ip 192.168.26.177 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.171.143.33/24 (up)", "Routing: OSPF enabled on 10.171.143.0/24 area 0", "ACL 153: permit traffic from 192.168.26.177"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.171.143.33/24 is up, and ACL 153 permits traffic from 192.168.26.177."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.195.2.210 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.195.2.20.0.0.255 area 0\naccess-list 101 permit ip 192.168.180.110 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.195.2.210/24 (up)", "Routing: OSPF enabled on 10.195.2.20/24 area 0", "ACL 101: permit traffic from 192.168.180.110"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.195.2.210/24 is up, and ACL 101 permits traffic from 192.168.180.110."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.122.103.168 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.122.103.10.0.0.255 area 0\naccess-list 198 deny ip 192.168.58.214 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.122.103.168/24 (down)", "Routing: OSPF enabled on 10.122.103.10/24 area 0", "ACL 198: deny traffic from 192.168.58.214"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.122.103.168/24 is down, and ACL 198 denys traffic from 192.168.58.214."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.102.191.230 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.102.191.20.0.0.255 area 0\naccess-list 162 deny ip 192.168.244.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.102.191.230/24 (down)", "Routing: OSPF enabled on 10.102.191.20/24 area 0", "ACL 162: deny traffic from 192.168.244.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.102.191.230/24 is down, and ACL 162 denys traffic from 192.168.244.69."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.202.221.246 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.202.221.20.0.0.255 area 0\naccess-list 115 deny ip 192.168.87.168 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.202.221.246/24 (down)", "Routing: OSPF enabled on 10.202.221.20/24 area 0", "ACL 115: deny traffic from 192.168.87.168"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.202.221.246/24 is down, and ACL 115 denys traffic from 192.168.87.168."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.137.49.211 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.137.49.20.0.0.255 area 0\naccess-list 177 permit ip 192.168.7.164 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.137.49.211/24 (up)", "Routing: OSPF enabled on 10.137.49.20/24 area 0", "ACL 177: permit traffic from 192.168.7.164"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.137.49.211/24 is up, and ACL 177 permits traffic from 192.168.7.164."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.19.216.85 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.19.216.0.0.0.255 area 0\naccess-list 133 deny ip 192.168.216.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.19.216.85/24 (up)", "Routing: OSPF enabled on 10.19.216.0/24 area 0", "ACL 133: deny traffic from 192.168.216.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.19.216.85/24 is up, and ACL 133 denys traffic from 192.168.216.208."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.101.209.179 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.101.209.10.0.0.255 area 0\naccess-list 147 permit ip 192.168.72.138 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.101.209.179/24 (down)", "Routing: OSPF enabled on 10.101.209.10/24 area 0", "ACL 147: permit traffic from 192.168.72.138"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.101.209.179/24 is down, and ACL 147 permits traffic from 192.168.72.138."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.53.35.178 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.53.35.10.0.0.255 area 0\naccess-list 139 permit ip 192.168.240.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.53.35.178/24 (up)", "Routing: OSPF enabled on 10.53.35.10/24 area 0", "ACL 139: permit traffic from 192.168.240.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.53.35.178/24 is up, and ACL 139 permits traffic from 192.168.240.92."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.3.215.199 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.3.215.10.0.0.255 area 0\naccess-list 169 deny ip 192.168.210.111 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.3.215.199/24 (up)", "Routing: OSPF enabled on 10.3.215.10/24 area 0", "ACL 169: deny traffic from 192.168.210.111"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.3.215.199/24 is up, and ACL 169 denys traffic from 192.168.210.111."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.182.85.140 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.182.85.10.0.0.255 area 0\naccess-list 159 permit ip 192.168.181.33 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.182.85.140/24 (down)", "Routing: OSPF enabled on 10.182.85.10/24 area 0", "ACL 159: permit traffic from 192.168.181.33"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.182.85.140/24 is down, and ACL 159 permits traffic from 192.168.181.33."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.133.242.243 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.133.242.20.0.0.255 area 0\naccess-list 102 permit ip 192.168.249.55 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.133.242.243/24 (down)", "Routing: OSPF enabled on 10.133.242.20/24 area 0", "ACL 102: permit traffic from 192.168.249.55"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.133.242.243/24 is down, and ACL 102 permits traffic from 192.168.249.55."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.3.226.150 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.3.226.10.0.0.255 area 0\naccess-list 174 permit ip 192.168.217.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.3.226.150/24 (up)", "Routing: OSPF enabled on 10.3.226.10/24 area 0", "ACL 174: permit traffic from 192.168.217.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.3.226.150/24 is up, and ACL 174 permits traffic from 192.168.217.95."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.162.238.77 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.162.238.0.0.0.255 area 0\naccess-list 115 permit ip 192.168.187.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.162.238.77/24 (up)", "Routing: OSPF enabled on 10.162.238.0/24 area 0", "ACL 115: permit traffic from 192.168.187.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.162.238.77/24 is up, and ACL 115 permits traffic from 192.168.187.114."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.61.29.181 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.61.29.10.0.0.255 area 0\naccess-list 101 deny ip 192.168.234.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.61.29.181/24 (down)", "Routing: OSPF enabled on 10.61.29.10/24 area 0", "ACL 101: deny traffic from 192.168.234.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.61.29.181/24 is down, and ACL 101 denys traffic from 192.168.234.85."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.65.227.40 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.65.227.0.0.0.255 area 0\naccess-list 187 permit ip 192.168.11.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.65.227.40/24 (down)", "Routing: OSPF enabled on 10.65.227.0/24 area 0", "ACL 187: permit traffic from 192.168.11.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.65.227.40/24 is down, and ACL 187 permits traffic from 192.168.11.109."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.238.140.120 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.238.140.10.0.0.255 area 0\naccess-list 120 permit ip 192.168.204.72 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.238.140.120/24 (down)", "Routing: OSPF enabled on 10.238.140.10/24 area 0", "ACL 120: permit traffic from 192.168.204.72"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.238.140.120/24 is down, and ACL 120 permits traffic from 192.168.204.72."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.128.144.146 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.128.144.10.0.0.255 area 0\naccess-list 105 deny ip 192.168.140.244 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.128.144.146/24 (up)", "Routing: OSPF enabled on 10.128.144.10/24 area 0", "ACL 105: deny traffic from 192.168.140.244"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.128.144.146/24 is up, and ACL 105 denys traffic from 192.168.140.244."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.80.150.200 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.80.150.20.0.0.255 area 0\naccess-list 137 permit ip 192.168.129.162 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.80.150.200/24 (up)", "Routing: OSPF enabled on 10.80.150.20/24 area 0", "ACL 137: permit traffic from 192.168.129.162"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.80.150.200/24 is up, and ACL 137 permits traffic from 192.168.129.162."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.192.199.126 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.192.199.10.0.0.255 area 0\naccess-list 153 deny ip 192.168.106.156 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.192.199.126/24 (up)", "Routing: OSPF enabled on 10.192.199.10/24 area 0", "ACL 153: deny traffic from 192.168.106.156"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.192.199.126/24 is up, and ACL 153 denys traffic from 192.168.106.156."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.213.236.96 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.213.236.0.0.0.255 area 0\naccess-list 122 deny ip 192.168.125.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.213.236.96/24 (down)", "Routing: OSPF enabled on 10.213.236.0/24 area 0", "ACL 122: deny traffic from 192.168.125.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.213.236.96/24 is down, and ACL 122 denys traffic from 192.168.125.154."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.116.213.115 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.116.213.10.0.0.255 area 0\naccess-list 174 permit ip 192.168.216.0 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.116.213.115/24 (down)", "Routing: OSPF enabled on 10.116.213.10/24 area 0", "ACL 174: permit traffic from 192.168.216.0"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.116.213.115/24 is down, and ACL 174 permits traffic from 192.168.216.0."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.123.187.202 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.123.187.20.0.0.255 area 0\naccess-list 196 deny ip 192.168.4.151 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.123.187.202/24 (down)", "Routing: OSPF enabled on 10.123.187.20/24 area 0", "ACL 196: deny traffic from 192.168.4.151"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.123.187.202/24 is down, and ACL 196 denys traffic from 192.168.4.151."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.52.30.112 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.52.30.10.0.0.255 area 0\naccess-list 161 deny ip 192.168.14.39 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.52.30.112/24 (up)", "Routing: OSPF enabled on 10.52.30.10/24 area 0", "ACL 161: deny traffic from 192.168.14.39"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.52.30.112/24 is up, and ACL 161 denys traffic from 192.168.14.39."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.133.159.70 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.133.159.0.0.0.255 area 0\naccess-list 144 deny ip 192.168.158.17 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.133.159.70/24 (up)", "Routing: OSPF enabled on 10.133.159.0/24 area 0", "ACL 144: deny traffic from 192.168.158.17"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.133.159.70/24 is up, and ACL 144 denys traffic from 192.168.158.17."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.198.62.46 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.198.62.0.0.0.255 area 0\naccess-list 187 deny ip 192.168.219.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.198.62.46/24 (up)", "Routing: OSPF enabled on 10.198.62.0/24 area 0", "ACL 187: deny traffic from 192.168.219.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.198.62.46/24 is up, and ACL 187 denys traffic from 192.168.219.94."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.66.213.76 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.66.213.0.0.0.255 area 0\naccess-list 169 permit ip 192.168.22.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.66.213.76/24 (up)", "Routing: OSPF enabled on 10.66.213.0/24 area 0", "ACL 169: permit traffic from 192.168.22.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.66.213.76/24 is up, and ACL 169 permits traffic from 192.168.22.53."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.89.37.207 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.89.37.20.0.0.255 area 0\naccess-list 171 permit ip 192.168.179.26 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.89.37.207/24 (up)", "Routing: OSPF enabled on 10.89.37.20/24 area 0", "ACL 171: permit traffic from 192.168.179.26"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.89.37.207/24 is up, and ACL 171 permits traffic from 192.168.179.26."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.119.138.104 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.119.138.10.0.0.255 area 0\naccess-list 128 deny ip 192.168.85.159 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.119.138.104/24 (up)", "Routing: OSPF enabled on 10.119.138.10/24 area 0", "ACL 128: deny traffic from 192.168.85.159"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.119.138.104/24 is up, and ACL 128 denys traffic from 192.168.85.159."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.234.222.35 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.234.222.0.0.0.255 area 0\naccess-list 140 deny ip 192.168.189.223 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.234.222.35/24 (down)", "Routing: OSPF enabled on 10.234.222.0/24 area 0", "ACL 140: deny traffic from 192.168.189.223"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.234.222.35/24 is down, and ACL 140 denys traffic from 192.168.189.223."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.59.236.119 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.59.236.10.0.0.255 area 0\naccess-list 175 permit ip 192.168.136.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.59.236.119/24 (up)", "Routing: OSPF enabled on 10.59.236.10/24 area 0", "ACL 175: permit traffic from 192.168.136.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.59.236.119/24 is up, and ACL 175 permits traffic from 192.168.136.48."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.146.63.57 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.146.63.0.0.0.255 area 0\naccess-list 171 deny ip 192.168.221.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.146.63.57/24 (down)", "Routing: OSPF enabled on 10.146.63.0/24 area 0", "ACL 171: deny traffic from 192.168.221.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.146.63.57/24 is down, and ACL 171 denys traffic from 192.168.221.186."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.8.23.107 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.8.23.10.0.0.255 area 0\naccess-list 196 deny ip 192.168.63.150 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.8.23.107/24 (down)", "Routing: OSPF enabled on 10.8.23.10/24 area 0", "ACL 196: deny traffic from 192.168.63.150"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.8.23.107/24 is down, and ACL 196 denys traffic from 192.168.63.150."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.131.81.181 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.131.81.10.0.0.255 area 0\naccess-list 146 permit ip 192.168.160.16 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.131.81.181/24 (down)", "Routing: OSPF enabled on 10.131.81.10/24 area 0", "ACL 146: permit traffic from 192.168.160.16"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.131.81.181/24 is down, and ACL 146 permits traffic from 192.168.160.16."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.46.253.188 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.46.253.10.0.0.255 area 0\naccess-list 163 permit ip 192.168.16.39 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.46.253.188/24 (up)", "Routing: OSPF enabled on 10.46.253.10/24 area 0", "ACL 163: permit traffic from 192.168.16.39"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.46.253.188/24 is up, and ACL 163 permits traffic from 192.168.16.39."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.169.6.221 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.169.6.20.0.0.255 area 0\naccess-list 102 deny ip 192.168.2.224 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.169.6.221/24 (down)", "Routing: OSPF enabled on 10.169.6.20/24 area 0", "ACL 102: deny traffic from 192.168.2.224"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.169.6.221/24 is down, and ACL 102 denys traffic from 192.168.2.224."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.159.106.147 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.159.106.10.0.0.255 area 0\naccess-list 158 deny ip 192.168.49.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.159.106.147/24 (up)", "Routing: OSPF enabled on 10.159.106.10/24 area 0", "ACL 158: deny traffic from 192.168.49.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.159.106.147/24 is up, and ACL 158 denys traffic from 192.168.49.38."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.98.148.207 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.98.148.20.0.0.255 area 0\naccess-list 179 permit ip 192.168.91.252 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.98.148.207/24 (up)", "Routing: OSPF enabled on 10.98.148.20/24 area 0", "ACL 179: permit traffic from 192.168.91.252"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.98.148.207/24 is up, and ACL 179 permits traffic from 192.168.91.252."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.82.226.244 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.82.226.20.0.0.255 area 0\naccess-list 156 deny ip 192.168.254.115 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.82.226.244/24 (up)", "Routing: OSPF enabled on 10.82.226.20/24 area 0", "ACL 156: deny traffic from 192.168.254.115"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.82.226.244/24 is up, and ACL 156 denys traffic from 192.168.254.115."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.136.22.100 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.136.22.10.0.0.255 area 0\naccess-list 174 permit ip 192.168.80.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.136.22.100/24 (up)", "Routing: OSPF enabled on 10.136.22.10/24 area 0", "ACL 174: permit traffic from 192.168.80.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.136.22.100/24 is up, and ACL 174 permits traffic from 192.168.80.134."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.98.173.66 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.98.173.0.0.0.255 area 0\naccess-list 160 permit ip 192.168.212.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.98.173.66/24 (up)", "Routing: OSPF enabled on 10.98.173.0/24 area 0", "ACL 160: permit traffic from 192.168.212.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.98.173.66/24 is up, and ACL 160 permits traffic from 192.168.212.13."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.180.148.68 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.180.148.0.0.0.255 area 0\naccess-list 125 deny ip 192.168.244.51 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.180.148.68/24 (down)", "Routing: OSPF enabled on 10.180.148.0/24 area 0", "ACL 125: deny traffic from 192.168.244.51"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.180.148.68/24 is down, and ACL 125 denys traffic from 192.168.244.51."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.207.14.15 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.207.14.0.0.0.255 area 0\naccess-list 196 deny ip 192.168.199.175 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.207.14.15/24 (up)", "Routing: OSPF enabled on 10.207.14.0/24 area 0", "ACL 196: deny traffic from 192.168.199.175"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.207.14.15/24 is up, and ACL 196 denys traffic from 192.168.199.175."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.4.180.74 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.4.180.0.0.0.255 area 0\naccess-list 178 deny ip 192.168.15.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.4.180.74/24 (down)", "Routing: OSPF enabled on 10.4.180.0/24 area 0", "ACL 178: deny traffic from 192.168.15.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.4.180.74/24 is down, and ACL 178 denys traffic from 192.168.15.199."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.183.233.51 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.183.233.0.0.0.255 area 0\naccess-list 151 permit ip 192.168.223.145 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.183.233.51/24 (down)", "Routing: OSPF enabled on 10.183.233.0/24 area 0", "ACL 151: permit traffic from 192.168.223.145"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.183.233.51/24 is down, and ACL 151 permits traffic from 192.168.223.145."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.249.170.196 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.249.170.10.0.0.255 area 0\naccess-list 148 deny ip 192.168.78.118 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.249.170.196/24 (up)", "Routing: OSPF enabled on 10.249.170.10/24 area 0", "ACL 148: deny traffic from 192.168.78.118"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.249.170.196/24 is up, and ACL 148 denys traffic from 192.168.78.118."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.175.247.110 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.175.247.10.0.0.255 area 0\naccess-list 168 deny ip 192.168.107.88 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.175.247.110/24 (down)", "Routing: OSPF enabled on 10.175.247.10/24 area 0", "ACL 168: deny traffic from 192.168.107.88"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.175.247.110/24 is down, and ACL 168 denys traffic from 192.168.107.88."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.217.64.69 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.217.64.0.0.0.255 area 0\naccess-list 141 deny ip 192.168.153.111 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.217.64.69/24 (down)", "Routing: OSPF enabled on 10.217.64.0/24 area 0", "ACL 141: deny traffic from 192.168.153.111"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.217.64.69/24 is down, and ACL 141 denys traffic from 192.168.153.111."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.69.193.157 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.69.193.10.0.0.255 area 0\naccess-list 143 deny ip 192.168.68.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.69.193.157/24 (up)", "Routing: OSPF enabled on 10.69.193.10/24 area 0", "ACL 143: deny traffic from 192.168.68.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.69.193.157/24 is up, and ACL 143 denys traffic from 192.168.68.95."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.16.64.168 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.16.64.10.0.0.255 area 0\naccess-list 119 permit ip 192.168.104.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.16.64.168/24 (down)", "Routing: OSPF enabled on 10.16.64.10/24 area 0", "ACL 119: permit traffic from 192.168.104.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.16.64.168/24 is down, and ACL 119 permits traffic from 192.168.104.107."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.167.119.191 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.167.119.10.0.0.255 area 0\naccess-list 192 deny ip 192.168.215.166 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.167.119.191/24 (down)", "Routing: OSPF enabled on 10.167.119.10/24 area 0", "ACL 192: deny traffic from 192.168.215.166"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.167.119.191/24 is down, and ACL 192 denys traffic from 192.168.215.166."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.3.181.211 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.3.181.20.0.0.255 area 0\naccess-list 108 permit ip 192.168.137.145 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.3.181.211/24 (down)", "Routing: OSPF enabled on 10.3.181.20/24 area 0", "ACL 108: permit traffic from 192.168.137.145"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.3.181.211/24 is down, and ACL 108 permits traffic from 192.168.137.145."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.88.43.209 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.88.43.20.0.0.255 area 0\naccess-list 121 deny ip 192.168.146.158 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.88.43.209/24 (up)", "Routing: OSPF enabled on 10.88.43.20/24 area 0", "ACL 121: deny traffic from 192.168.146.158"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.88.43.209/24 is up, and ACL 121 denys traffic from 192.168.146.158."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.199.166.151 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.199.166.10.0.0.255 area 0\naccess-list 181 deny ip 192.168.212.149 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.199.166.151/24 (up)", "Routing: OSPF enabled on 10.199.166.10/24 area 0", "ACL 181: deny traffic from 192.168.212.149"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.199.166.151/24 is up, and ACL 181 denys traffic from 192.168.212.149."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.169.45.201 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.169.45.20.0.0.255 area 0\naccess-list 166 permit ip 192.168.224.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.169.45.201/24 (up)", "Routing: OSPF enabled on 10.169.45.20/24 area 0", "ACL 166: permit traffic from 192.168.224.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.169.45.201/24 is up, and ACL 166 permits traffic from 192.168.224.245."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.147.243.149 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.147.243.10.0.0.255 area 0\naccess-list 161 deny ip 192.168.96.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.147.243.149/24 (up)", "Routing: OSPF enabled on 10.147.243.10/24 area 0", "ACL 161: deny traffic from 192.168.96.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.147.243.149/24 is up, and ACL 161 denys traffic from 192.168.96.206."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.149.199.25 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.149.199.0.0.0.255 area 0\naccess-list 113 permit ip 192.168.120.36 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.149.199.25/24 (down)", "Routing: OSPF enabled on 10.149.199.0/24 area 0", "ACL 113: permit traffic from 192.168.120.36"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.149.199.25/24 is down, and ACL 113 permits traffic from 192.168.120.36."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.75.215.79 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.75.215.0.0.0.255 area 0\naccess-list 161 permit ip 192.168.146.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.75.215.79/24 (up)", "Routing: OSPF enabled on 10.75.215.0/24 area 0", "ACL 161: permit traffic from 192.168.146.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.75.215.79/24 is up, and ACL 161 permits traffic from 192.168.146.221."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.182.234.201 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.182.234.20.0.0.255 area 0\naccess-list 161 deny ip 192.168.43.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.182.234.201/24 (down)", "Routing: OSPF enabled on 10.182.234.20/24 area 0", "ACL 161: deny traffic from 192.168.43.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.182.234.201/24 is down, and ACL 161 denys traffic from 192.168.43.148."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.255.143.72 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.255.143.0.0.0.255 area 0\naccess-list 103 deny ip 192.168.214.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.255.143.72/24 (down)", "Routing: OSPF enabled on 10.255.143.0/24 area 0", "ACL 103: deny traffic from 192.168.214.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.255.143.72/24 is down, and ACL 103 denys traffic from 192.168.214.199."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.204.105.187 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.204.105.10.0.0.255 area 0\naccess-list 171 permit ip 192.168.29.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.204.105.187/24 (down)", "Routing: OSPF enabled on 10.204.105.10/24 area 0", "ACL 171: permit traffic from 192.168.29.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.204.105.187/24 is down, and ACL 171 permits traffic from 192.168.29.206."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.21.3.9 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.21.30.0.0.255 area 0\naccess-list 124 deny ip 192.168.79.4 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.21.3.9/24 (down)", "Routing: OSPF enabled on 10.21.30/24 area 0", "ACL 124: deny traffic from 192.168.79.4"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.21.3.9/24 is down, and ACL 124 denys traffic from 192.168.79.4."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.68.122.91 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.68.122.0.0.0.255 area 0\naccess-list 128 permit ip 192.168.247.81 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.68.122.91/24 (down)", "Routing: OSPF enabled on 10.68.122.0/24 area 0", "ACL 128: permit traffic from 192.168.247.81"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.68.122.91/24 is down, and ACL 128 permits traffic from 192.168.247.81."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.47.78.30 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.47.78.0.0.0.255 area 0\naccess-list 157 deny ip 192.168.171.240 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.47.78.30/24 (up)", "Routing: OSPF enabled on 10.47.78.0/24 area 0", "ACL 157: deny traffic from 192.168.171.240"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.47.78.30/24 is up, and ACL 157 denys traffic from 192.168.171.240."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.113.246.147 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.113.246.10.0.0.255 area 0\naccess-list 113 deny ip 192.168.118.161 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.113.246.147/24 (down)", "Routing: OSPF enabled on 10.113.246.10/24 area 0", "ACL 113: deny traffic from 192.168.118.161"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.113.246.147/24 is down, and ACL 113 denys traffic from 192.168.118.161."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.17.190.51 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.17.190.0.0.0.255 area 0\naccess-list 175 deny ip 192.168.172.144 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.17.190.51/24 (up)", "Routing: OSPF enabled on 10.17.190.0/24 area 0", "ACL 175: deny traffic from 192.168.172.144"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.17.190.51/24 is up, and ACL 175 denys traffic from 192.168.172.144."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.48.178.195 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.48.178.10.0.0.255 area 0\naccess-list 148 permit ip 192.168.140.103 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.48.178.195/24 (down)", "Routing: OSPF enabled on 10.48.178.10/24 area 0", "ACL 148: permit traffic from 192.168.140.103"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.48.178.195/24 is down, and ACL 148 permits traffic from 192.168.140.103."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.93.7.59 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.93.7.0.0.0.255 area 0\naccess-list 193 deny ip 192.168.240.84 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.93.7.59/24 (down)", "Routing: OSPF enabled on 10.93.7.0/24 area 0", "ACL 193: deny traffic from 192.168.240.84"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.93.7.59/24 is down, and ACL 193 denys traffic from 192.168.240.84."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.89.60.252 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.89.60.20.0.0.255 area 0\naccess-list 158 deny ip 192.168.224.247 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.89.60.252/24 (down)", "Routing: OSPF enabled on 10.89.60.20/24 area 0", "ACL 158: deny traffic from 192.168.224.247"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.89.60.252/24 is down, and ACL 158 denys traffic from 192.168.224.247."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.238.177.62 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.238.177.0.0.0.255 area 0\naccess-list 105 permit ip 192.168.180.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.238.177.62/24 (down)", "Routing: OSPF enabled on 10.238.177.0/24 area 0", "ACL 105: permit traffic from 192.168.180.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.238.177.62/24 is down, and ACL 105 permits traffic from 192.168.180.120."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.44.56.222 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.44.56.20.0.0.255 area 0\naccess-list 104 permit ip 192.168.248.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.44.56.222/24 (down)", "Routing: OSPF enabled on 10.44.56.20/24 area 0", "ACL 104: permit traffic from 192.168.248.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.44.56.222/24 is down, and ACL 104 permits traffic from 192.168.248.134."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.235.8.231 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.235.8.20.0.0.255 area 0\naccess-list 114 deny ip 192.168.8.61 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.235.8.231/24 (up)", "Routing: OSPF enabled on 10.235.8.20/24 area 0", "ACL 114: deny traffic from 192.168.8.61"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.235.8.231/24 is up, and ACL 114 denys traffic from 192.168.8.61."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.72.63.23 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.72.63.0.0.0.255 area 0\naccess-list 119 permit ip 192.168.188.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.72.63.23/24 (down)", "Routing: OSPF enabled on 10.72.63.0/24 area 0", "ACL 119: permit traffic from 192.168.188.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.72.63.23/24 is down, and ACL 119 permits traffic from 192.168.188.154."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.146.152.14 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.146.152.0.0.0.255 area 0\naccess-list 144 deny ip 192.168.10.91 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.146.152.14/24 (down)", "Routing: OSPF enabled on 10.146.152.0/24 area 0", "ACL 144: deny traffic from 192.168.10.91"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.146.152.14/24 is down, and ACL 144 denys traffic from 192.168.10.91."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.59.131.134 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.59.131.10.0.0.255 area 0\naccess-list 138 permit ip 192.168.8.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.59.131.134/24 (up)", "Routing: OSPF enabled on 10.59.131.10/24 area 0", "ACL 138: permit traffic from 192.168.8.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.59.131.134/24 is up, and ACL 138 permits traffic from 192.168.8.242."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.182.110.166 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.182.110.10.0.0.255 area 0\naccess-list 194 permit ip 192.168.18.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.182.110.166/24 (down)", "Routing: OSPF enabled on 10.182.110.10/24 area 0", "ACL 194: permit traffic from 192.168.18.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.182.110.166/24 is down, and ACL 194 permits traffic from 192.168.18.233."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.242.93.22 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.242.93.0.0.0.255 area 0\naccess-list 126 permit ip 192.168.71.218 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.242.93.22/24 (up)", "Routing: OSPF enabled on 10.242.93.0/24 area 0", "ACL 126: permit traffic from 192.168.71.218"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.242.93.22/24 is up, and ACL 126 permits traffic from 192.168.71.218."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.204.165.126 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.204.165.10.0.0.255 area 0\naccess-list 176 permit ip 192.168.12.181 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.204.165.126/24 (down)", "Routing: OSPF enabled on 10.204.165.10/24 area 0", "ACL 176: permit traffic from 192.168.12.181"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.204.165.126/24 is down, and ACL 176 permits traffic from 192.168.12.181."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.85.117.183 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.85.117.10.0.0.255 area 0\naccess-list 105 permit ip 192.168.121.19 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.85.117.183/24 (down)", "Routing: OSPF enabled on 10.85.117.10/24 area 0", "ACL 105: permit traffic from 192.168.121.19"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.85.117.183/24 is down, and ACL 105 permits traffic from 192.168.121.19."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.127.139.86 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.127.139.0.0.0.255 area 0\naccess-list 176 permit ip 192.168.174.150 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.127.139.86/24 (down)", "Routing: OSPF enabled on 10.127.139.0/24 area 0", "ACL 176: permit traffic from 192.168.174.150"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.127.139.86/24 is down, and ACL 176 permits traffic from 192.168.174.150."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.149.11.83 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.149.11.0.0.0.255 area 0\naccess-list 162 deny ip 192.168.136.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.149.11.83/24 (up)", "Routing: OSPF enabled on 10.149.11.0/24 area 0", "ACL 162: deny traffic from 192.168.136.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.149.11.83/24 is up, and ACL 162 denys traffic from 192.168.136.121."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.141.53.80 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.141.53.0.0.0.255 area 0\naccess-list 182 deny ip 192.168.208.84 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.141.53.80/24 (down)", "Routing: OSPF enabled on 10.141.53.0/24 area 0", "ACL 182: deny traffic from 192.168.208.84"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.141.53.80/24 is down, and ACL 182 denys traffic from 192.168.208.84."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.39.2.92 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.39.2.0.0.0.255 area 0\naccess-list 188 deny ip 192.168.47.80 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.39.2.92/24 (down)", "Routing: OSPF enabled on 10.39.2.0/24 area 0", "ACL 188: deny traffic from 192.168.47.80"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.39.2.92/24 is down, and ACL 188 denys traffic from 192.168.47.80."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.129.254.183 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.129.254.10.0.0.255 area 0\naccess-list 147 deny ip 192.168.211.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.129.254.183/24 (up)", "Routing: OSPF enabled on 10.129.254.10/24 area 0", "ACL 147: deny traffic from 192.168.211.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.129.254.183/24 is up, and ACL 147 denys traffic from 192.168.211.49."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.89.17.198 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.89.17.10.0.0.255 area 0\naccess-list 186 permit ip 192.168.250.12 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.89.17.198/24 (up)", "Routing: OSPF enabled on 10.89.17.10/24 area 0", "ACL 186: permit traffic from 192.168.250.12"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.89.17.198/24 is up, and ACL 186 permits traffic from 192.168.250.12."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.23.44.46 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.23.44.0.0.0.255 area 0\naccess-list 197 deny ip 192.168.237.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.23.44.46/24 (down)", "Routing: OSPF enabled on 10.23.44.0/24 area 0", "ACL 197: deny traffic from 192.168.237.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.23.44.46/24 is down, and ACL 197 denys traffic from 192.168.237.37."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.31.223.134 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.31.223.10.0.0.255 area 0\naccess-list 162 permit ip 192.168.105.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.31.223.134/24 (up)", "Routing: OSPF enabled on 10.31.223.10/24 area 0", "ACL 162: permit traffic from 192.168.105.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.31.223.134/24 is up, and ACL 162 permits traffic from 192.168.105.220."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.36.54.187 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.36.54.10.0.0.255 area 0\naccess-list 120 deny ip 192.168.62.93 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.36.54.187/24 (up)", "Routing: OSPF enabled on 10.36.54.10/24 area 0", "ACL 120: deny traffic from 192.168.62.93"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.36.54.187/24 is up, and ACL 120 denys traffic from 192.168.62.93."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.224.75.97 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.224.75.0.0.0.255 area 0\naccess-list 141 deny ip 192.168.242.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.224.75.97/24 (down)", "Routing: OSPF enabled on 10.224.75.0/24 area 0", "ACL 141: deny traffic from 192.168.242.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.224.75.97/24 is down, and ACL 141 denys traffic from 192.168.242.233."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.120.8.45 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.120.8.0.0.0.255 area 0\naccess-list 165 deny ip 192.168.179.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.120.8.45/24 (down)", "Routing: OSPF enabled on 10.120.8.0/24 area 0", "ACL 165: deny traffic from 192.168.179.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.120.8.45/24 is down, and ACL 165 denys traffic from 192.168.179.242."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.183.188.37 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.183.188.0.0.0.255 area 0\naccess-list 164 permit ip 192.168.27.144 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.183.188.37/24 (down)", "Routing: OSPF enabled on 10.183.188.0/24 area 0", "ACL 164: permit traffic from 192.168.27.144"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.183.188.37/24 is down, and ACL 164 permits traffic from 192.168.27.144."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.112.2.184 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.112.2.10.0.0.255 area 0\naccess-list 134 deny ip 192.168.77.80 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.112.2.184/24 (up)", "Routing: OSPF enabled on 10.112.2.10/24 area 0", "ACL 134: deny traffic from 192.168.77.80"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.112.2.184/24 is up, and ACL 134 denys traffic from 192.168.77.80."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.15.66.62 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.15.66.0.0.0.255 area 0\naccess-list 159 deny ip 192.168.53.229 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.15.66.62/24 (down)", "Routing: OSPF enabled on 10.15.66.0/24 area 0", "ACL 159: deny traffic from 192.168.53.229"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.15.66.62/24 is down, and ACL 159 denys traffic from 192.168.53.229."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.32.12.40 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.32.12.0.0.0.255 area 0\naccess-list 121 deny ip 192.168.203.170 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.32.12.40/24 (up)", "Routing: OSPF enabled on 10.32.12.0/24 area 0", "ACL 121: deny traffic from 192.168.203.170"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.32.12.40/24 is up, and ACL 121 denys traffic from 192.168.203.170."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.174.215.113 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.174.215.10.0.0.255 area 0\naccess-list 183 deny ip 192.168.65.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.174.215.113/24 (up)", "Routing: OSPF enabled on 10.174.215.10/24 area 0", "ACL 183: deny traffic from 192.168.65.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.174.215.113/24 is up, and ACL 183 denys traffic from 192.168.65.191."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.214.131.119 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.214.131.10.0.0.255 area 0\naccess-list 184 deny ip 192.168.183.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.214.131.119/24 (up)", "Routing: OSPF enabled on 10.214.131.10/24 area 0", "ACL 184: deny traffic from 192.168.183.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.214.131.119/24 is up, and ACL 184 denys traffic from 192.168.183.192."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.5.174.41 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.5.174.0.0.0.255 area 0\naccess-list 138 permit ip 192.168.174.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.5.174.41/24 (up)", "Routing: OSPF enabled on 10.5.174.0/24 area 0", "ACL 138: permit traffic from 192.168.174.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.5.174.41/24 is up, and ACL 138 permits traffic from 192.168.174.67."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.161.251.84 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.161.251.0.0.0.255 area 0\naccess-list 174 deny ip 192.168.240.115 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.161.251.84/24 (up)", "Routing: OSPF enabled on 10.161.251.0/24 area 0", "ACL 174: deny traffic from 192.168.240.115"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.161.251.84/24 is up, and ACL 174 denys traffic from 192.168.240.115."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.142.38.29 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.142.38.0.0.0.255 area 0\naccess-list 127 deny ip 192.168.190.29 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.142.38.29/24 (down)", "Routing: OSPF enabled on 10.142.38.0/24 area 0", "ACL 127: deny traffic from 192.168.190.29"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.142.38.29/24 is down, and ACL 127 denys traffic from 192.168.190.29."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.140.232.181 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.140.232.10.0.0.255 area 0\naccess-list 137 permit ip 192.168.80.55 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.140.232.181/24 (down)", "Routing: OSPF enabled on 10.140.232.10/24 area 0", "ACL 137: permit traffic from 192.168.80.55"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.140.232.181/24 is down, and ACL 137 permits traffic from 192.168.80.55."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.71.189.226 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.71.189.20.0.0.255 area 0\naccess-list 190 deny ip 192.168.86.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.71.189.226/24 (up)", "Routing: OSPF enabled on 10.71.189.20/24 area 0", "ACL 190: deny traffic from 192.168.86.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.71.189.226/24 is up, and ACL 190 denys traffic from 192.168.86.106."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.106.117.133 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.106.117.10.0.0.255 area 0\naccess-list 102 deny ip 192.168.25.178 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.106.117.133/24 (up)", "Routing: OSPF enabled on 10.106.117.10/24 area 0", "ACL 102: deny traffic from 192.168.25.178"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.106.117.133/24 is up, and ACL 102 denys traffic from 192.168.25.178."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.11.108.43 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.11.108.0.0.0.255 area 0\naccess-list 189 permit ip 192.168.135.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.11.108.43/24 (up)", "Routing: OSPF enabled on 10.11.108.0/24 area 0", "ACL 189: permit traffic from 192.168.135.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.11.108.43/24 is up, and ACL 189 permits traffic from 192.168.135.53."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.96.11.178 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.96.11.10.0.0.255 area 0\naccess-list 113 deny ip 192.168.249.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.96.11.178/24 (up)", "Routing: OSPF enabled on 10.96.11.10/24 area 0", "ACL 113: deny traffic from 192.168.249.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.96.11.178/24 is up, and ACL 113 denys traffic from 192.168.249.186."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.201.94.24 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.201.94.0.0.0.255 area 0\naccess-list 191 deny ip 192.168.183.138 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.201.94.24/24 (up)", "Routing: OSPF enabled on 10.201.94.0/24 area 0", "ACL 191: deny traffic from 192.168.183.138"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.201.94.24/24 is up, and ACL 191 denys traffic from 192.168.183.138."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.201.209.81 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.201.209.0.0.0.255 area 0\naccess-list 154 deny ip 192.168.46.138 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.201.209.81/24 (up)", "Routing: OSPF enabled on 10.201.209.0/24 area 0", "ACL 154: deny traffic from 192.168.46.138"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.201.209.81/24 is up, and ACL 154 denys traffic from 192.168.46.138."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.160.155.139 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.160.155.10.0.0.255 area 0\naccess-list 127 permit ip 192.168.92.36 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.160.155.139/24 (up)", "Routing: OSPF enabled on 10.160.155.10/24 area 0", "ACL 127: permit traffic from 192.168.92.36"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.160.155.139/24 is up, and ACL 127 permits traffic from 192.168.92.36."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.253.1.201 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.253.1.20.0.0.255 area 0\naccess-list 176 deny ip 192.168.184.214 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.253.1.201/24 (up)", "Routing: OSPF enabled on 10.253.1.20/24 area 0", "ACL 176: deny traffic from 192.168.184.214"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.253.1.201/24 is up, and ACL 176 denys traffic from 192.168.184.214."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.115.36.111 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.115.36.10.0.0.255 area 0\naccess-list 100 permit ip 192.168.100.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.115.36.111/24 (down)", "Routing: OSPF enabled on 10.115.36.10/24 area 0", "ACL 100: permit traffic from 192.168.100.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.115.36.111/24 is down, and ACL 100 permits traffic from 192.168.100.146."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.106.82.34 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.106.82.0.0.0.255 area 0\naccess-list 160 permit ip 192.168.214.47 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.106.82.34/24 (down)", "Routing: OSPF enabled on 10.106.82.0/24 area 0", "ACL 160: permit traffic from 192.168.214.47"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.106.82.34/24 is down, and ACL 160 permits traffic from 192.168.214.47."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.43.6.171 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.43.6.10.0.0.255 area 0\naccess-list 185 permit ip 192.168.107.66 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.43.6.171/24 (up)", "Routing: OSPF enabled on 10.43.6.10/24 area 0", "ACL 185: permit traffic from 192.168.107.66"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.43.6.171/24 is up, and ACL 185 permits traffic from 192.168.107.66."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.255.167.121 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.255.167.10.0.0.255 area 0\naccess-list 132 permit ip 192.168.164.29 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.255.167.121/24 (down)", "Routing: OSPF enabled on 10.255.167.10/24 area 0", "ACL 132: permit traffic from 192.168.164.29"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.255.167.121/24 is down, and ACL 132 permits traffic from 192.168.164.29."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.85.223.84 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.85.223.0.0.0.255 area 0\naccess-list 197 permit ip 192.168.38.42 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.85.223.84/24 (up)", "Routing: OSPF enabled on 10.85.223.0/24 area 0", "ACL 197: permit traffic from 192.168.38.42"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.85.223.84/24 is up, and ACL 197 permits traffic from 192.168.38.42."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.124.19.146 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.124.19.10.0.0.255 area 0\naccess-list 163 deny ip 192.168.236.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.124.19.146/24 (up)", "Routing: OSPF enabled on 10.124.19.10/24 area 0", "ACL 163: deny traffic from 192.168.236.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.124.19.146/24 is up, and ACL 163 denys traffic from 192.168.236.95."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.71.38.219 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.71.38.20.0.0.255 area 0\naccess-list 101 deny ip 192.168.66.163 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.71.38.219/24 (up)", "Routing: OSPF enabled on 10.71.38.20/24 area 0", "ACL 101: deny traffic from 192.168.66.163"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.71.38.219/24 is up, and ACL 101 denys traffic from 192.168.66.163."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.92.53.205 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.92.53.20.0.0.255 area 0\naccess-list 143 deny ip 192.168.96.123 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.92.53.205/24 (down)", "Routing: OSPF enabled on 10.92.53.20/24 area 0", "ACL 143: deny traffic from 192.168.96.123"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.92.53.205/24 is down, and ACL 143 denys traffic from 192.168.96.123."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.80.76.157 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.80.76.10.0.0.255 area 0\naccess-list 149 deny ip 192.168.86.215 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.80.76.157/24 (down)", "Routing: OSPF enabled on 10.80.76.10/24 area 0", "ACL 149: deny traffic from 192.168.86.215"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.80.76.157/24 is down, and ACL 149 denys traffic from 192.168.86.215."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.205.102.203 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.205.102.20.0.0.255 area 0\naccess-list 175 permit ip 192.168.221.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.205.102.203/24 (up)", "Routing: OSPF enabled on 10.205.102.20/24 area 0", "ACL 175: permit traffic from 192.168.221.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.205.102.203/24 is up, and ACL 175 permits traffic from 192.168.221.107."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.30.105.26 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.30.105.0.0.0.255 area 0\naccess-list 153 deny ip 192.168.247.149 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.30.105.26/24 (up)", "Routing: OSPF enabled on 10.30.105.0/24 area 0", "ACL 153: deny traffic from 192.168.247.149"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.30.105.26/24 is up, and ACL 153 denys traffic from 192.168.247.149."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.100.134.150 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.100.134.10.0.0.255 area 0\naccess-list 183 permit ip 192.168.81.76 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.100.134.150/24 (up)", "Routing: OSPF enabled on 10.100.134.10/24 area 0", "ACL 183: permit traffic from 192.168.81.76"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.100.134.150/24 is up, and ACL 183 permits traffic from 192.168.81.76."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.180.90.157 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.180.90.10.0.0.255 area 0\naccess-list 165 permit ip 192.168.195.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.180.90.157/24 (up)", "Routing: OSPF enabled on 10.180.90.10/24 area 0", "ACL 165: permit traffic from 192.168.195.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.180.90.157/24 is up, and ACL 165 permits traffic from 192.168.195.13."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.127.139.76 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.127.139.0.0.0.255 area 0\naccess-list 126 permit ip 192.168.225.139 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.127.139.76/24 (down)", "Routing: OSPF enabled on 10.127.139.0/24 area 0", "ACL 126: permit traffic from 192.168.225.139"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.127.139.76/24 is down, and ACL 126 permits traffic from 192.168.225.139."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.247.204.124 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.247.204.10.0.0.255 area 0\naccess-list 160 deny ip 192.168.230.142 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.247.204.124/24 (up)", "Routing: OSPF enabled on 10.247.204.10/24 area 0", "ACL 160: deny traffic from 192.168.230.142"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.247.204.124/24 is up, and ACL 160 denys traffic from 192.168.230.142."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.223.54.127 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.223.54.10.0.0.255 area 0\naccess-list 196 permit ip 192.168.88.179 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.223.54.127/24 (down)", "Routing: OSPF enabled on 10.223.54.10/24 area 0", "ACL 196: permit traffic from 192.168.88.179"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.223.54.127/24 is down, and ACL 196 permits traffic from 192.168.88.179."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.11.77.253 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.11.77.20.0.0.255 area 0\naccess-list 129 permit ip 192.168.234.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.11.77.253/24 (up)", "Routing: OSPF enabled on 10.11.77.20/24 area 0", "ACL 129: permit traffic from 192.168.234.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.11.77.253/24 is up, and ACL 129 permits traffic from 192.168.234.220."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.214.95.12 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.214.95.0.0.0.255 area 0\naccess-list 108 permit ip 192.168.93.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.214.95.12/24 (down)", "Routing: OSPF enabled on 10.214.95.0/24 area 0", "ACL 108: permit traffic from 192.168.93.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.214.95.12/24 is down, and ACL 108 permits traffic from 192.168.93.242."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.81.72.33 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.81.72.0.0.0.255 area 0\naccess-list 191 deny ip 192.168.158.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.81.72.33/24 (down)", "Routing: OSPF enabled on 10.81.72.0/24 area 0", "ACL 191: deny traffic from 192.168.158.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.81.72.33/24 is down, and ACL 191 denys traffic from 192.168.158.105."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.177.187.250 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.177.187.20.0.0.255 area 0\naccess-list 158 deny ip 192.168.251.101 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.177.187.250/24 (up)", "Routing: OSPF enabled on 10.177.187.20/24 area 0", "ACL 158: deny traffic from 192.168.251.101"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.177.187.250/24 is up, and ACL 158 denys traffic from 192.168.251.101."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.254.68.93 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.254.68.0.0.0.255 area 0\naccess-list 144 deny ip 192.168.51.96 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.254.68.93/24 (up)", "Routing: OSPF enabled on 10.254.68.0/24 area 0", "ACL 144: deny traffic from 192.168.51.96"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.254.68.93/24 is up, and ACL 144 denys traffic from 192.168.51.96."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.193.130.129 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.193.130.10.0.0.255 area 0\naccess-list 115 deny ip 192.168.38.26 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.193.130.129/24 (up)", "Routing: OSPF enabled on 10.193.130.10/24 area 0", "ACL 115: deny traffic from 192.168.38.26"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.193.130.129/24 is up, and ACL 115 denys traffic from 192.168.38.26."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.96.208.223 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.96.208.20.0.0.255 area 0\naccess-list 172 permit ip 192.168.198.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.96.208.223/24 (up)", "Routing: OSPF enabled on 10.96.208.20/24 area 0", "ACL 172: permit traffic from 192.168.198.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.96.208.223/24 is up, and ACL 172 permits traffic from 192.168.198.129."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.22.73.70 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.22.73.0.0.0.255 area 0\naccess-list 102 deny ip 192.168.172.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.22.73.70/24 (down)", "Routing: OSPF enabled on 10.22.73.0/24 area 0", "ACL 102: deny traffic from 192.168.172.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.22.73.70/24 is down, and ACL 102 denys traffic from 192.168.172.233."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.252.240.64 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.252.240.0.0.0.255 area 0\naccess-list 105 deny ip 192.168.201.35 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.252.240.64/24 (up)", "Routing: OSPF enabled on 10.252.240.0/24 area 0", "ACL 105: deny traffic from 192.168.201.35"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.252.240.64/24 is up, and ACL 105 denys traffic from 192.168.201.35."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.80.7.245 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.80.7.20.0.0.255 area 0\naccess-list 155 permit ip 192.168.87.91 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.80.7.245/24 (down)", "Routing: OSPF enabled on 10.80.7.20/24 area 0", "ACL 155: permit traffic from 192.168.87.91"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.80.7.245/24 is down, and ACL 155 permits traffic from 192.168.87.91."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.137.216.134 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.137.216.10.0.0.255 area 0\naccess-list 167 permit ip 192.168.64.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.137.216.134/24 (down)", "Routing: OSPF enabled on 10.137.216.10/24 area 0", "ACL 167: permit traffic from 192.168.64.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.137.216.134/24 is down, and ACL 167 permits traffic from 192.168.64.67."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.199.60.92 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.199.60.0.0.0.255 area 0\naccess-list 132 permit ip 192.168.168.182 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.199.60.92/24 (up)", "Routing: OSPF enabled on 10.199.60.0/24 area 0", "ACL 132: permit traffic from 192.168.168.182"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.199.60.92/24 is up, and ACL 132 permits traffic from 192.168.168.182."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.134.64.174 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.134.64.10.0.0.255 area 0\naccess-list 152 deny ip 192.168.13.176 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.134.64.174/24 (up)", "Routing: OSPF enabled on 10.134.64.10/24 area 0", "ACL 152: deny traffic from 192.168.13.176"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.134.64.174/24 is up, and ACL 152 denys traffic from 192.168.13.176."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.254.94.253 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.254.94.20.0.0.255 area 0\naccess-list 136 deny ip 192.168.225.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.254.94.253/24 (down)", "Routing: OSPF enabled on 10.254.94.20/24 area 0", "ACL 136: deny traffic from 192.168.225.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.254.94.253/24 is down, and ACL 136 denys traffic from 192.168.225.152."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.170.199.173 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.170.199.10.0.0.255 area 0\naccess-list 108 deny ip 192.168.112.202 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.170.199.173/24 (up)", "Routing: OSPF enabled on 10.170.199.10/24 area 0", "ACL 108: deny traffic from 192.168.112.202"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.170.199.173/24 is up, and ACL 108 denys traffic from 192.168.112.202."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.131.22.15 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.131.22.0.0.0.255 area 0\naccess-list 191 deny ip 192.168.235.231 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.131.22.15/24 (down)", "Routing: OSPF enabled on 10.131.22.0/24 area 0", "ACL 191: deny traffic from 192.168.235.231"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.131.22.15/24 is down, and ACL 191 denys traffic from 192.168.235.231."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.197.18.40 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.197.18.0.0.0.255 area 0\naccess-list 155 permit ip 192.168.65.201 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.197.18.40/24 (down)", "Routing: OSPF enabled on 10.197.18.0/24 area 0", "ACL 155: permit traffic from 192.168.65.201"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.197.18.40/24 is down, and ACL 155 permits traffic from 192.168.65.201."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.56.216.112 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.56.216.10.0.0.255 area 0\naccess-list 148 permit ip 192.168.6.44 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.56.216.112/24 (down)", "Routing: OSPF enabled on 10.56.216.10/24 area 0", "ACL 148: permit traffic from 192.168.6.44"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.56.216.112/24 is down, and ACL 148 permits traffic from 192.168.6.44."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.172.221.143 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.172.221.10.0.0.255 area 0\naccess-list 134 permit ip 192.168.171.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.172.221.143/24 (up)", "Routing: OSPF enabled on 10.172.221.10/24 area 0", "ACL 134: permit traffic from 192.168.171.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.172.221.143/24 is up, and ACL 134 permits traffic from 192.168.171.56."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.123.154.236 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.123.154.20.0.0.255 area 0\naccess-list 199 permit ip 192.168.36.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.123.154.236/24 (up)", "Routing: OSPF enabled on 10.123.154.20/24 area 0", "ACL 199: permit traffic from 192.168.36.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.123.154.236/24 is up, and ACL 199 permits traffic from 192.168.36.250."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.151.103.219 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.151.103.20.0.0.255 area 0\naccess-list 123 deny ip 192.168.163.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.151.103.219/24 (down)", "Routing: OSPF enabled on 10.151.103.20/24 area 0", "ACL 123: deny traffic from 192.168.163.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.151.103.219/24 is down, and ACL 123 denys traffic from 192.168.163.105."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.202.80.98 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.202.80.0.0.0.255 area 0\naccess-list 104 deny ip 192.168.115.240 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.202.80.98/24 (up)", "Routing: OSPF enabled on 10.202.80.0/24 area 0", "ACL 104: deny traffic from 192.168.115.240"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.202.80.98/24 is up, and ACL 104 denys traffic from 192.168.115.240."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.86.200.188 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.86.200.10.0.0.255 area 0\naccess-list 131 deny ip 192.168.53.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.86.200.188/24 (up)", "Routing: OSPF enabled on 10.86.200.10/24 area 0", "ACL 131: deny traffic from 192.168.53.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.86.200.188/24 is up, and ACL 131 denys traffic from 192.168.53.136."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.127.88.245 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.127.88.20.0.0.255 area 0\naccess-list 121 deny ip 192.168.160.68 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.127.88.245/24 (down)", "Routing: OSPF enabled on 10.127.88.20/24 area 0", "ACL 121: deny traffic from 192.168.160.68"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.127.88.245/24 is down, and ACL 121 denys traffic from 192.168.160.68."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.89.92.125 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.89.92.10.0.0.255 area 0\naccess-list 183 permit ip 192.168.239.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.89.92.125/24 (down)", "Routing: OSPF enabled on 10.89.92.10/24 area 0", "ACL 183: permit traffic from 192.168.239.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.89.92.125/24 is down, and ACL 183 permits traffic from 192.168.239.48."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.22.177.193 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.22.177.10.0.0.255 area 0\naccess-list 143 deny ip 192.168.101.112 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.22.177.193/24 (up)", "Routing: OSPF enabled on 10.22.177.10/24 area 0", "ACL 143: deny traffic from 192.168.101.112"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.22.177.193/24 is up, and ACL 143 denys traffic from 192.168.101.112."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.190.175.241 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.190.175.20.0.0.255 area 0\naccess-list 108 deny ip 192.168.237.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.190.175.241/24 (up)", "Routing: OSPF enabled on 10.190.175.20/24 area 0", "ACL 108: deny traffic from 192.168.237.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.190.175.241/24 is up, and ACL 108 denys traffic from 192.168.237.107."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.232.199.189 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.232.199.10.0.0.255 area 0\naccess-list 150 permit ip 192.168.74.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.232.199.189/24 (down)", "Routing: OSPF enabled on 10.232.199.10/24 area 0", "ACL 150: permit traffic from 192.168.74.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.232.199.189/24 is down, and ACL 150 permits traffic from 192.168.74.9."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.150.139.162 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.150.139.10.0.0.255 area 0\naccess-list 109 permit ip 192.168.49.61 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.150.139.162/24 (up)", "Routing: OSPF enabled on 10.150.139.10/24 area 0", "ACL 109: permit traffic from 192.168.49.61"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.150.139.162/24 is up, and ACL 109 permits traffic from 192.168.49.61."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.9.37.177 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.9.37.10.0.0.255 area 0\naccess-list 185 deny ip 192.168.11.141 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.9.37.177/24 (down)", "Routing: OSPF enabled on 10.9.37.10/24 area 0", "ACL 185: deny traffic from 192.168.11.141"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.9.37.177/24 is down, and ACL 185 denys traffic from 192.168.11.141."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.48.46.59 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.48.46.0.0.0.255 area 0\naccess-list 168 permit ip 192.168.121.15 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.48.46.59/24 (up)", "Routing: OSPF enabled on 10.48.46.0/24 area 0", "ACL 168: permit traffic from 192.168.121.15"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.48.46.59/24 is up, and ACL 168 permits traffic from 192.168.121.15."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.168.171.121 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.168.171.10.0.0.255 area 0\naccess-list 111 deny ip 192.168.92.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.168.171.121/24 (down)", "Routing: OSPF enabled on 10.168.171.10/24 area 0", "ACL 111: deny traffic from 192.168.92.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.168.171.121/24 is down, and ACL 111 denys traffic from 192.168.92.245."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.173.221.201 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.173.221.20.0.0.255 area 0\naccess-list 100 permit ip 192.168.168.213 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.173.221.201/24 (down)", "Routing: OSPF enabled on 10.173.221.20/24 area 0", "ACL 100: permit traffic from 192.168.168.213"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.173.221.201/24 is down, and ACL 100 permits traffic from 192.168.168.213."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.150.167.100 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.150.167.10.0.0.255 area 0\naccess-list 130 permit ip 192.168.65.197 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.150.167.100/24 (down)", "Routing: OSPF enabled on 10.150.167.10/24 area 0", "ACL 130: permit traffic from 192.168.65.197"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.150.167.100/24 is down, and ACL 130 permits traffic from 192.168.65.197."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.101.166.141 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.101.166.10.0.0.255 area 0\naccess-list 119 deny ip 192.168.250.87 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.101.166.141/24 (up)", "Routing: OSPF enabled on 10.101.166.10/24 area 0", "ACL 119: deny traffic from 192.168.250.87"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.101.166.141/24 is up, and ACL 119 denys traffic from 192.168.250.87."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.185.3.110 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.185.3.10.0.0.255 area 0\naccess-list 104 deny ip 192.168.11.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.185.3.110/24 (up)", "Routing: OSPF enabled on 10.185.3.10/24 area 0", "ACL 104: deny traffic from 192.168.11.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.185.3.110/24 is up, and ACL 104 denys traffic from 192.168.11.185."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.174.70.17 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.174.70.0.0.0.255 area 0\naccess-list 158 deny ip 192.168.12.46 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.174.70.17/24 (up)", "Routing: OSPF enabled on 10.174.70.0/24 area 0", "ACL 158: deny traffic from 192.168.12.46"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.174.70.17/24 is up, and ACL 158 denys traffic from 192.168.12.46."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.220.212.65 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.220.212.0.0.0.255 area 0\naccess-list 158 permit ip 192.168.166.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.220.212.65/24 (down)", "Routing: OSPF enabled on 10.220.212.0/24 area 0", "ACL 158: permit traffic from 192.168.166.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.220.212.65/24 is down, and ACL 158 permits traffic from 192.168.166.208."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.19.48.229 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.19.48.20.0.0.255 area 0\naccess-list 195 deny ip 192.168.79.119 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.19.48.229/24 (down)", "Routing: OSPF enabled on 10.19.48.20/24 area 0", "ACL 195: deny traffic from 192.168.79.119"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.19.48.229/24 is down, and ACL 195 denys traffic from 192.168.79.119."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.244.51.108 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.244.51.10.0.0.255 area 0\naccess-list 106 deny ip 192.168.186.0 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.244.51.108/24 (down)", "Routing: OSPF enabled on 10.244.51.10/24 area 0", "ACL 106: deny traffic from 192.168.186.0"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.244.51.108/24 is down, and ACL 106 denys traffic from 192.168.186.0."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.105.169.157 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.105.169.10.0.0.255 area 0\naccess-list 112 deny ip 192.168.151.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.105.169.157/24 (up)", "Routing: OSPF enabled on 10.105.169.10/24 area 0", "ACL 112: deny traffic from 192.168.151.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.105.169.157/24 is up, and ACL 112 denys traffic from 192.168.151.106."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.222.19.40 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.222.19.0.0.0.255 area 0\naccess-list 172 deny ip 192.168.142.84 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.222.19.40/24 (down)", "Routing: OSPF enabled on 10.222.19.0/24 area 0", "ACL 172: deny traffic from 192.168.142.84"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.222.19.40/24 is down, and ACL 172 denys traffic from 192.168.142.84."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.234.194.54 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.234.194.0.0.0.255 area 0\naccess-list 150 deny ip 192.168.7.66 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.234.194.54/24 (up)", "Routing: OSPF enabled on 10.234.194.0/24 area 0", "ACL 150: deny traffic from 192.168.7.66"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.234.194.54/24 is up, and ACL 150 denys traffic from 192.168.7.66."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.179.119.32 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.179.119.0.0.0.255 area 0\naccess-list 111 permit ip 192.168.85.248 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.179.119.32/24 (down)", "Routing: OSPF enabled on 10.179.119.0/24 area 0", "ACL 111: permit traffic from 192.168.85.248"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.179.119.32/24 is down, and ACL 111 permits traffic from 192.168.85.248."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.221.165.33 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.221.165.0.0.0.255 area 0\naccess-list 159 permit ip 192.168.246.232 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.221.165.33/24 (down)", "Routing: OSPF enabled on 10.221.165.0/24 area 0", "ACL 159: permit traffic from 192.168.246.232"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.221.165.33/24 is down, and ACL 159 permits traffic from 192.168.246.232."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.162.199.194 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.162.199.10.0.0.255 area 0\naccess-list 110 permit ip 192.168.29.31 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.162.199.194/24 (down)", "Routing: OSPF enabled on 10.162.199.10/24 area 0", "ACL 110: permit traffic from 192.168.29.31"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.162.199.194/24 is down, and ACL 110 permits traffic from 192.168.29.31."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.126.244.136 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.126.244.10.0.0.255 area 0\naccess-list 117 permit ip 192.168.96.26 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.126.244.136/24 (up)", "Routing: OSPF enabled on 10.126.244.10/24 area 0", "ACL 117: permit traffic from 192.168.96.26"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.126.244.136/24 is up, and ACL 117 permits traffic from 192.168.96.26."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.215.228.241 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.215.228.20.0.0.255 area 0\naccess-list 161 permit ip 192.168.38.210 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.215.228.241/24 (up)", "Routing: OSPF enabled on 10.215.228.20/24 area 0", "ACL 161: permit traffic from 192.168.38.210"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.215.228.241/24 is up, and ACL 161 permits traffic from 192.168.38.210."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.239.143.159 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.239.143.10.0.0.255 area 0\naccess-list 122 permit ip 192.168.167.43 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.239.143.159/24 (down)", "Routing: OSPF enabled on 10.239.143.10/24 area 0", "ACL 122: permit traffic from 192.168.167.43"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.239.143.159/24 is down, and ACL 122 permits traffic from 192.168.167.43."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.178.210.162 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.178.210.10.0.0.255 area 0\naccess-list 185 permit ip 192.168.43.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.178.210.162/24 (up)", "Routing: OSPF enabled on 10.178.210.10/24 area 0", "ACL 185: permit traffic from 192.168.43.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.178.210.162/24 is up, and ACL 185 permits traffic from 192.168.43.20."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.20.26.214 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.20.26.20.0.0.255 area 0\naccess-list 103 deny ip 192.168.148.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.20.26.214/24 (down)", "Routing: OSPF enabled on 10.20.26.20/24 area 0", "ACL 103: deny traffic from 192.168.148.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.20.26.214/24 is down, and ACL 103 denys traffic from 192.168.148.105."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.129.137.79 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.129.137.0.0.0.255 area 0\naccess-list 171 deny ip 192.168.194.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.129.137.79/24 (down)", "Routing: OSPF enabled on 10.129.137.0/24 area 0", "ACL 171: deny traffic from 192.168.194.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.129.137.79/24 is down, and ACL 171 denys traffic from 192.168.194.126."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.51.72.185 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.51.72.10.0.0.255 area 0\naccess-list 122 permit ip 192.168.203.237 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.51.72.185/24 (down)", "Routing: OSPF enabled on 10.51.72.10/24 area 0", "ACL 122: permit traffic from 192.168.203.237"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.51.72.185/24 is down, and ACL 122 permits traffic from 192.168.203.237."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.69.236.49 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.69.236.0.0.0.255 area 0\naccess-list 113 permit ip 192.168.101.91 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.69.236.49/24 (down)", "Routing: OSPF enabled on 10.69.236.0/24 area 0", "ACL 113: permit traffic from 192.168.101.91"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.69.236.49/24 is down, and ACL 113 permits traffic from 192.168.101.91."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.22.18.64 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.22.18.0.0.0.255 area 0\naccess-list 147 permit ip 192.168.104.100 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.22.18.64/24 (up)", "Routing: OSPF enabled on 10.22.18.0/24 area 0", "ACL 147: permit traffic from 192.168.104.100"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.22.18.64/24 is up, and ACL 147 permits traffic from 192.168.104.100."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.181.45.200 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.181.45.20.0.0.255 area 0\naccess-list 168 deny ip 192.168.150.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.181.45.200/24 (down)", "Routing: OSPF enabled on 10.181.45.20/24 area 0", "ACL 168: deny traffic from 192.168.150.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.181.45.200/24 is down, and ACL 168 denys traffic from 192.168.150.10."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.139.242.91 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.139.242.0.0.0.255 area 0\naccess-list 113 permit ip 192.168.114.255 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.139.242.91/24 (up)", "Routing: OSPF enabled on 10.139.242.0/24 area 0", "ACL 113: permit traffic from 192.168.114.255"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.139.242.91/24 is up, and ACL 113 permits traffic from 192.168.114.255."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.227.162.144 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.227.162.10.0.0.255 area 0\naccess-list 198 permit ip 192.168.117.240 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.227.162.144/24 (up)", "Routing: OSPF enabled on 10.227.162.10/24 area 0", "ACL 198: permit traffic from 192.168.117.240"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.227.162.144/24 is up, and ACL 198 permits traffic from 192.168.117.240."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.121.183.34 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.121.183.0.0.0.255 area 0\naccess-list 110 deny ip 192.168.94.218 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.121.183.34/24 (down)", "Routing: OSPF enabled on 10.121.183.0/24 area 0", "ACL 110: deny traffic from 192.168.94.218"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.121.183.34/24 is down, and ACL 110 denys traffic from 192.168.94.218."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.221.193.131 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.221.193.10.0.0.255 area 0\naccess-list 131 deny ip 192.168.254.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.221.193.131/24 (down)", "Routing: OSPF enabled on 10.221.193.10/24 area 0", "ACL 131: deny traffic from 192.168.254.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.221.193.131/24 is down, and ACL 131 denys traffic from 192.168.254.75."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.87.204.8 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.87.2040.0.0.255 area 0\naccess-list 173 deny ip 192.168.15.149 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.87.204.8/24 (up)", "Routing: OSPF enabled on 10.87.2040/24 area 0", "ACL 173: deny traffic from 192.168.15.149"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.87.204.8/24 is up, and ACL 173 denys traffic from 192.168.15.149."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.161.171.18 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.161.171.0.0.0.255 area 0\naccess-list 164 deny ip 192.168.15.243 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.161.171.18/24 (down)", "Routing: OSPF enabled on 10.161.171.0/24 area 0", "ACL 164: deny traffic from 192.168.15.243"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.161.171.18/24 is down, and ACL 164 denys traffic from 192.168.15.243."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.166.194.1 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.166.1940.0.0.255 area 0\naccess-list 118 deny ip 192.168.229.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.166.194.1/24 (up)", "Routing: OSPF enabled on 10.166.1940/24 area 0", "ACL 118: deny traffic from 192.168.229.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.166.194.1/24 is up, and ACL 118 denys traffic from 192.168.229.193."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.78.94.7 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.78.940.0.0.255 area 0\naccess-list 128 deny ip 192.168.37.171 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.78.94.7/24 (up)", "Routing: OSPF enabled on 10.78.940/24 area 0", "ACL 128: deny traffic from 192.168.37.171"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.78.94.7/24 is up, and ACL 128 denys traffic from 192.168.37.171."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.249.124.61 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.249.124.0.0.0.255 area 0\naccess-list 169 deny ip 192.168.240.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.249.124.61/24 (down)", "Routing: OSPF enabled on 10.249.124.0/24 area 0", "ACL 169: deny traffic from 192.168.240.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.249.124.61/24 is down, and ACL 169 denys traffic from 192.168.240.222."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.181.190.39 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.181.190.0.0.0.255 area 0\naccess-list 152 permit ip 192.168.64.30 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.181.190.39/24 (down)", "Routing: OSPF enabled on 10.181.190.0/24 area 0", "ACL 152: permit traffic from 192.168.64.30"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.181.190.39/24 is down, and ACL 152 permits traffic from 192.168.64.30."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.103.7.211 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.103.7.20.0.0.255 area 0\naccess-list 135 permit ip 192.168.22.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.103.7.211/24 (down)", "Routing: OSPF enabled on 10.103.7.20/24 area 0", "ACL 135: permit traffic from 192.168.22.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.103.7.211/24 is down, and ACL 135 permits traffic from 192.168.22.193."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.103.22.28 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.103.22.0.0.0.255 area 0\naccess-list 134 deny ip 192.168.197.247 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.103.22.28/24 (down)", "Routing: OSPF enabled on 10.103.22.0/24 area 0", "ACL 134: deny traffic from 192.168.197.247"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.103.22.28/24 is down, and ACL 134 denys traffic from 192.168.197.247."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.195.188.51 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.195.188.0.0.0.255 area 0\naccess-list 135 permit ip 192.168.5.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.195.188.51/24 (down)", "Routing: OSPF enabled on 10.195.188.0/24 area 0", "ACL 135: permit traffic from 192.168.5.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.195.188.51/24 is down, and ACL 135 permits traffic from 192.168.5.204."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.252.178.227 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.252.178.20.0.0.255 area 0\naccess-list 116 deny ip 192.168.229.156 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.252.178.227/24 (down)", "Routing: OSPF enabled on 10.252.178.20/24 area 0", "ACL 116: deny traffic from 192.168.229.156"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.252.178.227/24 is down, and ACL 116 denys traffic from 192.168.229.156."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.15.247.163 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.15.247.10.0.0.255 area 0\naccess-list 122 permit ip 192.168.26.189 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.15.247.163/24 (down)", "Routing: OSPF enabled on 10.15.247.10/24 area 0", "ACL 122: permit traffic from 192.168.26.189"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.15.247.163/24 is down, and ACL 122 permits traffic from 192.168.26.189."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.28.41.237 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.28.41.20.0.0.255 area 0\naccess-list 137 deny ip 192.168.60.102 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.28.41.237/24 (up)", "Routing: OSPF enabled on 10.28.41.20/24 area 0", "ACL 137: deny traffic from 192.168.60.102"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.28.41.237/24 is up, and ACL 137 denys traffic from 192.168.60.102."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.102.79.31 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.102.79.0.0.0.255 area 0\naccess-list 108 deny ip 192.168.201.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.102.79.31/24 (up)", "Routing: OSPF enabled on 10.102.79.0/24 area 0", "ACL 108: deny traffic from 192.168.201.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.102.79.31/24 is up, and ACL 108 denys traffic from 192.168.201.134."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.126.12.51 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.126.12.0.0.0.255 area 0\naccess-list 124 deny ip 192.168.131.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.126.12.51/24 (up)", "Routing: OSPF enabled on 10.126.12.0/24 area 0", "ACL 124: deny traffic from 192.168.131.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.126.12.51/24 is up, and ACL 124 denys traffic from 192.168.131.196."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.186.75.2 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.186.750.0.0.255 area 0\naccess-list 116 deny ip 192.168.89.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.186.75.2/24 (up)", "Routing: OSPF enabled on 10.186.750/24 area 0", "ACL 116: deny traffic from 192.168.89.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.186.75.2/24 is up, and ACL 116 denys traffic from 192.168.89.196."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.131.54.240 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.131.54.20.0.0.255 area 0\naccess-list 122 permit ip 192.168.177.104 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.131.54.240/24 (up)", "Routing: OSPF enabled on 10.131.54.20/24 area 0", "ACL 122: permit traffic from 192.168.177.104"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.131.54.240/24 is up, and ACL 122 permits traffic from 192.168.177.104."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.135.30.103 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.135.30.10.0.0.255 area 0\naccess-list 188 deny ip 192.168.21.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.135.30.103/24 (down)", "Routing: OSPF enabled on 10.135.30.10/24 area 0", "ACL 188: deny traffic from 192.168.21.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.135.30.103/24 is down, and ACL 188 denys traffic from 192.168.21.113."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.48.145.150 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.48.145.10.0.0.255 area 0\naccess-list 111 deny ip 192.168.227.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.48.145.150/24 (up)", "Routing: OSPF enabled on 10.48.145.10/24 area 0", "ACL 111: deny traffic from 192.168.227.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.48.145.150/24 is up, and ACL 111 denys traffic from 192.168.227.37."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.193.61.228 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.193.61.20.0.0.255 area 0\naccess-list 105 permit ip 192.168.115.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.193.61.228/24 (up)", "Routing: OSPF enabled on 10.193.61.20/24 area 0", "ACL 105: permit traffic from 192.168.115.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.193.61.228/24 is up, and ACL 105 permits traffic from 192.168.115.251."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.149.100.241 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.149.100.20.0.0.255 area 0\naccess-list 130 deny ip 192.168.223.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.149.100.241/24 (up)", "Routing: OSPF enabled on 10.149.100.20/24 area 0", "ACL 130: deny traffic from 192.168.223.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.149.100.241/24 is up, and ACL 130 denys traffic from 192.168.223.69."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.53.232.128 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.53.232.10.0.0.255 area 0\naccess-list 190 permit ip 192.168.215.24 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.53.232.128/24 (down)", "Routing: OSPF enabled on 10.53.232.10/24 area 0", "ACL 190: permit traffic from 192.168.215.24"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.53.232.128/24 is down, and ACL 190 permits traffic from 192.168.215.24."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.92.214.62 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.92.214.0.0.0.255 area 0\naccess-list 126 deny ip 192.168.105.43 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.92.214.62/24 (up)", "Routing: OSPF enabled on 10.92.214.0/24 area 0", "ACL 126: deny traffic from 192.168.105.43"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.92.214.62/24 is up, and ACL 126 denys traffic from 192.168.105.43."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.29.91.148 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.29.91.10.0.0.255 area 0\naccess-list 112 permit ip 192.168.250.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.29.91.148/24 (down)", "Routing: OSPF enabled on 10.29.91.10/24 area 0", "ACL 112: permit traffic from 192.168.250.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.29.91.148/24 is down, and ACL 112 permits traffic from 192.168.250.172."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.220.169.6 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.220.1690.0.0.255 area 0\naccess-list 177 permit ip 192.168.173.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.220.169.6/24 (down)", "Routing: OSPF enabled on 10.220.1690/24 area 0", "ACL 177: permit traffic from 192.168.173.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.220.169.6/24 is down, and ACL 177 permits traffic from 192.168.173.230."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.186.57.171 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.186.57.10.0.0.255 area 0\naccess-list 194 deny ip 192.168.96.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.186.57.171/24 (down)", "Routing: OSPF enabled on 10.186.57.10/24 area 0", "ACL 194: deny traffic from 192.168.96.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.186.57.171/24 is down, and ACL 194 denys traffic from 192.168.96.136."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.198.151.247 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.198.151.20.0.0.255 area 0\naccess-list 176 deny ip 192.168.172.35 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.198.151.247/24 (down)", "Routing: OSPF enabled on 10.198.151.20/24 area 0", "ACL 176: deny traffic from 192.168.172.35"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.198.151.247/24 is down, and ACL 176 denys traffic from 192.168.172.35."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.9.118.162 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.9.118.10.0.0.255 area 0\naccess-list 187 permit ip 192.168.131.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.9.118.162/24 (down)", "Routing: OSPF enabled on 10.9.118.10/24 area 0", "ACL 187: permit traffic from 192.168.131.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.9.118.162/24 is down, and ACL 187 permits traffic from 192.168.131.152."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.166.58.217 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.166.58.20.0.0.255 area 0\naccess-list 144 deny ip 192.168.44.45 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.166.58.217/24 (down)", "Routing: OSPF enabled on 10.166.58.20/24 area 0", "ACL 144: deny traffic from 192.168.44.45"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.166.58.217/24 is down, and ACL 144 denys traffic from 192.168.44.45."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.168.83.3 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.168.830.0.0.255 area 0\naccess-list 170 permit ip 192.168.187.135 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.168.83.3/24 (down)", "Routing: OSPF enabled on 10.168.830/24 area 0", "ACL 170: permit traffic from 192.168.187.135"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.168.83.3/24 is down, and ACL 170 permits traffic from 192.168.187.135."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.76.69.243 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.76.69.20.0.0.255 area 0\naccess-list 146 permit ip 192.168.14.226 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.76.69.243/24 (up)", "Routing: OSPF enabled on 10.76.69.20/24 area 0", "ACL 146: permit traffic from 192.168.14.226"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.76.69.243/24 is up, and ACL 146 permits traffic from 192.168.14.226."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.174.206.223 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.174.206.20.0.0.255 area 0\naccess-list 115 permit ip 192.168.116.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.174.206.223/24 (down)", "Routing: OSPF enabled on 10.174.206.20/24 area 0", "ACL 115: permit traffic from 192.168.116.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.174.206.223/24 is down, and ACL 115 permits traffic from 192.168.116.49."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.98.244.121 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.98.244.10.0.0.255 area 0\naccess-list 106 permit ip 192.168.23.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.98.244.121/24 (up)", "Routing: OSPF enabled on 10.98.244.10/24 area 0", "ACL 106: permit traffic from 192.168.23.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.98.244.121/24 is up, and ACL 106 permits traffic from 192.168.23.116."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.251.55.12 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.251.55.0.0.0.255 area 0\naccess-list 152 deny ip 192.168.124.73 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.251.55.12/24 (down)", "Routing: OSPF enabled on 10.251.55.0/24 area 0", "ACL 152: deny traffic from 192.168.124.73"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.251.55.12/24 is down, and ACL 152 denys traffic from 192.168.124.73."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.65.206.111 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.65.206.10.0.0.255 area 0\naccess-list 123 deny ip 192.168.164.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.65.206.111/24 (up)", "Routing: OSPF enabled on 10.65.206.10/24 area 0", "ACL 123: deny traffic from 192.168.164.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.65.206.111/24 is up, and ACL 123 denys traffic from 192.168.164.92."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.149.130.167 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.149.130.10.0.0.255 area 0\naccess-list 164 deny ip 192.168.166.236 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.149.130.167/24 (up)", "Routing: OSPF enabled on 10.149.130.10/24 area 0", "ACL 164: deny traffic from 192.168.166.236"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.149.130.167/24 is up, and ACL 164 denys traffic from 192.168.166.236."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.98.209.202 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.98.209.20.0.0.255 area 0\naccess-list 155 permit ip 192.168.253.46 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.98.209.202/24 (up)", "Routing: OSPF enabled on 10.98.209.20/24 area 0", "ACL 155: permit traffic from 192.168.253.46"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.98.209.202/24 is up, and ACL 155 permits traffic from 192.168.253.46."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.132.209.220 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.132.209.20.0.0.255 area 0\naccess-list 139 permit ip 192.168.223.169 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.132.209.220/24 (down)", "Routing: OSPF enabled on 10.132.209.20/24 area 0", "ACL 139: permit traffic from 192.168.223.169"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.132.209.220/24 is down, and ACL 139 permits traffic from 192.168.223.169."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.175.67.202 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.175.67.20.0.0.255 area 0\naccess-list 179 permit ip 192.168.27.161 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.175.67.202/24 (down)", "Routing: OSPF enabled on 10.175.67.20/24 area 0", "ACL 179: permit traffic from 192.168.27.161"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.175.67.202/24 is down, and ACL 179 permits traffic from 192.168.27.161."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.231.202.111 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.231.202.10.0.0.255 area 0\naccess-list 168 permit ip 192.168.82.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.231.202.111/24 (up)", "Routing: OSPF enabled on 10.231.202.10/24 area 0", "ACL 168: permit traffic from 192.168.82.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.231.202.111/24 is up, and ACL 168 permits traffic from 192.168.82.160."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.66.36.50 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.66.36.0.0.0.255 area 0\naccess-list 135 permit ip 192.168.146.72 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.66.36.50/24 (down)", "Routing: OSPF enabled on 10.66.36.0/24 area 0", "ACL 135: permit traffic from 192.168.146.72"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.66.36.50/24 is down, and ACL 135 permits traffic from 192.168.146.72."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.185.7.65 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.185.7.0.0.0.255 area 0\naccess-list 126 deny ip 192.168.4.168 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.185.7.65/24 (down)", "Routing: OSPF enabled on 10.185.7.0/24 area 0", "ACL 126: deny traffic from 192.168.4.168"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.185.7.65/24 is down, and ACL 126 denys traffic from 192.168.4.168."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.6.40.99 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.6.40.0.0.0.255 area 0\naccess-list 127 deny ip 192.168.162.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.6.40.99/24 (up)", "Routing: OSPF enabled on 10.6.40.0/24 area 0", "ACL 127: deny traffic from 192.168.162.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.6.40.99/24 is up, and ACL 127 denys traffic from 192.168.162.152."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.2.94.142 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.2.94.10.0.0.255 area 0\naccess-list 129 permit ip 192.168.35.29 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.2.94.142/24 (up)", "Routing: OSPF enabled on 10.2.94.10/24 area 0", "ACL 129: permit traffic from 192.168.35.29"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.2.94.142/24 is up, and ACL 129 permits traffic from 192.168.35.29."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.211.230.173 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.211.230.10.0.0.255 area 0\naccess-list 164 deny ip 192.168.168.7 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.211.230.173/24 (up)", "Routing: OSPF enabled on 10.211.230.10/24 area 0", "ACL 164: deny traffic from 192.168.168.7"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.211.230.173/24 is up, and ACL 164 denys traffic from 192.168.168.7."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.3.117.246 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.3.117.20.0.0.255 area 0\naccess-list 181 permit ip 192.168.44.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.3.117.246/24 (up)", "Routing: OSPF enabled on 10.3.117.20/24 area 0", "ACL 181: permit traffic from 192.168.44.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.3.117.246/24 is up, and ACL 181 permits traffic from 192.168.44.160."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.68.31.176 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.68.31.10.0.0.255 area 0\naccess-list 141 permit ip 192.168.126.46 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.68.31.176/24 (down)", "Routing: OSPF enabled on 10.68.31.10/24 area 0", "ACL 141: permit traffic from 192.168.126.46"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.68.31.176/24 is down, and ACL 141 permits traffic from 192.168.126.46."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.142.69.15 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.142.69.0.0.0.255 area 0\naccess-list 169 permit ip 192.168.49.62 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.142.69.15/24 (up)", "Routing: OSPF enabled on 10.142.69.0/24 area 0", "ACL 169: permit traffic from 192.168.49.62"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.142.69.15/24 is up, and ACL 169 permits traffic from 192.168.49.62."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.152.62.101 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.152.62.10.0.0.255 area 0\naccess-list 126 deny ip 192.168.211.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.152.62.101/24 (down)", "Routing: OSPF enabled on 10.152.62.10/24 area 0", "ACL 126: deny traffic from 192.168.211.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.152.62.101/24 is down, and ACL 126 denys traffic from 192.168.211.117."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.119.61.238 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.119.61.20.0.0.255 area 0\naccess-list 142 deny ip 192.168.152.141 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.119.61.238/24 (up)", "Routing: OSPF enabled on 10.119.61.20/24 area 0", "ACL 142: deny traffic from 192.168.152.141"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.119.61.238/24 is up, and ACL 142 denys traffic from 192.168.152.141."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.192.206.186 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.192.206.10.0.0.255 area 0\naccess-list 158 deny ip 192.168.79.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.192.206.186/24 (up)", "Routing: OSPF enabled on 10.192.206.10/24 area 0", "ACL 158: deny traffic from 192.168.79.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.192.206.186/24 is up, and ACL 158 denys traffic from 192.168.79.116."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.91.217.49 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.91.217.0.0.0.255 area 0\naccess-list 100 permit ip 192.168.106.132 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.91.217.49/24 (up)", "Routing: OSPF enabled on 10.91.217.0/24 area 0", "ACL 100: permit traffic from 192.168.106.132"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.91.217.49/24 is up, and ACL 100 permits traffic from 192.168.106.132."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.93.136.158 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.93.136.10.0.0.255 area 0\naccess-list 103 permit ip 192.168.143.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.93.136.158/24 (up)", "Routing: OSPF enabled on 10.93.136.10/24 area 0", "ACL 103: permit traffic from 192.168.143.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.93.136.158/24 is up, and ACL 103 permits traffic from 192.168.143.134."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.218.27.147 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.218.27.10.0.0.255 area 0\naccess-list 119 deny ip 192.168.31.79 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.218.27.147/24 (up)", "Routing: OSPF enabled on 10.218.27.10/24 area 0", "ACL 119: deny traffic from 192.168.31.79"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.218.27.147/24 is up, and ACL 119 denys traffic from 192.168.31.79."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.190.104.208 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.190.104.20.0.0.255 area 0\naccess-list 169 deny ip 192.168.157.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.190.104.208/24 (down)", "Routing: OSPF enabled on 10.190.104.20/24 area 0", "ACL 169: deny traffic from 192.168.157.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.190.104.208/24 is down, and ACL 169 denys traffic from 192.168.157.108."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.158.198.190 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.158.198.10.0.0.255 area 0\naccess-list 148 deny ip 192.168.247.243 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.158.198.190/24 (down)", "Routing: OSPF enabled on 10.158.198.10/24 area 0", "ACL 148: deny traffic from 192.168.247.243"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.158.198.190/24 is down, and ACL 148 denys traffic from 192.168.247.243."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.4.194.78 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.4.194.0.0.0.255 area 0\naccess-list 139 permit ip 192.168.24.189 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.4.194.78/24 (up)", "Routing: OSPF enabled on 10.4.194.0/24 area 0", "ACL 139: permit traffic from 192.168.24.189"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.4.194.78/24 is up, and ACL 139 permits traffic from 192.168.24.189."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.34.191.38 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.34.191.0.0.0.255 area 0\naccess-list 149 deny ip 192.168.215.223 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.34.191.38/24 (up)", "Routing: OSPF enabled on 10.34.191.0/24 area 0", "ACL 149: deny traffic from 192.168.215.223"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.34.191.38/24 is up, and ACL 149 denys traffic from 192.168.215.223."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.210.19.170 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.210.19.10.0.0.255 area 0\naccess-list 138 deny ip 192.168.70.24 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.210.19.170/24 (down)", "Routing: OSPF enabled on 10.210.19.10/24 area 0", "ACL 138: deny traffic from 192.168.70.24"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.210.19.170/24 is down, and ACL 138 denys traffic from 192.168.70.24."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.202.16.88 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.202.16.0.0.0.255 area 0\naccess-list 190 deny ip 192.168.19.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.202.16.88/24 (down)", "Routing: OSPF enabled on 10.202.16.0/24 area 0", "ACL 190: deny traffic from 192.168.19.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.202.16.88/24 is down, and ACL 190 denys traffic from 192.168.19.109."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.195.248.171 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.195.248.10.0.0.255 area 0\naccess-list 129 permit ip 192.168.2.31 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.195.248.171/24 (down)", "Routing: OSPF enabled on 10.195.248.10/24 area 0", "ACL 129: permit traffic from 192.168.2.31"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.195.248.171/24 is down, and ACL 129 permits traffic from 192.168.2.31."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.182.165.164 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.182.165.10.0.0.255 area 0\naccess-list 131 permit ip 192.168.18.5 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.182.165.164/24 (up)", "Routing: OSPF enabled on 10.182.165.10/24 area 0", "ACL 131: permit traffic from 192.168.18.5"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.182.165.164/24 is up, and ACL 131 permits traffic from 192.168.18.5."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.211.230.169 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.211.230.10.0.0.255 area 0\naccess-list 135 deny ip 192.168.209.70 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.211.230.169/24 (down)", "Routing: OSPF enabled on 10.211.230.10/24 area 0", "ACL 135: deny traffic from 192.168.209.70"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.211.230.169/24 is down, and ACL 135 denys traffic from 192.168.209.70."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.42.53.53 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.42.53.0.0.0.255 area 0\naccess-list 111 permit ip 192.168.59.60 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.42.53.53/24 (up)", "Routing: OSPF enabled on 10.42.53.0/24 area 0", "ACL 111: permit traffic from 192.168.59.60"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.42.53.53/24 is up, and ACL 111 permits traffic from 192.168.59.60."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.244.26.69 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.244.26.0.0.0.255 area 0\naccess-list 179 deny ip 192.168.63.90 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.244.26.69/24 (up)", "Routing: OSPF enabled on 10.244.26.0/24 area 0", "ACL 179: deny traffic from 192.168.63.90"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.244.26.69/24 is up, and ACL 179 denys traffic from 192.168.63.90."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.90.4.210 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.90.4.20.0.0.255 area 0\naccess-list 113 permit ip 192.168.69.132 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.90.4.210/24 (down)", "Routing: OSPF enabled on 10.90.4.20/24 area 0", "ACL 113: permit traffic from 192.168.69.132"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.90.4.210/24 is down, and ACL 113 permits traffic from 192.168.69.132."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.141.216.158 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.141.216.10.0.0.255 area 0\naccess-list 162 deny ip 192.168.166.100 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.141.216.158/24 (down)", "Routing: OSPF enabled on 10.141.216.10/24 area 0", "ACL 162: deny traffic from 192.168.166.100"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.141.216.158/24 is down, and ACL 162 denys traffic from 192.168.166.100."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.3.218.124 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.3.218.10.0.0.255 area 0\naccess-list 184 deny ip 192.168.231.212 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.3.218.124/24 (down)", "Routing: OSPF enabled on 10.3.218.10/24 area 0", "ACL 184: deny traffic from 192.168.231.212"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.3.218.124/24 is down, and ACL 184 denys traffic from 192.168.231.212."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.120.217.128 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.120.217.10.0.0.255 area 0\naccess-list 137 deny ip 192.168.251.23 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.120.217.128/24 (down)", "Routing: OSPF enabled on 10.120.217.10/24 area 0", "ACL 137: deny traffic from 192.168.251.23"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.120.217.128/24 is down, and ACL 137 denys traffic from 192.168.251.23."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.205.112.127 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.205.112.10.0.0.255 area 0\naccess-list 170 permit ip 192.168.183.122 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.205.112.127/24 (up)", "Routing: OSPF enabled on 10.205.112.10/24 area 0", "ACL 170: permit traffic from 192.168.183.122"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.205.112.127/24 is up, and ACL 170 permits traffic from 192.168.183.122."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.252.79.207 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.252.79.20.0.0.255 area 0\naccess-list 199 permit ip 192.168.94.89 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.252.79.207/24 (up)", "Routing: OSPF enabled on 10.252.79.20/24 area 0", "ACL 199: permit traffic from 192.168.94.89"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.252.79.207/24 is up, and ACL 199 permits traffic from 192.168.94.89."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.132.116.182 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.132.116.10.0.0.255 area 0\naccess-list 156 permit ip 192.168.166.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.132.116.182/24 (up)", "Routing: OSPF enabled on 10.132.116.10/24 area 0", "ACL 156: permit traffic from 192.168.166.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.132.116.182/24 is up, and ACL 156 permits traffic from 192.168.166.152."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.121.16.81 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.121.16.0.0.0.255 area 0\naccess-list 177 deny ip 192.168.194.118 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.121.16.81/24 (down)", "Routing: OSPF enabled on 10.121.16.0/24 area 0", "ACL 177: deny traffic from 192.168.194.118"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.121.16.81/24 is down, and ACL 177 denys traffic from 192.168.194.118."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.62.245.49 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.62.245.0.0.0.255 area 0\naccess-list 106 deny ip 192.168.200.102 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.62.245.49/24 (up)", "Routing: OSPF enabled on 10.62.245.0/24 area 0", "ACL 106: deny traffic from 192.168.200.102"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.62.245.49/24 is up, and ACL 106 denys traffic from 192.168.200.102."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.221.113.117 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.221.113.10.0.0.255 area 0\naccess-list 199 permit ip 192.168.11.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.221.113.117/24 (up)", "Routing: OSPF enabled on 10.221.113.10/24 area 0", "ACL 199: permit traffic from 192.168.11.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.221.113.117/24 is up, and ACL 199 permits traffic from 192.168.11.250."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.2.90.77 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.2.90.0.0.0.255 area 0\naccess-list 153 deny ip 192.168.5.110 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.2.90.77/24 (down)", "Routing: OSPF enabled on 10.2.90.0/24 area 0", "ACL 153: deny traffic from 192.168.5.110"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.2.90.77/24 is down, and ACL 153 denys traffic from 192.168.5.110."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.105.145.96 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.105.145.0.0.0.255 area 0\naccess-list 174 deny ip 192.168.42.169 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.105.145.96/24 (up)", "Routing: OSPF enabled on 10.105.145.0/24 area 0", "ACL 174: deny traffic from 192.168.42.169"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.105.145.96/24 is up, and ACL 174 denys traffic from 192.168.42.169."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.123.136.27 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.123.136.0.0.0.255 area 0\naccess-list 137 permit ip 192.168.103.177 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.123.136.27/24 (down)", "Routing: OSPF enabled on 10.123.136.0/24 area 0", "ACL 137: permit traffic from 192.168.103.177"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.123.136.27/24 is down, and ACL 137 permits traffic from 192.168.103.177."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.123.144.131 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.123.144.10.0.0.255 area 0\naccess-list 164 permit ip 192.168.30.5 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.123.144.131/24 (up)", "Routing: OSPF enabled on 10.123.144.10/24 area 0", "ACL 164: permit traffic from 192.168.30.5"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.123.144.131/24 is up, and ACL 164 permits traffic from 192.168.30.5."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.20.45.17 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.20.45.0.0.0.255 area 0\naccess-list 117 deny ip 192.168.216.61 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.20.45.17/24 (up)", "Routing: OSPF enabled on 10.20.45.0/24 area 0", "ACL 117: deny traffic from 192.168.216.61"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.20.45.17/24 is up, and ACL 117 denys traffic from 192.168.216.61."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.53.226.79 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.53.226.0.0.0.255 area 0\naccess-list 146 permit ip 192.168.211.76 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.53.226.79/24 (down)", "Routing: OSPF enabled on 10.53.226.0/24 area 0", "ACL 146: permit traffic from 192.168.211.76"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.53.226.79/24 is down, and ACL 146 permits traffic from 192.168.211.76."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.28.214.174 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.28.214.10.0.0.255 area 0\naccess-list 158 deny ip 192.168.73.159 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.28.214.174/24 (up)", "Routing: OSPF enabled on 10.28.214.10/24 area 0", "ACL 158: deny traffic from 192.168.73.159"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.28.214.174/24 is up, and ACL 158 denys traffic from 192.168.73.159."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.108.240.170 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.108.240.10.0.0.255 area 0\naccess-list 185 deny ip 192.168.97.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.108.240.170/24 (up)", "Routing: OSPF enabled on 10.108.240.10/24 area 0", "ACL 185: deny traffic from 192.168.97.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.108.240.170/24 is up, and ACL 185 denys traffic from 192.168.97.109."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.195.179.82 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.195.179.0.0.0.255 area 0\naccess-list 122 permit ip 192.168.226.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.195.179.82/24 (up)", "Routing: OSPF enabled on 10.195.179.0/24 area 0", "ACL 122: permit traffic from 192.168.226.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.195.179.82/24 is up, and ACL 122 permits traffic from 192.168.226.40."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.131.74.143 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.131.74.10.0.0.255 area 0\naccess-list 190 deny ip 192.168.144.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.131.74.143/24 (up)", "Routing: OSPF enabled on 10.131.74.10/24 area 0", "ACL 190: deny traffic from 192.168.144.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.131.74.143/24 is up, and ACL 190 denys traffic from 192.168.144.9."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.134.204.79 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.134.204.0.0.0.255 area 0\naccess-list 168 permit ip 192.168.29.240 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.134.204.79/24 (up)", "Routing: OSPF enabled on 10.134.204.0/24 area 0", "ACL 168: permit traffic from 192.168.29.240"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.134.204.79/24 is up, and ACL 168 permits traffic from 192.168.29.240."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.58.143.101 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.58.143.10.0.0.255 area 0\naccess-list 196 deny ip 192.168.19.0 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.58.143.101/24 (up)", "Routing: OSPF enabled on 10.58.143.10/24 area 0", "ACL 196: deny traffic from 192.168.19.0"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.58.143.101/24 is up, and ACL 196 denys traffic from 192.168.19.0."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.161.238.2 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.161.2380.0.0.255 area 0\naccess-list 177 permit ip 192.168.184.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.161.238.2/24 (down)", "Routing: OSPF enabled on 10.161.2380/24 area 0", "ACL 177: permit traffic from 192.168.184.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.161.238.2/24 is down, and ACL 177 permits traffic from 192.168.184.95."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.3.158.194 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.3.158.10.0.0.255 area 0\naccess-list 112 permit ip 192.168.204.140 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.3.158.194/24 (down)", "Routing: OSPF enabled on 10.3.158.10/24 area 0", "ACL 112: permit traffic from 192.168.204.140"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.3.158.194/24 is down, and ACL 112 permits traffic from 192.168.204.140."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.190.202.213 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.190.202.20.0.0.255 area 0\naccess-list 151 deny ip 192.168.195.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.190.202.213/24 (down)", "Routing: OSPF enabled on 10.190.202.20/24 area 0", "ACL 151: deny traffic from 192.168.195.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.190.202.213/24 is down, and ACL 151 denys traffic from 192.168.195.113."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.121.54.71 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.121.54.0.0.0.255 area 0\naccess-list 186 deny ip 192.168.186.86 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.121.54.71/24 (up)", "Routing: OSPF enabled on 10.121.54.0/24 area 0", "ACL 186: deny traffic from 192.168.186.86"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.121.54.71/24 is up, and ACL 186 denys traffic from 192.168.186.86."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.41.113.206 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.41.113.20.0.0.255 area 0\naccess-list 115 deny ip 192.168.160.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.41.113.206/24 (down)", "Routing: OSPF enabled on 10.41.113.20/24 area 0", "ACL 115: deny traffic from 192.168.160.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.41.113.206/24 is down, and ACL 115 denys traffic from 192.168.160.9."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.6.76.223 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.6.76.20.0.0.255 area 0\naccess-list 185 permit ip 192.168.60.248 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.6.76.223/24 (up)", "Routing: OSPF enabled on 10.6.76.20/24 area 0", "ACL 185: permit traffic from 192.168.60.248"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.6.76.223/24 is up, and ACL 185 permits traffic from 192.168.60.248."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.197.51.115 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.197.51.10.0.0.255 area 0\naccess-list 191 permit ip 192.168.193.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.197.51.115/24 (down)", "Routing: OSPF enabled on 10.197.51.10/24 area 0", "ACL 191: permit traffic from 192.168.193.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.197.51.115/24 is down, and ACL 191 permits traffic from 192.168.193.155."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.97.124.106 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.97.124.10.0.0.255 area 0\naccess-list 137 permit ip 192.168.119.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.97.124.106/24 (down)", "Routing: OSPF enabled on 10.97.124.10/24 area 0", "ACL 137: permit traffic from 192.168.119.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.97.124.106/24 is down, and ACL 137 permits traffic from 192.168.119.250."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.255.128.31 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.255.128.0.0.0.255 area 0\naccess-list 138 deny ip 192.168.98.0 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.255.128.31/24 (down)", "Routing: OSPF enabled on 10.255.128.0/24 area 0", "ACL 138: deny traffic from 192.168.98.0"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.255.128.31/24 is down, and ACL 138 denys traffic from 192.168.98.0."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.241.236.157 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.241.236.10.0.0.255 area 0\naccess-list 134 permit ip 192.168.33.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.241.236.157/24 (down)", "Routing: OSPF enabled on 10.241.236.10/24 area 0", "ACL 134: permit traffic from 192.168.33.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.241.236.157/24 is down, and ACL 134 permits traffic from 192.168.33.196."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.8.85.96 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.8.85.0.0.0.255 area 0\naccess-list 104 permit ip 192.168.126.64 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.8.85.96/24 (up)", "Routing: OSPF enabled on 10.8.85.0/24 area 0", "ACL 104: permit traffic from 192.168.126.64"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.8.85.96/24 is up, and ACL 104 permits traffic from 192.168.126.64."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.53.28.201 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.53.28.20.0.0.255 area 0\naccess-list 154 deny ip 192.168.89.86 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.53.28.201/24 (up)", "Routing: OSPF enabled on 10.53.28.20/24 area 0", "ACL 154: deny traffic from 192.168.89.86"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.53.28.201/24 is up, and ACL 154 denys traffic from 192.168.89.86."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.47.240.162 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.47.240.10.0.0.255 area 0\naccess-list 186 deny ip 192.168.158.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.47.240.162/24 (down)", "Routing: OSPF enabled on 10.47.240.10/24 area 0", "ACL 186: deny traffic from 192.168.158.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.47.240.162/24 is down, and ACL 186 denys traffic from 192.168.158.9."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.182.166.34 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.182.166.0.0.0.255 area 0\naccess-list 121 permit ip 192.168.216.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.182.166.34/24 (down)", "Routing: OSPF enabled on 10.182.166.0/24 area 0", "ACL 121: permit traffic from 192.168.216.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.182.166.34/24 is down, and ACL 121 permits traffic from 192.168.216.155."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.184.29.138 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.184.29.10.0.0.255 area 0\naccess-list 188 deny ip 192.168.148.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.184.29.138/24 (up)", "Routing: OSPF enabled on 10.184.29.10/24 area 0", "ACL 188: deny traffic from 192.168.148.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.184.29.138/24 is up, and ACL 188 denys traffic from 192.168.148.199."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.210.143.92 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.210.143.0.0.0.255 area 0\naccess-list 120 permit ip 192.168.5.74 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.210.143.92/24 (down)", "Routing: OSPF enabled on 10.210.143.0/24 area 0", "ACL 120: permit traffic from 192.168.5.74"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.210.143.92/24 is down, and ACL 120 permits traffic from 192.168.5.74."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.25.182.113 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.25.182.10.0.0.255 area 0\naccess-list 157 deny ip 192.168.214.26 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.25.182.113/24 (up)", "Routing: OSPF enabled on 10.25.182.10/24 area 0", "ACL 157: deny traffic from 192.168.214.26"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.25.182.113/24 is up, and ACL 157 denys traffic from 192.168.214.26."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.132.21.1 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.132.210.0.0.255 area 0\naccess-list 128 permit ip 192.168.16.147 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.132.21.1/24 (up)", "Routing: OSPF enabled on 10.132.210/24 area 0", "ACL 128: permit traffic from 192.168.16.147"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.132.21.1/24 is up, and ACL 128 permits traffic from 192.168.16.147."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.103.133.174 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.103.133.10.0.0.255 area 0\naccess-list 170 deny ip 192.168.97.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.103.133.174/24 (up)", "Routing: OSPF enabled on 10.103.133.10/24 area 0", "ACL 170: deny traffic from 192.168.97.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.103.133.174/24 is up, and ACL 170 denys traffic from 192.168.97.38."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.3.163.165 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.3.163.10.0.0.255 area 0\naccess-list 153 deny ip 192.168.67.58 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.3.163.165/24 (up)", "Routing: OSPF enabled on 10.3.163.10/24 area 0", "ACL 153: deny traffic from 192.168.67.58"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.3.163.165/24 is up, and ACL 153 denys traffic from 192.168.67.58."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.29.27.192 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.29.27.10.0.0.255 area 0\naccess-list 152 permit ip 192.168.168.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.29.27.192/24 (up)", "Routing: OSPF enabled on 10.29.27.10/24 area 0", "ACL 152: permit traffic from 192.168.168.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.29.27.192/24 is up, and ACL 152 permits traffic from 192.168.168.40."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.103.160.199 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.103.160.10.0.0.255 area 0\naccess-list 124 deny ip 192.168.39.158 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.103.160.199/24 (down)", "Routing: OSPF enabled on 10.103.160.10/24 area 0", "ACL 124: deny traffic from 192.168.39.158"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.103.160.199/24 is down, and ACL 124 denys traffic from 192.168.39.158."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.105.26.213 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.105.26.20.0.0.255 area 0\naccess-list 172 deny ip 192.168.145.64 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.105.26.213/24 (down)", "Routing: OSPF enabled on 10.105.26.20/24 area 0", "ACL 172: deny traffic from 192.168.145.64"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.105.26.213/24 is down, and ACL 172 denys traffic from 192.168.145.64."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.174.246.159 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.174.246.10.0.0.255 area 0\naccess-list 144 deny ip 192.168.60.33 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.174.246.159/24 (up)", "Routing: OSPF enabled on 10.174.246.10/24 area 0", "ACL 144: deny traffic from 192.168.60.33"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.174.246.159/24 is up, and ACL 144 denys traffic from 192.168.60.33."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.145.195.165 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.145.195.10.0.0.255 area 0\naccess-list 162 deny ip 192.168.57.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.145.195.165/24 (up)", "Routing: OSPF enabled on 10.145.195.10/24 area 0", "ACL 162: deny traffic from 192.168.57.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.145.195.165/24 is up, and ACL 162 denys traffic from 192.168.57.152."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.212.30.187 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.212.30.10.0.0.255 area 0\naccess-list 163 deny ip 192.168.229.79 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.212.30.187/24 (down)", "Routing: OSPF enabled on 10.212.30.10/24 area 0", "ACL 163: deny traffic from 192.168.229.79"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.212.30.187/24 is down, and ACL 163 denys traffic from 192.168.229.79."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.20.248.251 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.20.248.20.0.0.255 area 0\naccess-list 123 deny ip 192.168.1.119 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.20.248.251/24 (up)", "Routing: OSPF enabled on 10.20.248.20/24 area 0", "ACL 123: deny traffic from 192.168.1.119"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.20.248.251/24 is up, and ACL 123 denys traffic from 192.168.1.119."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.188.208.250 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.188.208.20.0.0.255 area 0\naccess-list 192 permit ip 192.168.148.100 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.188.208.250/24 (down)", "Routing: OSPF enabled on 10.188.208.20/24 area 0", "ACL 192: permit traffic from 192.168.148.100"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.188.208.250/24 is down, and ACL 192 permits traffic from 192.168.148.100."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.209.201.184 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.209.201.10.0.0.255 area 0\naccess-list 172 deny ip 192.168.248.176 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.209.201.184/24 (down)", "Routing: OSPF enabled on 10.209.201.10/24 area 0", "ACL 172: deny traffic from 192.168.248.176"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.209.201.184/24 is down, and ACL 172 denys traffic from 192.168.248.176."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.84.247.96 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.84.247.0.0.0.255 area 0\naccess-list 105 permit ip 192.168.239.141 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.84.247.96/24 (up)", "Routing: OSPF enabled on 10.84.247.0/24 area 0", "ACL 105: permit traffic from 192.168.239.141"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.84.247.96/24 is up, and ACL 105 permits traffic from 192.168.239.141."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.242.22.16 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.242.22.0.0.0.255 area 0\naccess-list 121 deny ip 192.168.108.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.242.22.16/24 (down)", "Routing: OSPF enabled on 10.242.22.0/24 area 0", "ACL 121: deny traffic from 192.168.108.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.242.22.16/24 is down, and ACL 121 denys traffic from 192.168.108.146."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.47.247.36 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.47.247.0.0.0.255 area 0\naccess-list 144 permit ip 192.168.17.150 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.47.247.36/24 (down)", "Routing: OSPF enabled on 10.47.247.0/24 area 0", "ACL 144: permit traffic from 192.168.17.150"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.47.247.36/24 is down, and ACL 144 permits traffic from 192.168.17.150."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.221.83.204 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.221.83.20.0.0.255 area 0\naccess-list 154 permit ip 192.168.209.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.221.83.204/24 (up)", "Routing: OSPF enabled on 10.221.83.20/24 area 0", "ACL 154: permit traffic from 192.168.209.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.221.83.204/24 is up, and ACL 154 permits traffic from 192.168.209.146."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.155.241.248 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.155.241.20.0.0.255 area 0\naccess-list 189 deny ip 192.168.149.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.155.241.248/24 (down)", "Routing: OSPF enabled on 10.155.241.20/24 area 0", "ACL 189: deny traffic from 192.168.149.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.155.241.248/24 is down, and ACL 189 denys traffic from 192.168.149.120."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.57.25.142 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.57.25.10.0.0.255 area 0\naccess-list 189 deny ip 192.168.76.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.57.25.142/24 (down)", "Routing: OSPF enabled on 10.57.25.10/24 area 0", "ACL 189: deny traffic from 192.168.76.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.57.25.142/24 is down, and ACL 189 denys traffic from 192.168.76.220."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.243.120.236 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.243.120.20.0.0.255 area 0\naccess-list 184 deny ip 192.168.66.130 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.243.120.236/24 (up)", "Routing: OSPF enabled on 10.243.120.20/24 area 0", "ACL 184: deny traffic from 192.168.66.130"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.243.120.236/24 is up, and ACL 184 denys traffic from 192.168.66.130."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.102.184.19 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.102.184.0.0.0.255 area 0\naccess-list 105 deny ip 192.168.185.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.102.184.19/24 (up)", "Routing: OSPF enabled on 10.102.184.0/24 area 0", "ACL 105: deny traffic from 192.168.185.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.102.184.19/24 is up, and ACL 105 denys traffic from 192.168.185.234."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.28.127.18 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.28.127.0.0.0.255 area 0\naccess-list 185 deny ip 192.168.62.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.28.127.18/24 (down)", "Routing: OSPF enabled on 10.28.127.0/24 area 0", "ACL 185: deny traffic from 192.168.62.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.28.127.18/24 is down, and ACL 185 denys traffic from 192.168.62.196."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.217.166.130 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.217.166.10.0.0.255 area 0\naccess-list 163 permit ip 192.168.195.71 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.217.166.130/24 (down)", "Routing: OSPF enabled on 10.217.166.10/24 area 0", "ACL 163: permit traffic from 192.168.195.71"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.217.166.130/24 is down, and ACL 163 permits traffic from 192.168.195.71."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.145.180.91 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.145.180.0.0.0.255 area 0\naccess-list 113 deny ip 192.168.117.130 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.145.180.91/24 (up)", "Routing: OSPF enabled on 10.145.180.0/24 area 0", "ACL 113: deny traffic from 192.168.117.130"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.145.180.91/24 is up, and ACL 113 denys traffic from 192.168.117.130."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.46.143.43 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.46.143.0.0.0.255 area 0\naccess-list 143 permit ip 192.168.73.178 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.46.143.43/24 (up)", "Routing: OSPF enabled on 10.46.143.0/24 area 0", "ACL 143: permit traffic from 192.168.73.178"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.46.143.43/24 is up, and ACL 143 permits traffic from 192.168.73.178."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.43.179.50 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.43.179.0.0.0.255 area 0\naccess-list 140 permit ip 192.168.216.93 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.43.179.50/24 (up)", "Routing: OSPF enabled on 10.43.179.0/24 area 0", "ACL 140: permit traffic from 192.168.216.93"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.43.179.50/24 is up, and ACL 140 permits traffic from 192.168.216.93."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.4.143.216 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.4.143.20.0.0.255 area 0\naccess-list 199 deny ip 192.168.7.135 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.4.143.216/24 (down)", "Routing: OSPF enabled on 10.4.143.20/24 area 0", "ACL 199: deny traffic from 192.168.7.135"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.4.143.216/24 is down, and ACL 199 denys traffic from 192.168.7.135."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.160.155.18 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.160.155.0.0.0.255 area 0\naccess-list 122 permit ip 192.168.47.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.160.155.18/24 (up)", "Routing: OSPF enabled on 10.160.155.0/24 area 0", "ACL 122: permit traffic from 192.168.47.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.160.155.18/24 is up, and ACL 122 permits traffic from 192.168.47.155."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.217.207.253 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.217.207.20.0.0.255 area 0\naccess-list 142 permit ip 192.168.155.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.217.207.253/24 (up)", "Routing: OSPF enabled on 10.217.207.20/24 area 0", "ACL 142: permit traffic from 192.168.155.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.217.207.253/24 is up, and ACL 142 permits traffic from 192.168.155.59."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.112.223.43 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.112.223.0.0.0.255 area 0\naccess-list 164 permit ip 192.168.139.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.112.223.43/24 (down)", "Routing: OSPF enabled on 10.112.223.0/24 area 0", "ACL 164: permit traffic from 192.168.139.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.112.223.43/24 is down, and ACL 164 permits traffic from 192.168.139.148."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.56.207.90 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.56.207.0.0.0.255 area 0\naccess-list 109 permit ip 192.168.25.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.56.207.90/24 (up)", "Routing: OSPF enabled on 10.56.207.0/24 area 0", "ACL 109: permit traffic from 192.168.25.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.56.207.90/24 is up, and ACL 109 permits traffic from 192.168.25.238."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.105.83.101 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.105.83.10.0.0.255 area 0\naccess-list 199 permit ip 192.168.11.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.105.83.101/24 (down)", "Routing: OSPF enabled on 10.105.83.10/24 area 0", "ACL 199: permit traffic from 192.168.11.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.105.83.101/24 is down, and ACL 199 permits traffic from 192.168.11.92."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.247.186.140 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.247.186.10.0.0.255 area 0\naccess-list 141 permit ip 192.168.48.167 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.247.186.140/24 (up)", "Routing: OSPF enabled on 10.247.186.10/24 area 0", "ACL 141: permit traffic from 192.168.48.167"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.247.186.140/24 is up, and ACL 141 permits traffic from 192.168.48.167."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.184.156.43 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.184.156.0.0.0.255 area 0\naccess-list 186 deny ip 192.168.92.207 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.184.156.43/24 (down)", "Routing: OSPF enabled on 10.184.156.0/24 area 0", "ACL 186: deny traffic from 192.168.92.207"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.184.156.43/24 is down, and ACL 186 denys traffic from 192.168.92.207."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.116.124.71 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.116.124.0.0.0.255 area 0\naccess-list 156 permit ip 192.168.76.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.116.124.71/24 (up)", "Routing: OSPF enabled on 10.116.124.0/24 area 0", "ACL 156: permit traffic from 192.168.76.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.116.124.71/24 is up, and ACL 156 permits traffic from 192.168.76.129."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.143.86.79 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.143.86.0.0.0.255 area 0\naccess-list 113 permit ip 192.168.170.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.143.86.79/24 (up)", "Routing: OSPF enabled on 10.143.86.0/24 area 0", "ACL 113: permit traffic from 192.168.170.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.143.86.79/24 is up, and ACL 113 permits traffic from 192.168.170.191."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.70.202.91 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.70.202.0.0.0.255 area 0\naccess-list 119 deny ip 192.168.184.42 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.70.202.91/24 (up)", "Routing: OSPF enabled on 10.70.202.0/24 area 0", "ACL 119: deny traffic from 192.168.184.42"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.70.202.91/24 is up, and ACL 119 denys traffic from 192.168.184.42."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.226.135.194 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.226.135.10.0.0.255 area 0\naccess-list 140 deny ip 192.168.73.239 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.226.135.194/24 (down)", "Routing: OSPF enabled on 10.226.135.10/24 area 0", "ACL 140: deny traffic from 192.168.73.239"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.226.135.194/24 is down, and ACL 140 denys traffic from 192.168.73.239."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.61.213.175 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.61.213.10.0.0.255 area 0\naccess-list 180 permit ip 192.168.63.252 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.61.213.175/24 (down)", "Routing: OSPF enabled on 10.61.213.10/24 area 0", "ACL 180: permit traffic from 192.168.63.252"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.61.213.175/24 is down, and ACL 180 permits traffic from 192.168.63.252."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.183.54.239 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.183.54.20.0.0.255 area 0\naccess-list 134 deny ip 192.168.175.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.183.54.239/24 (down)", "Routing: OSPF enabled on 10.183.54.20/24 area 0", "ACL 134: deny traffic from 192.168.175.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.183.54.239/24 is down, and ACL 134 denys traffic from 192.168.175.40."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.58.169.215 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.58.169.20.0.0.255 area 0\naccess-list 184 permit ip 192.168.70.225 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.58.169.215/24 (up)", "Routing: OSPF enabled on 10.58.169.20/24 area 0", "ACL 184: permit traffic from 192.168.70.225"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.58.169.215/24 is up, and ACL 184 permits traffic from 192.168.70.225."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.189.54.17 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.189.54.0.0.0.255 area 0\naccess-list 105 permit ip 192.168.148.127 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.189.54.17/24 (up)", "Routing: OSPF enabled on 10.189.54.0/24 area 0", "ACL 105: permit traffic from 192.168.148.127"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.189.54.17/24 is up, and ACL 105 permits traffic from 192.168.148.127."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.227.168.69 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.227.168.0.0.0.255 area 0\naccess-list 150 deny ip 192.168.140.131 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.227.168.69/24 (up)", "Routing: OSPF enabled on 10.227.168.0/24 area 0", "ACL 150: deny traffic from 192.168.140.131"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.227.168.69/24 is up, and ACL 150 denys traffic from 192.168.140.131."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.64.81.67 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.64.81.0.0.0.255 area 0\naccess-list 149 deny ip 192.168.210.182 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.64.81.67/24 (down)", "Routing: OSPF enabled on 10.64.81.0/24 area 0", "ACL 149: deny traffic from 192.168.210.182"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.64.81.67/24 is down, and ACL 149 denys traffic from 192.168.210.182."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.159.126.231 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.159.126.20.0.0.255 area 0\naccess-list 107 permit ip 192.168.124.8 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.159.126.231/24 (up)", "Routing: OSPF enabled on 10.159.126.20/24 area 0", "ACL 107: permit traffic from 192.168.124.8"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.159.126.231/24 is up, and ACL 107 permits traffic from 192.168.124.8."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.150.55.103 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.150.55.10.0.0.255 area 0\naccess-list 148 deny ip 192.168.11.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.150.55.103/24 (up)", "Routing: OSPF enabled on 10.150.55.10/24 area 0", "ACL 148: deny traffic from 192.168.11.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.150.55.103/24 is up, and ACL 148 denys traffic from 192.168.11.53."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.186.12.140 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.186.12.10.0.0.255 area 0\naccess-list 192 permit ip 192.168.149.61 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.186.12.140/24 (down)", "Routing: OSPF enabled on 10.186.12.10/24 area 0", "ACL 192: permit traffic from 192.168.149.61"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.186.12.140/24 is down, and ACL 192 permits traffic from 192.168.149.61."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.253.238.125 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.253.238.10.0.0.255 area 0\naccess-list 118 deny ip 192.168.196.35 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.253.238.125/24 (down)", "Routing: OSPF enabled on 10.253.238.10/24 area 0", "ACL 118: deny traffic from 192.168.196.35"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.253.238.125/24 is down, and ACL 118 denys traffic from 192.168.196.35."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.222.28.31 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.222.28.0.0.0.255 area 0\naccess-list 176 deny ip 192.168.28.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.222.28.31/24 (up)", "Routing: OSPF enabled on 10.222.28.0/24 area 0", "ACL 176: deny traffic from 192.168.28.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.222.28.31/24 is up, and ACL 176 denys traffic from 192.168.28.94."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.252.107.141 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.252.107.10.0.0.255 area 0\naccess-list 148 deny ip 192.168.151.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.252.107.141/24 (up)", "Routing: OSPF enabled on 10.252.107.10/24 area 0", "ACL 148: deny traffic from 192.168.151.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.252.107.141/24 is up, and ACL 148 denys traffic from 192.168.151.193."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.153.110.174 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.153.110.10.0.0.255 area 0\naccess-list 196 permit ip 192.168.77.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.153.110.174/24 (down)", "Routing: OSPF enabled on 10.153.110.10/24 area 0", "ACL 196: permit traffic from 192.168.77.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.153.110.174/24 is down, and ACL 196 permits traffic from 192.168.77.20."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.239.33.7 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.239.330.0.0.255 area 0\naccess-list 110 deny ip 192.168.30.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.239.33.7/24 (up)", "Routing: OSPF enabled on 10.239.330/24 area 0", "ACL 110: deny traffic from 192.168.30.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.239.33.7/24 is up, and ACL 110 denys traffic from 192.168.30.13."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.66.60.29 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.66.60.0.0.0.255 area 0\naccess-list 199 deny ip 192.168.141.57 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.66.60.29/24 (down)", "Routing: OSPF enabled on 10.66.60.0/24 area 0", "ACL 199: deny traffic from 192.168.141.57"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.66.60.29/24 is down, and ACL 199 denys traffic from 192.168.141.57."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.253.62.88 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.253.62.0.0.0.255 area 0\naccess-list 191 permit ip 192.168.197.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.253.62.88/24 (down)", "Routing: OSPF enabled on 10.253.62.0/24 area 0", "ACL 191: permit traffic from 192.168.197.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.253.62.88/24 is down, and ACL 191 permits traffic from 192.168.197.25."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.52.60.35 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.52.60.0.0.0.255 area 0\naccess-list 140 deny ip 192.168.74.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.52.60.35/24 (up)", "Routing: OSPF enabled on 10.52.60.0/24 area 0", "ACL 140: deny traffic from 192.168.74.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.52.60.35/24 is up, and ACL 140 denys traffic from 192.168.74.172."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.36.97.120 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.36.97.10.0.0.255 area 0\naccess-list 111 deny ip 192.168.190.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.36.97.120/24 (down)", "Routing: OSPF enabled on 10.36.97.10/24 area 0", "ACL 111: deny traffic from 192.168.190.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.36.97.120/24 is down, and ACL 111 denys traffic from 192.168.190.11."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.217.51.94 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.217.51.0.0.0.255 area 0\naccess-list 186 deny ip 192.168.196.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.217.51.94/24 (down)", "Routing: OSPF enabled on 10.217.51.0/24 area 0", "ACL 186: deny traffic from 192.168.196.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.217.51.94/24 is down, and ACL 186 denys traffic from 192.168.196.67."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.13.206.54 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.13.206.0.0.0.255 area 0\naccess-list 161 deny ip 192.168.248.102 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.13.206.54/24 (up)", "Routing: OSPF enabled on 10.13.206.0/24 area 0", "ACL 161: deny traffic from 192.168.248.102"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.13.206.54/24 is up, and ACL 161 denys traffic from 192.168.248.102."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.166.77.210 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.166.77.20.0.0.255 area 0\naccess-list 151 permit ip 192.168.127.145 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.166.77.210/24 (up)", "Routing: OSPF enabled on 10.166.77.20/24 area 0", "ACL 151: permit traffic from 192.168.127.145"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.166.77.210/24 is up, and ACL 151 permits traffic from 192.168.127.145."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.197.164.213 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.197.164.20.0.0.255 area 0\naccess-list 159 deny ip 192.168.86.102 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.197.164.213/24 (down)", "Routing: OSPF enabled on 10.197.164.20/24 area 0", "ACL 159: deny traffic from 192.168.86.102"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.197.164.213/24 is down, and ACL 159 denys traffic from 192.168.86.102."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.71.152.140 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.71.152.10.0.0.255 area 0\naccess-list 173 deny ip 192.168.121.110 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.71.152.140/24 (down)", "Routing: OSPF enabled on 10.71.152.10/24 area 0", "ACL 173: deny traffic from 192.168.121.110"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.71.152.140/24 is down, and ACL 173 denys traffic from 192.168.121.110."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.69.126.170 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.69.126.10.0.0.255 area 0\naccess-list 192 deny ip 192.168.98.19 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.69.126.170/24 (up)", "Routing: OSPF enabled on 10.69.126.10/24 area 0", "ACL 192: deny traffic from 192.168.98.19"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.69.126.170/24 is up, and ACL 192 denys traffic from 192.168.98.19."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.57.10.83 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.57.10.0.0.0.255 area 0\naccess-list 129 deny ip 192.168.161.99 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.57.10.83/24 (down)", "Routing: OSPF enabled on 10.57.10.0/24 area 0", "ACL 129: deny traffic from 192.168.161.99"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.57.10.83/24 is down, and ACL 129 denys traffic from 192.168.161.99."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.170.235.89 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.170.235.0.0.0.255 area 0\naccess-list 180 permit ip 192.168.3.202 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.170.235.89/24 (up)", "Routing: OSPF enabled on 10.170.235.0/24 area 0", "ACL 180: permit traffic from 192.168.3.202"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.170.235.89/24 is up, and ACL 180 permits traffic from 192.168.3.202."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.173.225.117 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.173.225.10.0.0.255 area 0\naccess-list 118 deny ip 192.168.192.123 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.173.225.117/24 (up)", "Routing: OSPF enabled on 10.173.225.10/24 area 0", "ACL 118: deny traffic from 192.168.192.123"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.173.225.117/24 is up, and ACL 118 denys traffic from 192.168.192.123."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.161.251.166 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.161.251.10.0.0.255 area 0\naccess-list 176 permit ip 192.168.243.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.161.251.166/24 (up)", "Routing: OSPF enabled on 10.161.251.10/24 area 0", "ACL 176: permit traffic from 192.168.243.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.161.251.166/24 is up, and ACL 176 permits traffic from 192.168.243.53."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.240.43.223 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.240.43.20.0.0.255 area 0\naccess-list 198 permit ip 192.168.196.252 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.240.43.223/24 (down)", "Routing: OSPF enabled on 10.240.43.20/24 area 0", "ACL 198: permit traffic from 192.168.196.252"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.240.43.223/24 is down, and ACL 198 permits traffic from 192.168.196.252."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.99.109.128 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.99.109.10.0.0.255 area 0\naccess-list 126 permit ip 192.168.26.241 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.99.109.128/24 (up)", "Routing: OSPF enabled on 10.99.109.10/24 area 0", "ACL 126: permit traffic from 192.168.26.241"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.99.109.128/24 is up, and ACL 126 permits traffic from 192.168.26.241."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.169.241.248 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.169.241.20.0.0.255 area 0\naccess-list 158 permit ip 192.168.228.149 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.169.241.248/24 (down)", "Routing: OSPF enabled on 10.169.241.20/24 area 0", "ACL 158: permit traffic from 192.168.228.149"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.169.241.248/24 is down, and ACL 158 permits traffic from 192.168.228.149."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.110.171.120 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.110.171.10.0.0.255 area 0\naccess-list 124 deny ip 192.168.98.213 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.110.171.120/24 (down)", "Routing: OSPF enabled on 10.110.171.10/24 area 0", "ACL 124: deny traffic from 192.168.98.213"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.110.171.120/24 is down, and ACL 124 denys traffic from 192.168.98.213."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.16.3.40 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.16.3.0.0.0.255 area 0\naccess-list 139 deny ip 192.168.24.12 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.16.3.40/24 (up)", "Routing: OSPF enabled on 10.16.3.0/24 area 0", "ACL 139: deny traffic from 192.168.24.12"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.16.3.40/24 is up, and ACL 139 denys traffic from 192.168.24.12."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.186.5.90 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.186.5.0.0.0.255 area 0\naccess-list 124 deny ip 192.168.242.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.186.5.90/24 (down)", "Routing: OSPF enabled on 10.186.5.0/24 area 0", "ACL 124: deny traffic from 192.168.242.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.186.5.90/24 is down, and ACL 124 denys traffic from 192.168.242.206."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.141.78.78 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.141.78.0.0.0.255 area 0\naccess-list 115 permit ip 192.168.35.6 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.141.78.78/24 (up)", "Routing: OSPF enabled on 10.141.78.0/24 area 0", "ACL 115: permit traffic from 192.168.35.6"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.141.78.78/24 is up, and ACL 115 permits traffic from 192.168.35.6."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.238.62.108 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.238.62.10.0.0.255 area 0\naccess-list 129 permit ip 192.168.8.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.238.62.108/24 (up)", "Routing: OSPF enabled on 10.238.62.10/24 area 0", "ACL 129: permit traffic from 192.168.8.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.238.62.108/24 is up, and ACL 129 permits traffic from 192.168.8.116."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.37.205.57 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.37.205.0.0.0.255 area 0\naccess-list 168 deny ip 192.168.165.184 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.37.205.57/24 (down)", "Routing: OSPF enabled on 10.37.205.0/24 area 0", "ACL 168: deny traffic from 192.168.165.184"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.37.205.57/24 is down, and ACL 168 denys traffic from 192.168.165.184."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.253.35.119 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.253.35.10.0.0.255 area 0\naccess-list 146 deny ip 192.168.76.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.253.35.119/24 (up)", "Routing: OSPF enabled on 10.253.35.10/24 area 0", "ACL 146: deny traffic from 192.168.76.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.253.35.119/24 is up, and ACL 146 denys traffic from 192.168.76.117."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.198.44.217 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.198.44.20.0.0.255 area 0\naccess-list 154 permit ip 192.168.156.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.198.44.217/24 (up)", "Routing: OSPF enabled on 10.198.44.20/24 area 0", "ACL 154: permit traffic from 192.168.156.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.198.44.217/24 is up, and ACL 154 permits traffic from 192.168.156.157."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.113.69.44 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.113.69.0.0.0.255 area 0\naccess-list 114 permit ip 192.168.11.104 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.113.69.44/24 (up)", "Routing: OSPF enabled on 10.113.69.0/24 area 0", "ACL 114: permit traffic from 192.168.11.104"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.113.69.44/24 is up, and ACL 114 permits traffic from 192.168.11.104."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.48.247.88 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.48.247.0.0.0.255 area 0\naccess-list 162 permit ip 192.168.86.6 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.48.247.88/24 (down)", "Routing: OSPF enabled on 10.48.247.0/24 area 0", "ACL 162: permit traffic from 192.168.86.6"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.48.247.88/24 is down, and ACL 162 permits traffic from 192.168.86.6."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.254.155.79 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.254.155.0.0.0.255 area 0\naccess-list 125 permit ip 192.168.237.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.254.155.79/24 (up)", "Routing: OSPF enabled on 10.254.155.0/24 area 0", "ACL 125: permit traffic from 192.168.237.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.254.155.79/24 is up, and ACL 125 permits traffic from 192.168.237.116."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.93.216.91 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.93.216.0.0.0.255 area 0\naccess-list 113 permit ip 192.168.154.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.93.216.91/24 (down)", "Routing: OSPF enabled on 10.93.216.0/24 area 0", "ACL 113: permit traffic from 192.168.154.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.93.216.91/24 is down, and ACL 113 permits traffic from 192.168.154.250."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.125.121.249 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.125.121.20.0.0.255 area 0\naccess-list 185 permit ip 192.168.111.124 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.125.121.249/24 (up)", "Routing: OSPF enabled on 10.125.121.20/24 area 0", "ACL 185: permit traffic from 192.168.111.124"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.125.121.249/24 is up, and ACL 185 permits traffic from 192.168.111.124."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.225.103.69 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.225.103.0.0.0.255 area 0\naccess-list 191 permit ip 192.168.231.184 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.225.103.69/24 (down)", "Routing: OSPF enabled on 10.225.103.0/24 area 0", "ACL 191: permit traffic from 192.168.231.184"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.225.103.69/24 is down, and ACL 191 permits traffic from 192.168.231.184."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.55.244.127 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.55.244.10.0.0.255 area 0\naccess-list 169 deny ip 192.168.103.174 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.55.244.127/24 (up)", "Routing: OSPF enabled on 10.55.244.10/24 area 0", "ACL 169: deny traffic from 192.168.103.174"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.55.244.127/24 is up, and ACL 169 denys traffic from 192.168.103.174."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.2.161.112 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.2.161.10.0.0.255 area 0\naccess-list 106 deny ip 192.168.209.228 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.2.161.112/24 (down)", "Routing: OSPF enabled on 10.2.161.10/24 area 0", "ACL 106: deny traffic from 192.168.209.228"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.2.161.112/24 is down, and ACL 106 denys traffic from 192.168.209.228."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.165.120.142 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.165.120.10.0.0.255 area 0\naccess-list 113 permit ip 192.168.32.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.165.120.142/24 (down)", "Routing: OSPF enabled on 10.165.120.10/24 area 0", "ACL 113: permit traffic from 192.168.32.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.165.120.142/24 is down, and ACL 113 permits traffic from 192.168.32.108."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.111.122.109 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.111.122.10.0.0.255 area 0\naccess-list 157 deny ip 192.168.72.183 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.111.122.109/24 (up)", "Routing: OSPF enabled on 10.111.122.10/24 area 0", "ACL 157: deny traffic from 192.168.72.183"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.111.122.109/24 is up, and ACL 157 denys traffic from 192.168.72.183."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.129.91.162 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.129.91.10.0.0.255 area 0\naccess-list 199 deny ip 192.168.229.88 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.129.91.162/24 (up)", "Routing: OSPF enabled on 10.129.91.10/24 area 0", "ACL 199: deny traffic from 192.168.229.88"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.129.91.162/24 is up, and ACL 199 denys traffic from 192.168.229.88."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.22.168.188 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.22.168.10.0.0.255 area 0\naccess-list 164 permit ip 192.168.31.89 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.22.168.188/24 (up)", "Routing: OSPF enabled on 10.22.168.10/24 area 0", "ACL 164: permit traffic from 192.168.31.89"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.22.168.188/24 is up, and ACL 164 permits traffic from 192.168.31.89."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.130.204.4 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.130.2040.0.0.255 area 0\naccess-list 100 permit ip 192.168.185.45 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.130.204.4/24 (up)", "Routing: OSPF enabled on 10.130.2040/24 area 0", "ACL 100: permit traffic from 192.168.185.45"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.130.204.4/24 is up, and ACL 100 permits traffic from 192.168.185.45."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.0.121.127 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.0.121.10.0.0.255 area 0\naccess-list 184 deny ip 192.168.119.225 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.0.121.127/24 (up)", "Routing: OSPF enabled on 10.0.121.10/24 area 0", "ACL 184: deny traffic from 192.168.119.225"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.0.121.127/24 is up, and ACL 184 denys traffic from 192.168.119.225."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.25.141.78 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.25.141.0.0.0.255 area 0\naccess-list 195 deny ip 192.168.40.200 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.25.141.78/24 (up)", "Routing: OSPF enabled on 10.25.141.0/24 area 0", "ACL 195: deny traffic from 192.168.40.200"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.25.141.78/24 is up, and ACL 195 denys traffic from 192.168.40.200."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.139.223.136 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.139.223.10.0.0.255 area 0\naccess-list 180 permit ip 192.168.85.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.139.223.136/24 (down)", "Routing: OSPF enabled on 10.139.223.10/24 area 0", "ACL 180: permit traffic from 192.168.85.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.139.223.136/24 is down, and ACL 180 permits traffic from 192.168.85.148."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.82.184.6 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.82.1840.0.0.255 area 0\naccess-list 137 permit ip 192.168.3.43 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.82.184.6/24 (down)", "Routing: OSPF enabled on 10.82.1840/24 area 0", "ACL 137: permit traffic from 192.168.3.43"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.82.184.6/24 is down, and ACL 137 permits traffic from 192.168.3.43."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.61.227.126 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.61.227.10.0.0.255 area 0\naccess-list 191 deny ip 192.168.83.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.61.227.126/24 (up)", "Routing: OSPF enabled on 10.61.227.10/24 area 0", "ACL 191: deny traffic from 192.168.83.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.61.227.126/24 is up, and ACL 191 denys traffic from 192.168.83.92."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.67.100.230 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.67.100.20.0.0.255 area 0\naccess-list 164 permit ip 192.168.67.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.67.100.230/24 (down)", "Routing: OSPF enabled on 10.67.100.20/24 area 0", "ACL 164: permit traffic from 192.168.67.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.67.100.230/24 is down, and ACL 164 permits traffic from 192.168.67.196."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.79.130.48 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.79.130.0.0.0.255 area 0\naccess-list 197 permit ip 192.168.136.167 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.79.130.48/24 (up)", "Routing: OSPF enabled on 10.79.130.0/24 area 0", "ACL 197: permit traffic from 192.168.136.167"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.79.130.48/24 is up, and ACL 197 permits traffic from 192.168.136.167."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.168.54.73 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.168.54.0.0.0.255 area 0\naccess-list 159 deny ip 192.168.24.214 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.168.54.73/24 (down)", "Routing: OSPF enabled on 10.168.54.0/24 area 0", "ACL 159: deny traffic from 192.168.24.214"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.168.54.73/24 is down, and ACL 159 denys traffic from 192.168.24.214."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.36.45.46 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.36.45.0.0.0.255 area 0\naccess-list 150 permit ip 192.168.244.223 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.36.45.46/24 (up)", "Routing: OSPF enabled on 10.36.45.0/24 area 0", "ACL 150: permit traffic from 192.168.244.223"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.36.45.46/24 is up, and ACL 150 permits traffic from 192.168.244.223."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.81.53.45 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.81.53.0.0.0.255 area 0\naccess-list 126 permit ip 192.168.203.227 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.81.53.45/24 (up)", "Routing: OSPF enabled on 10.81.53.0/24 area 0", "ACL 126: permit traffic from 192.168.203.227"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.81.53.45/24 is up, and ACL 126 permits traffic from 192.168.203.227."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.115.71.185 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.115.71.10.0.0.255 area 0\naccess-list 192 deny ip 192.168.28.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.115.71.185/24 (down)", "Routing: OSPF enabled on 10.115.71.10/24 area 0", "ACL 192: deny traffic from 192.168.28.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.115.71.185/24 is down, and ACL 192 denys traffic from 192.168.28.221."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.111.255.74 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.111.255.0.0.0.255 area 0\naccess-list 173 permit ip 192.168.83.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.111.255.74/24 (up)", "Routing: OSPF enabled on 10.111.255.0/24 area 0", "ACL 173: permit traffic from 192.168.83.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.111.255.74/24 is up, and ACL 173 permits traffic from 192.168.83.77."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.138.110.15 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.138.110.0.0.0.255 area 0\naccess-list 122 deny ip 192.168.145.177 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.138.110.15/24 (up)", "Routing: OSPF enabled on 10.138.110.0/24 area 0", "ACL 122: deny traffic from 192.168.145.177"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.138.110.15/24 is up, and ACL 122 denys traffic from 192.168.145.177."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.10.235.248 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.10.235.20.0.0.255 area 0\naccess-list 188 permit ip 192.168.21.166 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.10.235.248/24 (up)", "Routing: OSPF enabled on 10.10.235.20/24 area 0", "ACL 188: permit traffic from 192.168.21.166"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.10.235.248/24 is up, and ACL 188 permits traffic from 192.168.21.166."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.45.200.109 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.45.200.10.0.0.255 area 0\naccess-list 128 permit ip 192.168.194.255 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.45.200.109/24 (down)", "Routing: OSPF enabled on 10.45.200.10/24 area 0", "ACL 128: permit traffic from 192.168.194.255"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.45.200.109/24 is down, and ACL 128 permits traffic from 192.168.194.255."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.100.111.205 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.100.111.20.0.0.255 area 0\naccess-list 109 permit ip 192.168.189.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.100.111.205/24 (down)", "Routing: OSPF enabled on 10.100.111.20/24 area 0", "ACL 109: permit traffic from 192.168.189.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.100.111.205/24 is down, and ACL 109 permits traffic from 192.168.189.49."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.238.232.107 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.238.232.10.0.0.255 area 0\naccess-list 109 permit ip 192.168.228.137 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.238.232.107/24 (down)", "Routing: OSPF enabled on 10.238.232.10/24 area 0", "ACL 109: permit traffic from 192.168.228.137"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.238.232.107/24 is down, and ACL 109 permits traffic from 192.168.228.137."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.240.219.156 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.240.219.10.0.0.255 area 0\naccess-list 114 permit ip 192.168.43.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.240.219.156/24 (up)", "Routing: OSPF enabled on 10.240.219.10/24 area 0", "ACL 114: permit traffic from 192.168.43.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.240.219.156/24 is up, and ACL 114 permits traffic from 192.168.43.75."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.72.14.109 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.72.14.10.0.0.255 area 0\naccess-list 191 deny ip 192.168.106.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.72.14.109/24 (down)", "Routing: OSPF enabled on 10.72.14.10/24 area 0", "ACL 191: deny traffic from 192.168.106.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.72.14.109/24 is down, and ACL 191 denys traffic from 192.168.106.221."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.195.165.84 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.195.165.0.0.0.255 area 0\naccess-list 156 deny ip 192.168.204.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.195.165.84/24 (up)", "Routing: OSPF enabled on 10.195.165.0/24 area 0", "ACL 156: deny traffic from 192.168.204.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.195.165.84/24 is up, and ACL 156 denys traffic from 192.168.204.146."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.215.56.25 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.215.56.0.0.0.255 area 0\naccess-list 135 deny ip 192.168.37.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.215.56.25/24 (up)", "Routing: OSPF enabled on 10.215.56.0/24 area 0", "ACL 135: deny traffic from 192.168.37.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.215.56.25/24 is up, and ACL 135 denys traffic from 192.168.37.56."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.111.208.93 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.111.208.0.0.0.255 area 0\naccess-list 106 deny ip 192.168.83.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.111.208.93/24 (up)", "Routing: OSPF enabled on 10.111.208.0/24 area 0", "ACL 106: deny traffic from 192.168.83.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.111.208.93/24 is up, and ACL 106 denys traffic from 192.168.83.154."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.155.6.2 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.155.60.0.0.255 area 0\naccess-list 140 permit ip 192.168.197.239 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.155.6.2/24 (down)", "Routing: OSPF enabled on 10.155.60/24 area 0", "ACL 140: permit traffic from 192.168.197.239"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.155.6.2/24 is down, and ACL 140 permits traffic from 192.168.197.239."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.80.37.156 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.80.37.10.0.0.255 area 0\naccess-list 159 deny ip 192.168.213.218 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.80.37.156/24 (up)", "Routing: OSPF enabled on 10.80.37.10/24 area 0", "ACL 159: deny traffic from 192.168.213.218"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.80.37.156/24 is up, and ACL 159 denys traffic from 192.168.213.218."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.216.61.78 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.216.61.0.0.0.255 area 0\naccess-list 140 deny ip 192.168.115.243 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.216.61.78/24 (down)", "Routing: OSPF enabled on 10.216.61.0/24 area 0", "ACL 140: deny traffic from 192.168.115.243"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.216.61.78/24 is down, and ACL 140 denys traffic from 192.168.115.243."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.189.110.184 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.189.110.10.0.0.255 area 0\naccess-list 142 permit ip 192.168.172.83 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.189.110.184/24 (up)", "Routing: OSPF enabled on 10.189.110.10/24 area 0", "ACL 142: permit traffic from 192.168.172.83"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.189.110.184/24 is up, and ACL 142 permits traffic from 192.168.172.83."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.160.159.141 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.160.159.10.0.0.255 area 0\naccess-list 157 deny ip 192.168.142.50 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.160.159.141/24 (down)", "Routing: OSPF enabled on 10.160.159.10/24 area 0", "ACL 157: deny traffic from 192.168.142.50"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.160.159.141/24 is down, and ACL 157 denys traffic from 192.168.142.50."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.154.12.232 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.154.12.20.0.0.255 area 0\naccess-list 182 deny ip 192.168.197.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.154.12.232/24 (down)", "Routing: OSPF enabled on 10.154.12.20/24 area 0", "ACL 182: deny traffic from 192.168.197.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.154.12.232/24 is down, and ACL 182 denys traffic from 192.168.197.67."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.101.214.56 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.101.214.0.0.0.255 area 0\naccess-list 195 permit ip 192.168.0.131 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.101.214.56/24 (down)", "Routing: OSPF enabled on 10.101.214.0/24 area 0", "ACL 195: permit traffic from 192.168.0.131"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.101.214.56/24 is down, and ACL 195 permits traffic from 192.168.0.131."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.214.55.73 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.214.55.0.0.0.255 area 0\naccess-list 166 deny ip 192.168.66.47 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.214.55.73/24 (up)", "Routing: OSPF enabled on 10.214.55.0/24 area 0", "ACL 166: deny traffic from 192.168.66.47"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.214.55.73/24 is up, and ACL 166 denys traffic from 192.168.66.47."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.10.66.168 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.10.66.10.0.0.255 area 0\naccess-list 195 deny ip 192.168.29.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.10.66.168/24 (up)", "Routing: OSPF enabled on 10.10.66.10/24 area 0", "ACL 195: deny traffic from 192.168.29.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.10.66.168/24 is up, and ACL 195 denys traffic from 192.168.29.129."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.57.2.51 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.57.2.0.0.0.255 area 0\naccess-list 141 permit ip 192.168.166.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.57.2.51/24 (down)", "Routing: OSPF enabled on 10.57.2.0/24 area 0", "ACL 141: permit traffic from 192.168.166.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.57.2.51/24 is down, and ACL 141 permits traffic from 192.168.166.160."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.140.48.193 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.140.48.10.0.0.255 area 0\naccess-list 121 deny ip 192.168.23.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.140.48.193/24 (down)", "Routing: OSPF enabled on 10.140.48.10/24 area 0", "ACL 121: deny traffic from 192.168.23.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.140.48.193/24 is down, and ACL 121 denys traffic from 192.168.23.105."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.62.55.206 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.62.55.20.0.0.255 area 0\naccess-list 137 permit ip 192.168.247.179 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.62.55.206/24 (up)", "Routing: OSPF enabled on 10.62.55.20/24 area 0", "ACL 137: permit traffic from 192.168.247.179"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.62.55.206/24 is up, and ACL 137 permits traffic from 192.168.247.179."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.96.145.3 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.96.1450.0.0.255 area 0\naccess-list 158 deny ip 192.168.189.164 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.96.145.3/24 (up)", "Routing: OSPF enabled on 10.96.1450/24 area 0", "ACL 158: deny traffic from 192.168.189.164"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.96.145.3/24 is up, and ACL 158 denys traffic from 192.168.189.164."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.240.179.142 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.240.179.10.0.0.255 area 0\naccess-list 165 permit ip 192.168.160.80 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.240.179.142/24 (up)", "Routing: OSPF enabled on 10.240.179.10/24 area 0", "ACL 165: permit traffic from 192.168.160.80"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.240.179.142/24 is up, and ACL 165 permits traffic from 192.168.160.80."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.68.85.166 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.68.85.10.0.0.255 area 0\naccess-list 170 permit ip 192.168.124.143 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.68.85.166/24 (up)", "Routing: OSPF enabled on 10.68.85.10/24 area 0", "ACL 170: permit traffic from 192.168.124.143"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.68.85.166/24 is up, and ACL 170 permits traffic from 192.168.124.143."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.171.179.97 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.171.179.0.0.0.255 area 0\naccess-list 145 permit ip 192.168.74.1 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.171.179.97/24 (down)", "Routing: OSPF enabled on 10.171.179.0/24 area 0", "ACL 145: permit traffic from 192.168.74.1"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.171.179.97/24 is down, and ACL 145 permits traffic from 192.168.74.1."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.154.168.21 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.154.168.0.0.0.255 area 0\naccess-list 168 deny ip 192.168.255.81 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.154.168.21/24 (down)", "Routing: OSPF enabled on 10.154.168.0/24 area 0", "ACL 168: deny traffic from 192.168.255.81"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.154.168.21/24 is down, and ACL 168 denys traffic from 192.168.255.81."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.182.49.16 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.182.49.0.0.0.255 area 0\naccess-list 199 permit ip 192.168.218.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.182.49.16/24 (down)", "Routing: OSPF enabled on 10.182.49.0/24 area 0", "ACL 199: permit traffic from 192.168.218.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.182.49.16/24 is down, and ACL 199 permits traffic from 192.168.218.192."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.59.46.134 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.59.46.10.0.0.255 area 0\naccess-list 128 deny ip 192.168.26.21 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.59.46.134/24 (up)", "Routing: OSPF enabled on 10.59.46.10/24 area 0", "ACL 128: deny traffic from 192.168.26.21"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.59.46.134/24 is up, and ACL 128 denys traffic from 192.168.26.21."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.231.198.101 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.231.198.10.0.0.255 area 0\naccess-list 152 permit ip 192.168.33.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.231.198.101/24 (up)", "Routing: OSPF enabled on 10.231.198.10/24 area 0", "ACL 152: permit traffic from 192.168.33.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.231.198.101/24 is up, and ACL 152 permits traffic from 192.168.33.206."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.143.169.199 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.143.169.10.0.0.255 area 0\naccess-list 198 permit ip 192.168.206.239 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.143.169.199/24 (down)", "Routing: OSPF enabled on 10.143.169.10/24 area 0", "ACL 198: permit traffic from 192.168.206.239"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.143.169.199/24 is down, and ACL 198 permits traffic from 192.168.206.239."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.66.191.147 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.66.191.10.0.0.255 area 0\naccess-list 150 deny ip 192.168.152.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.66.191.147/24 (down)", "Routing: OSPF enabled on 10.66.191.10/24 area 0", "ACL 150: deny traffic from 192.168.152.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.66.191.147/24 is down, and ACL 150 denys traffic from 192.168.152.94."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.162.160.94 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.162.160.0.0.0.255 area 0\naccess-list 103 permit ip 192.168.243.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.162.160.94/24 (up)", "Routing: OSPF enabled on 10.162.160.0/24 area 0", "ACL 103: permit traffic from 192.168.243.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.162.160.94/24 is up, and ACL 103 permits traffic from 192.168.243.192."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.181.71.104 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.181.71.10.0.0.255 area 0\naccess-list 101 permit ip 192.168.167.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.181.71.104/24 (down)", "Routing: OSPF enabled on 10.181.71.10/24 area 0", "ACL 101: permit traffic from 192.168.167.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.181.71.104/24 is down, and ACL 101 permits traffic from 192.168.167.155."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.162.254.31 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.162.254.0.0.0.255 area 0\naccess-list 152 deny ip 192.168.3.131 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.162.254.31/24 (down)", "Routing: OSPF enabled on 10.162.254.0/24 area 0", "ACL 152: deny traffic from 192.168.3.131"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.162.254.31/24 is down, and ACL 152 denys traffic from 192.168.3.131."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.96.145.108 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.96.145.10.0.0.255 area 0\naccess-list 113 deny ip 192.168.62.8 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.96.145.108/24 (up)", "Routing: OSPF enabled on 10.96.145.10/24 area 0", "ACL 113: deny traffic from 192.168.62.8"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.96.145.108/24 is up, and ACL 113 denys traffic from 192.168.62.8."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.91.59.23 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.91.59.0.0.0.255 area 0\naccess-list 131 deny ip 192.168.68.182 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.91.59.23/24 (down)", "Routing: OSPF enabled on 10.91.59.0/24 area 0", "ACL 131: deny traffic from 192.168.68.182"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.91.59.23/24 is down, and ACL 131 denys traffic from 192.168.68.182."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.89.172.109 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.89.172.10.0.0.255 area 0\naccess-list 197 permit ip 192.168.183.176 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.89.172.109/24 (up)", "Routing: OSPF enabled on 10.89.172.10/24 area 0", "ACL 197: permit traffic from 192.168.183.176"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.89.172.109/24 is up, and ACL 197 permits traffic from 192.168.183.176."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.233.227.4 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.233.2270.0.0.255 area 0\naccess-list 130 deny ip 192.168.136.87 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.233.227.4/24 (down)", "Routing: OSPF enabled on 10.233.2270/24 area 0", "ACL 130: deny traffic from 192.168.136.87"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.233.227.4/24 is down, and ACL 130 denys traffic from 192.168.136.87."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.196.254.12 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.196.254.0.0.0.255 area 0\naccess-list 120 deny ip 192.168.108.47 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.196.254.12/24 (down)", "Routing: OSPF enabled on 10.196.254.0/24 area 0", "ACL 120: deny traffic from 192.168.108.47"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.196.254.12/24 is down, and ACL 120 denys traffic from 192.168.108.47."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.164.117.54 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.164.117.0.0.0.255 area 0\naccess-list 141 permit ip 192.168.56.236 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.164.117.54/24 (down)", "Routing: OSPF enabled on 10.164.117.0/24 area 0", "ACL 141: permit traffic from 192.168.56.236"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.164.117.54/24 is down, and ACL 141 permits traffic from 192.168.56.236."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.9.173.145 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.9.173.10.0.0.255 area 0\naccess-list 143 permit ip 192.168.163.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.9.173.145/24 (down)", "Routing: OSPF enabled on 10.9.173.10/24 area 0", "ACL 143: permit traffic from 192.168.163.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.9.173.145/24 is down, and ACL 143 permits traffic from 192.168.163.199."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.228.250.229 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.228.250.20.0.0.255 area 0\naccess-list 123 permit ip 192.168.180.57 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.228.250.229/24 (down)", "Routing: OSPF enabled on 10.228.250.20/24 area 0", "ACL 123: permit traffic from 192.168.180.57"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.228.250.229/24 is down, and ACL 123 permits traffic from 192.168.180.57."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.148.79.195 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.148.79.10.0.0.255 area 0\naccess-list 129 deny ip 192.168.50.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.148.79.195/24 (down)", "Routing: OSPF enabled on 10.148.79.10/24 area 0", "ACL 129: deny traffic from 192.168.50.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.148.79.195/24 is down, and ACL 129 denys traffic from 192.168.50.230."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.222.85.219 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.222.85.20.0.0.255 area 0\naccess-list 167 deny ip 192.168.156.147 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.222.85.219/24 (up)", "Routing: OSPF enabled on 10.222.85.20/24 area 0", "ACL 167: deny traffic from 192.168.156.147"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.222.85.219/24 is up, and ACL 167 denys traffic from 192.168.156.147."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.61.27.79 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.61.27.0.0.0.255 area 0\naccess-list 125 deny ip 192.168.227.176 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.61.27.79/24 (down)", "Routing: OSPF enabled on 10.61.27.0/24 area 0", "ACL 125: deny traffic from 192.168.227.176"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.61.27.79/24 is down, and ACL 125 denys traffic from 192.168.227.176."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.7.63.204 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.7.63.20.0.0.255 area 0\naccess-list 106 permit ip 192.168.70.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.7.63.204/24 (up)", "Routing: OSPF enabled on 10.7.63.20/24 area 0", "ACL 106: permit traffic from 192.168.70.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.7.63.204/24 is up, and ACL 106 permits traffic from 192.168.70.191."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.253.133.56 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.253.133.0.0.0.255 area 0\naccess-list 167 deny ip 192.168.116.8 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.253.133.56/24 (down)", "Routing: OSPF enabled on 10.253.133.0/24 area 0", "ACL 167: deny traffic from 192.168.116.8"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.253.133.56/24 is down, and ACL 167 denys traffic from 192.168.116.8."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.146.101.147 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.146.101.10.0.0.255 area 0\naccess-list 165 permit ip 192.168.195.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.146.101.147/24 (up)", "Routing: OSPF enabled on 10.146.101.10/24 area 0", "ACL 165: permit traffic from 192.168.195.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.146.101.147/24 is up, and ACL 165 permits traffic from 192.168.195.95."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.69.14.122 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.69.14.10.0.0.255 area 0\naccess-list 167 deny ip 192.168.140.174 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.69.14.122/24 (up)", "Routing: OSPF enabled on 10.69.14.10/24 area 0", "ACL 167: deny traffic from 192.168.140.174"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.69.14.122/24 is up, and ACL 167 denys traffic from 192.168.140.174."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.230.58.188 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.230.58.10.0.0.255 area 0\naccess-list 107 deny ip 192.168.150.241 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.230.58.188/24 (down)", "Routing: OSPF enabled on 10.230.58.10/24 area 0", "ACL 107: deny traffic from 192.168.150.241"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.230.58.188/24 is down, and ACL 107 denys traffic from 192.168.150.241."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.143.63.46 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.143.63.0.0.0.255 area 0\naccess-list 154 permit ip 192.168.4.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.143.63.46/24 (down)", "Routing: OSPF enabled on 10.143.63.0/24 area 0", "ACL 154: permit traffic from 192.168.4.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.143.63.46/24 is down, and ACL 154 permits traffic from 192.168.4.121."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.12.94.159 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.12.94.10.0.0.255 area 0\naccess-list 140 permit ip 192.168.86.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.12.94.159/24 (up)", "Routing: OSPF enabled on 10.12.94.10/24 area 0", "ACL 140: permit traffic from 192.168.86.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.12.94.159/24 is up, and ACL 140 permits traffic from 192.168.86.116."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.44.98.150 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.44.98.10.0.0.255 area 0\naccess-list 156 permit ip 192.168.184.98 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.44.98.150/24 (up)", "Routing: OSPF enabled on 10.44.98.10/24 area 0", "ACL 156: permit traffic from 192.168.184.98"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.44.98.150/24 is up, and ACL 156 permits traffic from 192.168.184.98."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.55.164.161 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.55.164.10.0.0.255 area 0\naccess-list 142 deny ip 192.168.209.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.55.164.161/24 (down)", "Routing: OSPF enabled on 10.55.164.10/24 area 0", "ACL 142: deny traffic from 192.168.209.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.55.164.161/24 is down, and ACL 142 denys traffic from 192.168.209.78."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.255.182.52 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.255.182.0.0.0.255 area 0\naccess-list 136 permit ip 192.168.232.131 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.255.182.52/24 (up)", "Routing: OSPF enabled on 10.255.182.0/24 area 0", "ACL 136: permit traffic from 192.168.232.131"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.255.182.52/24 is up, and ACL 136 permits traffic from 192.168.232.131."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.59.123.214 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.59.123.20.0.0.255 area 0\naccess-list 100 permit ip 192.168.117.249 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.59.123.214/24 (up)", "Routing: OSPF enabled on 10.59.123.20/24 area 0", "ACL 100: permit traffic from 192.168.117.249"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.59.123.214/24 is up, and ACL 100 permits traffic from 192.168.117.249."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.2.211.241 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.2.211.20.0.0.255 area 0\naccess-list 195 deny ip 192.168.43.163 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.2.211.241/24 (up)", "Routing: OSPF enabled on 10.2.211.20/24 area 0", "ACL 195: deny traffic from 192.168.43.163"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.2.211.241/24 is up, and ACL 195 denys traffic from 192.168.43.163."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.245.103.133 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.245.103.10.0.0.255 area 0\naccess-list 110 deny ip 192.168.50.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.245.103.133/24 (up)", "Routing: OSPF enabled on 10.245.103.10/24 area 0", "ACL 110: deny traffic from 192.168.50.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.245.103.133/24 is up, and ACL 110 denys traffic from 192.168.50.25."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.160.80.166 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.160.80.10.0.0.255 area 0\naccess-list 178 deny ip 192.168.83.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.160.80.166/24 (up)", "Routing: OSPF enabled on 10.160.80.10/24 area 0", "ACL 178: deny traffic from 192.168.83.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.160.80.166/24 is up, and ACL 178 denys traffic from 192.168.83.220."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.65.175.63 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.65.175.0.0.0.255 area 0\naccess-list 104 permit ip 192.168.119.18 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.65.175.63/24 (down)", "Routing: OSPF enabled on 10.65.175.0/24 area 0", "ACL 104: permit traffic from 192.168.119.18"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.65.175.63/24 is down, and ACL 104 permits traffic from 192.168.119.18."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.153.230.210 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.153.230.20.0.0.255 area 0\naccess-list 166 permit ip 192.168.158.52 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.153.230.210/24 (down)", "Routing: OSPF enabled on 10.153.230.20/24 area 0", "ACL 166: permit traffic from 192.168.158.52"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.153.230.210/24 is down, and ACL 166 permits traffic from 192.168.158.52."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.236.219.133 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.236.219.10.0.0.255 area 0\naccess-list 131 permit ip 192.168.10.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.236.219.133/24 (down)", "Routing: OSPF enabled on 10.236.219.10/24 area 0", "ACL 131: permit traffic from 192.168.10.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.236.219.133/24 is down, and ACL 131 permits traffic from 192.168.10.92."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.187.21.89 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.187.21.0.0.0.255 area 0\naccess-list 132 permit ip 192.168.47.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.187.21.89/24 (up)", "Routing: OSPF enabled on 10.187.21.0/24 area 0", "ACL 132: permit traffic from 192.168.47.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.187.21.89/24 is up, and ACL 132 permits traffic from 192.168.47.38."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.249.117.178 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.249.117.10.0.0.255 area 0\naccess-list 196 permit ip 192.168.217.46 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.249.117.178/24 (down)", "Routing: OSPF enabled on 10.249.117.10/24 area 0", "ACL 196: permit traffic from 192.168.217.46"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.249.117.178/24 is down, and ACL 196 permits traffic from 192.168.217.46."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.167.93.75 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.167.93.0.0.0.255 area 0\naccess-list 122 permit ip 192.168.240.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.167.93.75/24 (up)", "Routing: OSPF enabled on 10.167.93.0/24 area 0", "ACL 122: permit traffic from 192.168.240.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.167.93.75/24 is up, and ACL 122 permits traffic from 192.168.240.251."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.66.111.176 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.66.111.10.0.0.255 area 0\naccess-list 192 deny ip 192.168.209.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.66.111.176/24 (up)", "Routing: OSPF enabled on 10.66.111.10/24 area 0", "ACL 192: deny traffic from 192.168.209.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.66.111.176/24 is up, and ACL 192 denys traffic from 192.168.209.77."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.244.55.68 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.244.55.0.0.0.255 area 0\naccess-list 117 permit ip 192.168.70.252 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.244.55.68/24 (down)", "Routing: OSPF enabled on 10.244.55.0/24 area 0", "ACL 117: permit traffic from 192.168.70.252"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.244.55.68/24 is down, and ACL 117 permits traffic from 192.168.70.252."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.79.168.145 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.79.168.10.0.0.255 area 0\naccess-list 155 permit ip 192.168.71.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.79.168.145/24 (down)", "Routing: OSPF enabled on 10.79.168.10/24 area 0", "ACL 155: permit traffic from 192.168.71.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.79.168.145/24 is down, and ACL 155 permits traffic from 192.168.71.251."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.149.149.146 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.149.149.10.0.0.255 area 0\naccess-list 184 deny ip 192.168.140.64 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.149.149.146/24 (down)", "Routing: OSPF enabled on 10.149.149.10/24 area 0", "ACL 184: deny traffic from 192.168.140.64"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.149.149.146/24 is down, and ACL 184 denys traffic from 192.168.140.64."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.51.192.233 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.51.192.20.0.0.255 area 0\naccess-list 123 deny ip 192.168.20.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.51.192.233/24 (down)", "Routing: OSPF enabled on 10.51.192.20/24 area 0", "ACL 123: deny traffic from 192.168.20.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.51.192.233/24 is down, and ACL 123 denys traffic from 192.168.20.238."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.127.208.56 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.127.208.0.0.0.255 area 0\naccess-list 165 deny ip 192.168.11.210 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.127.208.56/24 (up)", "Routing: OSPF enabled on 10.127.208.0/24 area 0", "ACL 165: deny traffic from 192.168.11.210"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.127.208.56/24 is up, and ACL 165 denys traffic from 192.168.11.210."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.85.108.114 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.85.108.10.0.0.255 area 0\naccess-list 153 permit ip 192.168.199.141 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.85.108.114/24 (up)", "Routing: OSPF enabled on 10.85.108.10/24 area 0", "ACL 153: permit traffic from 192.168.199.141"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.85.108.114/24 is up, and ACL 153 permits traffic from 192.168.199.141."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.192.156.216 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.192.156.20.0.0.255 area 0\naccess-list 107 permit ip 192.168.136.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.192.156.216/24 (down)", "Routing: OSPF enabled on 10.192.156.20/24 area 0", "ACL 107: permit traffic from 192.168.136.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.192.156.216/24 is down, and ACL 107 permits traffic from 192.168.136.245."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.101.250.80 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.101.250.0.0.0.255 area 0\naccess-list 144 permit ip 192.168.191.231 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.101.250.80/24 (down)", "Routing: OSPF enabled on 10.101.250.0/24 area 0", "ACL 144: permit traffic from 192.168.191.231"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.101.250.80/24 is down, and ACL 144 permits traffic from 192.168.191.231."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.237.104.53 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.237.104.0.0.0.255 area 0\naccess-list 101 deny ip 192.168.89.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.237.104.53/24 (down)", "Routing: OSPF enabled on 10.237.104.0/24 area 0", "ACL 101: deny traffic from 192.168.89.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.237.104.53/24 is down, and ACL 101 denys traffic from 192.168.89.172."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.8.106.67 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.8.106.0.0.0.255 area 0\naccess-list 132 permit ip 192.168.42.103 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.8.106.67/24 (up)", "Routing: OSPF enabled on 10.8.106.0/24 area 0", "ACL 132: permit traffic from 192.168.42.103"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.8.106.67/24 is up, and ACL 132 permits traffic from 192.168.42.103."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.212.145.154 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.212.145.10.0.0.255 area 0\naccess-list 115 deny ip 192.168.23.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.212.145.154/24 (down)", "Routing: OSPF enabled on 10.212.145.10/24 area 0", "ACL 115: deny traffic from 192.168.23.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.212.145.154/24 is down, and ACL 115 denys traffic from 192.168.23.204."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.123.49.185 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.123.49.10.0.0.255 area 0\naccess-list 181 permit ip 192.168.125.33 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.123.49.185/24 (up)", "Routing: OSPF enabled on 10.123.49.10/24 area 0", "ACL 181: permit traffic from 192.168.125.33"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.123.49.185/24 is up, and ACL 181 permits traffic from 192.168.125.33."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.214.136.64 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.214.136.0.0.0.255 area 0\naccess-list 184 deny ip 192.168.26.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.214.136.64/24 (down)", "Routing: OSPF enabled on 10.214.136.0/24 area 0", "ACL 184: deny traffic from 192.168.26.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.214.136.64/24 is down, and ACL 184 denys traffic from 192.168.26.117."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.208.204.232 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.208.204.20.0.0.255 area 0\naccess-list 133 deny ip 192.168.148.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.208.204.232/24 (up)", "Routing: OSPF enabled on 10.208.204.20/24 area 0", "ACL 133: deny traffic from 192.168.148.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.208.204.232/24 is up, and ACL 133 denys traffic from 192.168.148.230."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.142.195.250 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.142.195.20.0.0.255 area 0\naccess-list 193 permit ip 192.168.215.64 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.142.195.250/24 (up)", "Routing: OSPF enabled on 10.142.195.20/24 area 0", "ACL 193: permit traffic from 192.168.215.64"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.142.195.250/24 is up, and ACL 193 permits traffic from 192.168.215.64."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.47.39.49 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.47.39.0.0.0.255 area 0\naccess-list 159 deny ip 192.168.146.5 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.47.39.49/24 (down)", "Routing: OSPF enabled on 10.47.39.0/24 area 0", "ACL 159: deny traffic from 192.168.146.5"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.47.39.49/24 is down, and ACL 159 denys traffic from 192.168.146.5."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.7.139.29 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.7.139.0.0.0.255 area 0\naccess-list 147 permit ip 192.168.119.179 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.7.139.29/24 (down)", "Routing: OSPF enabled on 10.7.139.0/24 area 0", "ACL 147: permit traffic from 192.168.119.179"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.7.139.29/24 is down, and ACL 147 permits traffic from 192.168.119.179."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.134.210.192 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.134.210.10.0.0.255 area 0\naccess-list 160 deny ip 192.168.15.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.134.210.192/24 (up)", "Routing: OSPF enabled on 10.134.210.10/24 area 0", "ACL 160: deny traffic from 192.168.15.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.134.210.192/24 is up, and ACL 160 denys traffic from 192.168.15.193."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.141.70.136 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.141.70.10.0.0.255 area 0\naccess-list 124 deny ip 192.168.186.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.141.70.136/24 (up)", "Routing: OSPF enabled on 10.141.70.10/24 area 0", "ACL 124: deny traffic from 192.168.186.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.141.70.136/24 is up, and ACL 124 denys traffic from 192.168.186.250."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.188.140.238 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.188.140.20.0.0.255 area 0\naccess-list 196 deny ip 192.168.95.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.188.140.238/24 (down)", "Routing: OSPF enabled on 10.188.140.20/24 area 0", "ACL 196: deny traffic from 192.168.95.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.188.140.238/24 is down, and ACL 196 denys traffic from 192.168.95.220."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.67.196.60 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.67.196.0.0.0.255 area 0\naccess-list 182 deny ip 192.168.191.35 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.67.196.60/24 (up)", "Routing: OSPF enabled on 10.67.196.0/24 area 0", "ACL 182: deny traffic from 192.168.191.35"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.67.196.60/24 is up, and ACL 182 denys traffic from 192.168.191.35."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.184.215.253 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.184.215.20.0.0.255 area 0\naccess-list 160 deny ip 192.168.206.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.184.215.253/24 (up)", "Routing: OSPF enabled on 10.184.215.20/24 area 0", "ACL 160: deny traffic from 192.168.206.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.184.215.253/24 is up, and ACL 160 denys traffic from 192.168.206.107."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.30.126.17 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.30.126.0.0.0.255 area 0\naccess-list 173 permit ip 192.168.86.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.30.126.17/24 (up)", "Routing: OSPF enabled on 10.30.126.0/24 area 0", "ACL 173: permit traffic from 192.168.86.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.30.126.17/24 is up, and ACL 173 permits traffic from 192.168.86.208."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.79.101.79 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.79.101.0.0.0.255 area 0\naccess-list 176 permit ip 192.168.115.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.79.101.79/24 (down)", "Routing: OSPF enabled on 10.79.101.0/24 area 0", "ACL 176: permit traffic from 192.168.115.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.79.101.79/24 is down, and ACL 176 permits traffic from 192.168.115.242."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.51.245.243 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.51.245.20.0.0.255 area 0\naccess-list 121 deny ip 192.168.139.102 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.51.245.243/24 (down)", "Routing: OSPF enabled on 10.51.245.20/24 area 0", "ACL 121: deny traffic from 192.168.139.102"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.51.245.243/24 is down, and ACL 121 denys traffic from 192.168.139.102."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.126.210.199 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.126.210.10.0.0.255 area 0\naccess-list 162 deny ip 192.168.29.62 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.126.210.199/24 (down)", "Routing: OSPF enabled on 10.126.210.10/24 area 0", "ACL 162: deny traffic from 192.168.29.62"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.126.210.199/24 is down, and ACL 162 denys traffic from 192.168.29.62."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.201.39.5 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.201.390.0.0.255 area 0\naccess-list 123 deny ip 192.168.116.217 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.201.39.5/24 (up)", "Routing: OSPF enabled on 10.201.390/24 area 0", "ACL 123: deny traffic from 192.168.116.217"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.201.39.5/24 is up, and ACL 123 denys traffic from 192.168.116.217."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.79.186.72 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.79.186.0.0.0.255 area 0\naccess-list 137 deny ip 192.168.58.31 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.79.186.72/24 (up)", "Routing: OSPF enabled on 10.79.186.0/24 area 0", "ACL 137: deny traffic from 192.168.58.31"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.79.186.72/24 is up, and ACL 137 denys traffic from 192.168.58.31."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.106.211.189 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.106.211.10.0.0.255 area 0\naccess-list 151 deny ip 192.168.175.6 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.106.211.189/24 (up)", "Routing: OSPF enabled on 10.106.211.10/24 area 0", "ACL 151: deny traffic from 192.168.175.6"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.106.211.189/24 is up, and ACL 151 denys traffic from 192.168.175.6."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.208.174.12 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.208.174.0.0.0.255 area 0\naccess-list 160 permit ip 192.168.161.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.208.174.12/24 (up)", "Routing: OSPF enabled on 10.208.174.0/24 area 0", "ACL 160: permit traffic from 192.168.161.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.208.174.12/24 is up, and ACL 160 permits traffic from 192.168.161.94."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.148.178.94 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.148.178.0.0.0.255 area 0\naccess-list 198 permit ip 192.168.140.100 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.148.178.94/24 (down)", "Routing: OSPF enabled on 10.148.178.0/24 area 0", "ACL 198: permit traffic from 192.168.140.100"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.148.178.94/24 is down, and ACL 198 permits traffic from 192.168.140.100."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.41.97.94 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.41.97.0.0.0.255 area 0\naccess-list 143 permit ip 192.168.180.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.41.97.94/24 (up)", "Routing: OSPF enabled on 10.41.97.0/24 area 0", "ACL 143: permit traffic from 192.168.180.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.41.97.94/24 is up, and ACL 143 permits traffic from 192.168.180.148."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.72.44.186 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.72.44.10.0.0.255 area 0\naccess-list 102 deny ip 192.168.57.177 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.72.44.186/24 (up)", "Routing: OSPF enabled on 10.72.44.10/24 area 0", "ACL 102: deny traffic from 192.168.57.177"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.72.44.186/24 is up, and ACL 102 denys traffic from 192.168.57.177."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.250.43.39 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.250.43.0.0.0.255 area 0\naccess-list 126 permit ip 192.168.29.60 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.250.43.39/24 (down)", "Routing: OSPF enabled on 10.250.43.0/24 area 0", "ACL 126: permit traffic from 192.168.29.60"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.250.43.39/24 is down, and ACL 126 permits traffic from 192.168.29.60."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.188.191.67 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.188.191.0.0.0.255 area 0\naccess-list 137 deny ip 192.168.45.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.188.191.67/24 (down)", "Routing: OSPF enabled on 10.188.191.0/24 area 0", "ACL 137: deny traffic from 192.168.45.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.188.191.67/24 is down, and ACL 137 denys traffic from 192.168.45.192."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.179.68.172 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.179.68.10.0.0.255 area 0\naccess-list 179 deny ip 192.168.181.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.179.68.172/24 (down)", "Routing: OSPF enabled on 10.179.68.10/24 area 0", "ACL 179: deny traffic from 192.168.181.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.179.68.172/24 is down, and ACL 179 denys traffic from 192.168.181.160."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.91.247.41 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.91.247.0.0.0.255 area 0\naccess-list 194 permit ip 192.168.203.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.91.247.41/24 (up)", "Routing: OSPF enabled on 10.91.247.0/24 area 0", "ACL 194: permit traffic from 192.168.203.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.91.247.41/24 is up, and ACL 194 permits traffic from 192.168.203.134."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.25.67.40 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.25.67.0.0.0.255 area 0\naccess-list 167 permit ip 192.168.17.103 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.25.67.40/24 (up)", "Routing: OSPF enabled on 10.25.67.0/24 area 0", "ACL 167: permit traffic from 192.168.17.103"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.25.67.40/24 is up, and ACL 167 permits traffic from 192.168.17.103."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.221.46.78 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.221.46.0.0.0.255 area 0\naccess-list 102 deny ip 192.168.249.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.221.46.78/24 (down)", "Routing: OSPF enabled on 10.221.46.0/24 area 0", "ACL 102: deny traffic from 192.168.249.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.221.46.78/24 is down, and ACL 102 denys traffic from 192.168.249.107."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.251.155.5 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.251.1550.0.0.255 area 0\naccess-list 127 permit ip 192.168.109.241 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.251.155.5/24 (up)", "Routing: OSPF enabled on 10.251.1550/24 area 0", "ACL 127: permit traffic from 192.168.109.241"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.251.155.5/24 is up, and ACL 127 permits traffic from 192.168.109.241."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.254.204.129 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.254.204.10.0.0.255 area 0\naccess-list 134 deny ip 192.168.191.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.254.204.129/24 (up)", "Routing: OSPF enabled on 10.254.204.10/24 area 0", "ACL 134: deny traffic from 192.168.191.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.254.204.129/24 is up, and ACL 134 denys traffic from 192.168.191.185."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.0.75.225 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.0.75.20.0.0.255 area 0\naccess-list 193 permit ip 192.168.199.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.0.75.225/24 (down)", "Routing: OSPF enabled on 10.0.75.20/24 area 0", "ACL 193: permit traffic from 192.168.199.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.0.75.225/24 is down, and ACL 193 permits traffic from 192.168.199.106."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.213.44.81 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.213.44.0.0.0.255 area 0\naccess-list 185 permit ip 192.168.20.88 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.213.44.81/24 (up)", "Routing: OSPF enabled on 10.213.44.0/24 area 0", "ACL 185: permit traffic from 192.168.20.88"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.213.44.81/24 is up, and ACL 185 permits traffic from 192.168.20.88."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.111.52.220 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.111.52.20.0.0.255 area 0\naccess-list 107 deny ip 192.168.43.187 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.111.52.220/24 (up)", "Routing: OSPF enabled on 10.111.52.20/24 area 0", "ACL 107: deny traffic from 192.168.43.187"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.111.52.220/24 is up, and ACL 107 denys traffic from 192.168.43.187."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.20.1.121 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.20.1.10.0.0.255 area 0\naccess-list 189 deny ip 192.168.0.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.20.1.121/24 (down)", "Routing: OSPF enabled on 10.20.1.10/24 area 0", "ACL 189: deny traffic from 192.168.0.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.20.1.121/24 is down, and ACL 189 denys traffic from 192.168.0.105."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.221.158.107 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.221.158.10.0.0.255 area 0\naccess-list 112 permit ip 192.168.103.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.221.158.107/24 (down)", "Routing: OSPF enabled on 10.221.158.10/24 area 0", "ACL 112: permit traffic from 192.168.103.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.221.158.107/24 is down, and ACL 112 permits traffic from 192.168.103.120."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.220.167.35 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.220.167.0.0.0.255 area 0\naccess-list 102 permit ip 192.168.82.89 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.220.167.35/24 (down)", "Routing: OSPF enabled on 10.220.167.0/24 area 0", "ACL 102: permit traffic from 192.168.82.89"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.220.167.35/24 is down, and ACL 102 permits traffic from 192.168.82.89."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.173.167.178 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.173.167.10.0.0.255 area 0\naccess-list 124 deny ip 192.168.39.111 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.173.167.178/24 (down)", "Routing: OSPF enabled on 10.173.167.10/24 area 0", "ACL 124: deny traffic from 192.168.39.111"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.173.167.178/24 is down, and ACL 124 denys traffic from 192.168.39.111."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.157.148.70 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.157.148.0.0.0.255 area 0\naccess-list 158 deny ip 192.168.86.65 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.157.148.70/24 (up)", "Routing: OSPF enabled on 10.157.148.0/24 area 0", "ACL 158: deny traffic from 192.168.86.65"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.157.148.70/24 is up, and ACL 158 denys traffic from 192.168.86.65."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.244.37.196 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.244.37.10.0.0.255 area 0\naccess-list 164 permit ip 192.168.164.83 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.244.37.196/24 (up)", "Routing: OSPF enabled on 10.244.37.10/24 area 0", "ACL 164: permit traffic from 192.168.164.83"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.244.37.196/24 is up, and ACL 164 permits traffic from 192.168.164.83."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.199.180.113 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.199.180.10.0.0.255 area 0\naccess-list 157 permit ip 192.168.176.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.199.180.113/24 (down)", "Routing: OSPF enabled on 10.199.180.10/24 area 0", "ACL 157: permit traffic from 192.168.176.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.199.180.113/24 is down, and ACL 157 permits traffic from 192.168.176.85."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.43.102.67 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.43.102.0.0.0.255 area 0\naccess-list 105 deny ip 192.168.166.216 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.43.102.67/24 (up)", "Routing: OSPF enabled on 10.43.102.0/24 area 0", "ACL 105: deny traffic from 192.168.166.216"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.43.102.67/24 is up, and ACL 105 denys traffic from 192.168.166.216."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.254.48.238 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.254.48.20.0.0.255 area 0\naccess-list 105 permit ip 192.168.36.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.254.48.238/24 (down)", "Routing: OSPF enabled on 10.254.48.20/24 area 0", "ACL 105: permit traffic from 192.168.36.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.254.48.238/24 is down, and ACL 105 permits traffic from 192.168.36.108."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.211.187.222 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.211.187.20.0.0.255 area 0\naccess-list 101 permit ip 192.168.148.2 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.211.187.222/24 (up)", "Routing: OSPF enabled on 10.211.187.20/24 area 0", "ACL 101: permit traffic from 192.168.148.2"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.211.187.222/24 is up, and ACL 101 permits traffic from 192.168.148.2."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.105.170.227 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.105.170.20.0.0.255 area 0\naccess-list 118 deny ip 192.168.33.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.105.170.227/24 (down)", "Routing: OSPF enabled on 10.105.170.20/24 area 0", "ACL 118: deny traffic from 192.168.33.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.105.170.227/24 is down, and ACL 118 denys traffic from 192.168.33.48."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.140.124.90 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.140.124.0.0.0.255 area 0\naccess-list 134 deny ip 192.168.83.141 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.140.124.90/24 (down)", "Routing: OSPF enabled on 10.140.124.0/24 area 0", "ACL 134: deny traffic from 192.168.83.141"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.140.124.90/24 is down, and ACL 134 denys traffic from 192.168.83.141."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.165.206.159 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.165.206.10.0.0.255 area 0\naccess-list 183 permit ip 192.168.109.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.165.206.159/24 (down)", "Routing: OSPF enabled on 10.165.206.10/24 area 0", "ACL 183: permit traffic from 192.168.109.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.165.206.159/24 is down, and ACL 183 permits traffic from 192.168.109.146."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.172.38.141 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.172.38.10.0.0.255 area 0\naccess-list 183 deny ip 192.168.133.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.172.38.141/24 (down)", "Routing: OSPF enabled on 10.172.38.10/24 area 0", "ACL 183: deny traffic from 192.168.133.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.172.38.141/24 is down, and ACL 183 denys traffic from 192.168.133.48."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.184.241.252 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.184.241.20.0.0.255 area 0\naccess-list 192 permit ip 192.168.207.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.184.241.252/24 (up)", "Routing: OSPF enabled on 10.184.241.20/24 area 0", "ACL 192: permit traffic from 192.168.207.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.184.241.252/24 is up, and ACL 192 permits traffic from 192.168.207.105."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.150.72.138 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.150.72.10.0.0.255 area 0\naccess-list 108 permit ip 192.168.50.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.150.72.138/24 (up)", "Routing: OSPF enabled on 10.150.72.10/24 area 0", "ACL 108: permit traffic from 192.168.50.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.150.72.138/24 is up, and ACL 108 permits traffic from 192.168.50.107."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.84.5.80 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.84.5.0.0.0.255 area 0\naccess-list 141 deny ip 192.168.233.3 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.84.5.80/24 (down)", "Routing: OSPF enabled on 10.84.5.0/24 area 0", "ACL 141: deny traffic from 192.168.233.3"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.84.5.80/24 is down, and ACL 141 denys traffic from 192.168.233.3."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.155.60.183 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.155.60.10.0.0.255 area 0\naccess-list 181 deny ip 192.168.214.73 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.155.60.183/24 (up)", "Routing: OSPF enabled on 10.155.60.10/24 area 0", "ACL 181: deny traffic from 192.168.214.73"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.155.60.183/24 is up, and ACL 181 denys traffic from 192.168.214.73."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.78.246.177 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.78.246.10.0.0.255 area 0\naccess-list 150 permit ip 192.168.150.124 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.78.246.177/24 (down)", "Routing: OSPF enabled on 10.78.246.10/24 area 0", "ACL 150: permit traffic from 192.168.150.124"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.78.246.177/24 is down, and ACL 150 permits traffic from 192.168.150.124."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.102.20.205 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.102.20.20.0.0.255 area 0\naccess-list 193 deny ip 192.168.166.184 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.102.20.205/24 (down)", "Routing: OSPF enabled on 10.102.20.20/24 area 0", "ACL 193: deny traffic from 192.168.166.184"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.102.20.205/24 is down, and ACL 193 denys traffic from 192.168.166.184."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.66.27.3 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.66.270.0.0.255 area 0\naccess-list 114 permit ip 192.168.151.183 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.66.27.3/24 (down)", "Routing: OSPF enabled on 10.66.270/24 area 0", "ACL 114: permit traffic from 192.168.151.183"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.66.27.3/24 is down, and ACL 114 permits traffic from 192.168.151.183."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.228.90.7 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.228.900.0.0.255 area 0\naccess-list 198 permit ip 192.168.70.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.228.90.7/24 (down)", "Routing: OSPF enabled on 10.228.900/24 area 0", "ACL 198: permit traffic from 192.168.70.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.228.90.7/24 is down, and ACL 198 permits traffic from 192.168.70.234."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.99.254.81 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.99.254.0.0.0.255 area 0\naccess-list 170 deny ip 192.168.63.164 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.99.254.81/24 (up)", "Routing: OSPF enabled on 10.99.254.0/24 area 0", "ACL 170: deny traffic from 192.168.63.164"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.99.254.81/24 is up, and ACL 170 denys traffic from 192.168.63.164."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.20.84.194 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.20.84.10.0.0.255 area 0\naccess-list 130 permit ip 192.168.14.179 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.20.84.194/24 (down)", "Routing: OSPF enabled on 10.20.84.10/24 area 0", "ACL 130: permit traffic from 192.168.14.179"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.20.84.194/24 is down, and ACL 130 permits traffic from 192.168.14.179."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.126.69.184 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.126.69.10.0.0.255 area 0\naccess-list 167 permit ip 192.168.185.253 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.126.69.184/24 (up)", "Routing: OSPF enabled on 10.126.69.10/24 area 0", "ACL 167: permit traffic from 192.168.185.253"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.126.69.184/24 is up, and ACL 167 permits traffic from 192.168.185.253."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.133.222.170 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.133.222.10.0.0.255 area 0\naccess-list 175 deny ip 192.168.231.47 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.133.222.170/24 (down)", "Routing: OSPF enabled on 10.133.222.10/24 area 0", "ACL 175: deny traffic from 192.168.231.47"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.133.222.170/24 is down, and ACL 175 denys traffic from 192.168.231.47."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.6.166.170 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.6.166.10.0.0.255 area 0\naccess-list 164 permit ip 192.168.221.68 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.6.166.170/24 (down)", "Routing: OSPF enabled on 10.6.166.10/24 area 0", "ACL 164: permit traffic from 192.168.221.68"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.6.166.170/24 is down, and ACL 164 permits traffic from 192.168.221.68."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.219.193.104 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.219.193.10.0.0.255 area 0\naccess-list 112 deny ip 192.168.212.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.219.193.104/24 (up)", "Routing: OSPF enabled on 10.219.193.10/24 area 0", "ACL 112: deny traffic from 192.168.212.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.219.193.104/24 is up, and ACL 112 denys traffic from 192.168.212.11."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.45.235.164 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.45.235.10.0.0.255 area 0\naccess-list 127 permit ip 192.168.89.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.45.235.164/24 (down)", "Routing: OSPF enabled on 10.45.235.10/24 area 0", "ACL 127: permit traffic from 192.168.89.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.45.235.164/24 is down, and ACL 127 permits traffic from 192.168.89.222."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.213.74.195 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.213.74.10.0.0.255 area 0\naccess-list 193 deny ip 192.168.141.70 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.213.74.195/24 (up)", "Routing: OSPF enabled on 10.213.74.10/24 area 0", "ACL 193: deny traffic from 192.168.141.70"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.213.74.195/24 is up, and ACL 193 denys traffic from 192.168.141.70."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.16.219.240 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.16.219.20.0.0.255 area 0\naccess-list 193 deny ip 192.168.184.151 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.16.219.240/24 (up)", "Routing: OSPF enabled on 10.16.219.20/24 area 0", "ACL 193: deny traffic from 192.168.184.151"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.16.219.240/24 is up, and ACL 193 denys traffic from 192.168.184.151."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.67.36.154 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.67.36.10.0.0.255 area 0\naccess-list 167 deny ip 192.168.88.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.67.36.154/24 (down)", "Routing: OSPF enabled on 10.67.36.10/24 area 0", "ACL 167: deny traffic from 192.168.88.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.67.36.154/24 is down, and ACL 167 denys traffic from 192.168.88.129."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.70.176.165 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.70.176.10.0.0.255 area 0\naccess-list 130 deny ip 192.168.172.161 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.70.176.165/24 (up)", "Routing: OSPF enabled on 10.70.176.10/24 area 0", "ACL 130: deny traffic from 192.168.172.161"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.70.176.165/24 is up, and ACL 130 denys traffic from 192.168.172.161."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.24.124.117 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.24.124.10.0.0.255 area 0\naccess-list 138 permit ip 192.168.181.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.24.124.117/24 (up)", "Routing: OSPF enabled on 10.24.124.10/24 area 0", "ACL 138: permit traffic from 192.168.181.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.24.124.117/24 is up, and ACL 138 permits traffic from 192.168.181.106."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.182.226.231 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.182.226.20.0.0.255 area 0\naccess-list 165 deny ip 192.168.146.180 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.182.226.231/24 (up)", "Routing: OSPF enabled on 10.182.226.20/24 area 0", "ACL 165: deny traffic from 192.168.146.180"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.182.226.231/24 is up, and ACL 165 denys traffic from 192.168.146.180."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.45.226.199 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.45.226.10.0.0.255 area 0\naccess-list 185 deny ip 192.168.85.175 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.45.226.199/24 (down)", "Routing: OSPF enabled on 10.45.226.10/24 area 0", "ACL 185: deny traffic from 192.168.85.175"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.45.226.199/24 is down, and ACL 185 denys traffic from 192.168.85.175."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.194.19.136 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.194.19.10.0.0.255 area 0\naccess-list 115 permit ip 192.168.96.216 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.194.19.136/24 (up)", "Routing: OSPF enabled on 10.194.19.10/24 area 0", "ACL 115: permit traffic from 192.168.96.216"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.194.19.136/24 is up, and ACL 115 permits traffic from 192.168.96.216."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.30.182.52 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.30.182.0.0.0.255 area 0\naccess-list 145 deny ip 192.168.246.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.30.182.52/24 (up)", "Routing: OSPF enabled on 10.30.182.0/24 area 0", "ACL 145: deny traffic from 192.168.246.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.30.182.52/24 is up, and ACL 145 denys traffic from 192.168.246.49."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.157.2.240 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.157.2.20.0.0.255 area 0\naccess-list 151 permit ip 192.168.183.2 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.157.2.240/24 (up)", "Routing: OSPF enabled on 10.157.2.20/24 area 0", "ACL 151: permit traffic from 192.168.183.2"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.157.2.240/24 is up, and ACL 151 permits traffic from 192.168.183.2."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.38.214.126 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.38.214.10.0.0.255 area 0\naccess-list 190 deny ip 192.168.136.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.38.214.126/24 (down)", "Routing: OSPF enabled on 10.38.214.10/24 area 0", "ACL 190: deny traffic from 192.168.136.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.38.214.126/24 is down, and ACL 190 denys traffic from 192.168.136.230."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.73.242.62 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.73.242.0.0.0.255 area 0\naccess-list 118 deny ip 192.168.140.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.73.242.62/24 (down)", "Routing: OSPF enabled on 10.73.242.0/24 area 0", "ACL 118: deny traffic from 192.168.140.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.73.242.62/24 is down, and ACL 118 denys traffic from 192.168.140.126."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.219.197.240 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.219.197.20.0.0.255 area 0\naccess-list 166 permit ip 192.168.137.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.219.197.240/24 (down)", "Routing: OSPF enabled on 10.219.197.20/24 area 0", "ACL 166: permit traffic from 192.168.137.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.219.197.240/24 is down, and ACL 166 permits traffic from 192.168.137.172."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.169.208.217 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.169.208.20.0.0.255 area 0\naccess-list 157 deny ip 192.168.176.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.169.208.217/24 (up)", "Routing: OSPF enabled on 10.169.208.20/24 area 0", "ACL 157: deny traffic from 192.168.176.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.169.208.217/24 is up, and ACL 157 denys traffic from 192.168.176.106."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.227.212.110 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.227.212.10.0.0.255 area 0\naccess-list 195 permit ip 192.168.53.150 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.227.212.110/24 (up)", "Routing: OSPF enabled on 10.227.212.10/24 area 0", "ACL 195: permit traffic from 192.168.53.150"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.227.212.110/24 is up, and ACL 195 permits traffic from 192.168.53.150."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.176.90.26 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.176.90.0.0.0.255 area 0\naccess-list 147 permit ip 192.168.21.215 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.176.90.26/24 (down)", "Routing: OSPF enabled on 10.176.90.0/24 area 0", "ACL 147: permit traffic from 192.168.21.215"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.176.90.26/24 is down, and ACL 147 permits traffic from 192.168.21.215."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.60.190.134 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.60.190.10.0.0.255 area 0\naccess-list 168 deny ip 192.168.98.178 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.60.190.134/24 (down)", "Routing: OSPF enabled on 10.60.190.10/24 area 0", "ACL 168: deny traffic from 192.168.98.178"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.60.190.134/24 is down, and ACL 168 denys traffic from 192.168.98.178."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.161.88.206 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.161.88.20.0.0.255 area 0\naccess-list 197 permit ip 192.168.177.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.161.88.206/24 (up)", "Routing: OSPF enabled on 10.161.88.20/24 area 0", "ACL 197: permit traffic from 192.168.177.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.161.88.206/24 is up, and ACL 197 permits traffic from 192.168.177.204."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.38.128.187 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.38.128.10.0.0.255 area 0\naccess-list 135 permit ip 192.168.203.7 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.38.128.187/24 (up)", "Routing: OSPF enabled on 10.38.128.10/24 area 0", "ACL 135: permit traffic from 192.168.203.7"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.38.128.187/24 is up, and ACL 135 permits traffic from 192.168.203.7."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.7.95.122 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.7.95.10.0.0.255 area 0\naccess-list 122 deny ip 192.168.251.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.7.95.122/24 (up)", "Routing: OSPF enabled on 10.7.95.10/24 area 0", "ACL 122: deny traffic from 192.168.251.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.7.95.122/24 is up, and ACL 122 denys traffic from 192.168.251.121."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.56.190.164 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.56.190.10.0.0.255 area 0\naccess-list 178 permit ip 192.168.155.33 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.56.190.164/24 (down)", "Routing: OSPF enabled on 10.56.190.10/24 area 0", "ACL 178: permit traffic from 192.168.155.33"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.56.190.164/24 is down, and ACL 178 permits traffic from 192.168.155.33."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.62.181.10 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.62.181.0.0.0.255 area 0\naccess-list 177 deny ip 192.168.191.195 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.62.181.10/24 (up)", "Routing: OSPF enabled on 10.62.181.0/24 area 0", "ACL 177: deny traffic from 192.168.191.195"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.62.181.10/24 is up, and ACL 177 denys traffic from 192.168.191.195."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.238.176.121 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.238.176.10.0.0.255 area 0\naccess-list 187 deny ip 192.168.179.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.238.176.121/24 (up)", "Routing: OSPF enabled on 10.238.176.10/24 area 0", "ACL 187: deny traffic from 192.168.179.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.238.176.121/24 is up, and ACL 187 denys traffic from 192.168.179.185."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.245.130.184 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.245.130.10.0.0.255 area 0\naccess-list 147 permit ip 192.168.104.58 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.245.130.184/24 (down)", "Routing: OSPF enabled on 10.245.130.10/24 area 0", "ACL 147: permit traffic from 192.168.104.58"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.245.130.184/24 is down, and ACL 147 permits traffic from 192.168.104.58."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.223.224.219 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.223.224.20.0.0.255 area 0\naccess-list 153 permit ip 192.168.161.32 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.223.224.219/24 (up)", "Routing: OSPF enabled on 10.223.224.20/24 area 0", "ACL 153: permit traffic from 192.168.161.32"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.223.224.219/24 is up, and ACL 153 permits traffic from 192.168.161.32."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.124.52.27 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.124.52.0.0.0.255 area 0\naccess-list 167 deny ip 192.168.222.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.124.52.27/24 (down)", "Routing: OSPF enabled on 10.124.52.0/24 area 0", "ACL 167: deny traffic from 192.168.222.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.124.52.27/24 is down, and ACL 167 denys traffic from 192.168.222.208."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.163.26.171 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.163.26.10.0.0.255 area 0\naccess-list 159 deny ip 192.168.171.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.163.26.171/24 (up)", "Routing: OSPF enabled on 10.163.26.10/24 area 0", "ACL 159: deny traffic from 192.168.171.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.163.26.171/24 is up, and ACL 159 denys traffic from 192.168.171.105."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.82.42.213 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.82.42.20.0.0.255 area 0\naccess-list 175 deny ip 192.168.190.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.82.42.213/24 (up)", "Routing: OSPF enabled on 10.82.42.20/24 area 0", "ACL 175: deny traffic from 192.168.190.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.82.42.213/24 is up, and ACL 175 denys traffic from 192.168.190.56."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.42.50.195 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.42.50.10.0.0.255 area 0\naccess-list 153 permit ip 192.168.85.213 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.42.50.195/24 (up)", "Routing: OSPF enabled on 10.42.50.10/24 area 0", "ACL 153: permit traffic from 192.168.85.213"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.42.50.195/24 is up, and ACL 153 permits traffic from 192.168.85.213."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.5.107.199 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.5.107.10.0.0.255 area 0\naccess-list 127 permit ip 192.168.255.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.5.107.199/24 (down)", "Routing: OSPF enabled on 10.5.107.10/24 area 0", "ACL 127: permit traffic from 192.168.255.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.5.107.199/24 is down, and ACL 127 permits traffic from 192.168.255.116."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.193.180.186 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.193.180.10.0.0.255 area 0\naccess-list 151 permit ip 192.168.184.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.193.180.186/24 (down)", "Routing: OSPF enabled on 10.193.180.10/24 area 0", "ACL 151: permit traffic from 192.168.184.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.193.180.186/24 is down, and ACL 151 permits traffic from 192.168.184.191."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.48.152.107 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.48.152.10.0.0.255 area 0\naccess-list 109 permit ip 192.168.203.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.48.152.107/24 (up)", "Routing: OSPF enabled on 10.48.152.10/24 area 0", "ACL 109: permit traffic from 192.168.203.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.48.152.107/24 is up, and ACL 109 permits traffic from 192.168.203.48."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.254.98.248 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.254.98.20.0.0.255 area 0\naccess-list 183 permit ip 192.168.99.61 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.254.98.248/24 (down)", "Routing: OSPF enabled on 10.254.98.20/24 area 0", "ACL 183: permit traffic from 192.168.99.61"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.254.98.248/24 is down, and ACL 183 permits traffic from 192.168.99.61."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.117.41.8 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.117.410.0.0.255 area 0\naccess-list 151 deny ip 192.168.216.41 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.117.41.8/24 (up)", "Routing: OSPF enabled on 10.117.410/24 area 0", "ACL 151: deny traffic from 192.168.216.41"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.117.41.8/24 is up, and ACL 151 denys traffic from 192.168.216.41."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.103.55.184 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.103.55.10.0.0.255 area 0\naccess-list 165 deny ip 192.168.199.216 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.103.55.184/24 (up)", "Routing: OSPF enabled on 10.103.55.10/24 area 0", "ACL 165: deny traffic from 192.168.199.216"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.103.55.184/24 is up, and ACL 165 denys traffic from 192.168.199.216."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.34.194.229 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.34.194.20.0.0.255 area 0\naccess-list 141 deny ip 192.168.2.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.34.194.229/24 (up)", "Routing: OSPF enabled on 10.34.194.20/24 area 0", "ACL 141: deny traffic from 192.168.2.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.34.194.229/24 is up, and ACL 141 denys traffic from 192.168.2.233."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.105.192.35 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.105.192.0.0.0.255 area 0\naccess-list 174 deny ip 192.168.177.12 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.105.192.35/24 (up)", "Routing: OSPF enabled on 10.105.192.0/24 area 0", "ACL 174: deny traffic from 192.168.177.12"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.105.192.35/24 is up, and ACL 174 denys traffic from 192.168.177.12."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.107.200.22 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.107.200.0.0.0.255 area 0\naccess-list 104 deny ip 192.168.236.249 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.107.200.22/24 (down)", "Routing: OSPF enabled on 10.107.200.0/24 area 0", "ACL 104: deny traffic from 192.168.236.249"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.107.200.22/24 is down, and ACL 104 denys traffic from 192.168.236.249."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.152.140.29 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.152.140.0.0.0.255 area 0\naccess-list 104 deny ip 192.168.50.170 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.152.140.29/24 (up)", "Routing: OSPF enabled on 10.152.140.0/24 area 0", "ACL 104: deny traffic from 192.168.50.170"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.152.140.29/24 is up, and ACL 104 denys traffic from 192.168.50.170."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.247.8.85 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.247.8.0.0.0.255 area 0\naccess-list 176 deny ip 192.168.51.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.247.8.85/24 (down)", "Routing: OSPF enabled on 10.247.8.0/24 area 0", "ACL 176: deny traffic from 192.168.51.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.247.8.85/24 is down, and ACL 176 denys traffic from 192.168.51.238."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.157.84.122 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.157.84.10.0.0.255 area 0\naccess-list 174 deny ip 192.168.153.17 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.157.84.122/24 (down)", "Routing: OSPF enabled on 10.157.84.10/24 area 0", "ACL 174: deny traffic from 192.168.153.17"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.157.84.122/24 is down, and ACL 174 denys traffic from 192.168.153.17."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.37.152.27 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.37.152.0.0.0.255 area 0\naccess-list 157 permit ip 192.168.68.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.37.152.27/24 (up)", "Routing: OSPF enabled on 10.37.152.0/24 area 0", "ACL 157: permit traffic from 192.168.68.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.37.152.27/24 is up, and ACL 157 permits traffic from 192.168.68.234."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.199.38.26 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.199.38.0.0.0.255 area 0\naccess-list 158 permit ip 192.168.250.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.199.38.26/24 (up)", "Routing: OSPF enabled on 10.199.38.0/24 area 0", "ACL 158: permit traffic from 192.168.250.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.199.38.26/24 is up, and ACL 158 permits traffic from 192.168.250.208."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.255.196.22 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.255.196.0.0.0.255 area 0\naccess-list 133 permit ip 192.168.50.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.255.196.22/24 (up)", "Routing: OSPF enabled on 10.255.196.0/24 area 0", "ACL 133: permit traffic from 192.168.50.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.255.196.22/24 is up, and ACL 133 permits traffic from 192.168.50.116."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.28.200.127 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.28.200.10.0.0.255 area 0\naccess-list 125 permit ip 192.168.159.68 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.28.200.127/24 (down)", "Routing: OSPF enabled on 10.28.200.10/24 area 0", "ACL 125: permit traffic from 192.168.159.68"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.28.200.127/24 is down, and ACL 125 permits traffic from 192.168.159.68."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.188.104.179 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.188.104.10.0.0.255 area 0\naccess-list 132 permit ip 192.168.235.164 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.188.104.179/24 (down)", "Routing: OSPF enabled on 10.188.104.10/24 area 0", "ACL 132: permit traffic from 192.168.235.164"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.188.104.179/24 is down, and ACL 132 permits traffic from 192.168.235.164."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.255.81.111 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.255.81.10.0.0.255 area 0\naccess-list 158 permit ip 192.168.146.248 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.255.81.111/24 (up)", "Routing: OSPF enabled on 10.255.81.10/24 area 0", "ACL 158: permit traffic from 192.168.146.248"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.255.81.111/24 is up, and ACL 158 permits traffic from 192.168.146.248."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.32.20.166 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.32.20.10.0.0.255 area 0\naccess-list 191 deny ip 192.168.12.253 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.32.20.166/24 (up)", "Routing: OSPF enabled on 10.32.20.10/24 area 0", "ACL 191: deny traffic from 192.168.12.253"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.32.20.166/24 is up, and ACL 191 denys traffic from 192.168.12.253."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.51.24.95 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.51.24.0.0.0.255 area 0\naccess-list 112 deny ip 192.168.57.227 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.51.24.95/24 (up)", "Routing: OSPF enabled on 10.51.24.0/24 area 0", "ACL 112: deny traffic from 192.168.57.227"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.51.24.95/24 is up, and ACL 112 denys traffic from 192.168.57.227."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.167.42.79 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.167.42.0.0.0.255 area 0\naccess-list 158 deny ip 192.168.57.181 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.167.42.79/24 (up)", "Routing: OSPF enabled on 10.167.42.0/24 area 0", "ACL 158: deny traffic from 192.168.57.181"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.167.42.79/24 is up, and ACL 158 denys traffic from 192.168.57.181."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.222.55.98 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.222.55.0.0.0.255 area 0\naccess-list 175 deny ip 192.168.211.15 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.222.55.98/24 (down)", "Routing: OSPF enabled on 10.222.55.0/24 area 0", "ACL 175: deny traffic from 192.168.211.15"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.222.55.98/24 is down, and ACL 175 denys traffic from 192.168.211.15."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.106.122.62 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.106.122.0.0.0.255 area 0\naccess-list 116 permit ip 192.168.161.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.106.122.62/24 (down)", "Routing: OSPF enabled on 10.106.122.0/24 area 0", "ACL 116: permit traffic from 192.168.161.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.106.122.62/24 is down, and ACL 116 permits traffic from 192.168.161.204."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.140.134.4 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.140.1340.0.0.255 area 0\naccess-list 112 permit ip 192.168.112.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.140.134.4/24 (down)", "Routing: OSPF enabled on 10.140.1340/24 area 0", "ACL 112: permit traffic from 192.168.112.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.140.134.4/24 is down, and ACL 112 permits traffic from 192.168.112.186."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.252.29.179 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.252.29.10.0.0.255 area 0\naccess-list 134 permit ip 192.168.70.46 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.252.29.179/24 (down)", "Routing: OSPF enabled on 10.252.29.10/24 area 0", "ACL 134: permit traffic from 192.168.70.46"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.252.29.179/24 is down, and ACL 134 permits traffic from 192.168.70.46."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.114.94.75 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.114.94.0.0.0.255 area 0\naccess-list 104 deny ip 192.168.92.33 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.114.94.75/24 (down)", "Routing: OSPF enabled on 10.114.94.0/24 area 0", "ACL 104: deny traffic from 192.168.92.33"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.114.94.75/24 is down, and ACL 104 denys traffic from 192.168.92.33."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.104.57.16 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.104.57.0.0.0.255 area 0\naccess-list 150 permit ip 192.168.70.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.104.57.16/24 (down)", "Routing: OSPF enabled on 10.104.57.0/24 area 0", "ACL 150: permit traffic from 192.168.70.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.104.57.16/24 is down, and ACL 150 permits traffic from 192.168.70.114."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.113.205.46 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.113.205.0.0.0.255 area 0\naccess-list 155 deny ip 192.168.244.179 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.113.205.46/24 (up)", "Routing: OSPF enabled on 10.113.205.0/24 area 0", "ACL 155: deny traffic from 192.168.244.179"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.113.205.46/24 is up, and ACL 155 denys traffic from 192.168.244.179."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.17.138.223 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.17.138.20.0.0.255 area 0\naccess-list 190 permit ip 192.168.141.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.17.138.223/24 (up)", "Routing: OSPF enabled on 10.17.138.20/24 area 0", "ACL 190: permit traffic from 192.168.141.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.17.138.223/24 is up, and ACL 190 permits traffic from 192.168.141.109."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.159.233.148 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.159.233.10.0.0.255 area 0\naccess-list 195 deny ip 192.168.41.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.159.233.148/24 (up)", "Routing: OSPF enabled on 10.159.233.10/24 area 0", "ACL 195: deny traffic from 192.168.41.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.159.233.148/24 is up, and ACL 195 denys traffic from 192.168.41.233."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.125.128.53 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.125.128.0.0.0.255 area 0\naccess-list 195 permit ip 192.168.214.171 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.125.128.53/24 (down)", "Routing: OSPF enabled on 10.125.128.0/24 area 0", "ACL 195: permit traffic from 192.168.214.171"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.125.128.53/24 is down, and ACL 195 permits traffic from 192.168.214.171."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.104.251.225 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.104.251.20.0.0.255 area 0\naccess-list 151 permit ip 192.168.36.47 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.104.251.225/24 (down)", "Routing: OSPF enabled on 10.104.251.20/24 area 0", "ACL 151: permit traffic from 192.168.36.47"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.104.251.225/24 is down, and ACL 151 permits traffic from 192.168.36.47."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.44.205.129 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.44.205.10.0.0.255 area 0\naccess-list 128 permit ip 192.168.85.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.44.205.129/24 (down)", "Routing: OSPF enabled on 10.44.205.10/24 area 0", "ACL 128: permit traffic from 192.168.85.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.44.205.129/24 is down, and ACL 128 permits traffic from 192.168.85.94."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.223.118.2 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.223.1180.0.0.255 area 0\naccess-list 173 permit ip 192.168.37.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.223.118.2/24 (down)", "Routing: OSPF enabled on 10.223.1180/24 area 0", "ACL 173: permit traffic from 192.168.37.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.223.118.2/24 is down, and ACL 173 permits traffic from 192.168.37.95."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.198.70.246 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.198.70.20.0.0.255 area 0\naccess-list 175 permit ip 192.168.118.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.198.70.246/24 (down)", "Routing: OSPF enabled on 10.198.70.20/24 area 0", "ACL 175: permit traffic from 192.168.118.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.198.70.246/24 is down, and ACL 175 permits traffic from 192.168.118.20."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.167.167.137 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.167.167.10.0.0.255 area 0\naccess-list 112 deny ip 192.168.115.247 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.167.167.137/24 (up)", "Routing: OSPF enabled on 10.167.167.10/24 area 0", "ACL 112: deny traffic from 192.168.115.247"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.167.167.137/24 is up, and ACL 112 denys traffic from 192.168.115.247."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.158.177.124 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.158.177.10.0.0.255 area 0\naccess-list 115 permit ip 192.168.17.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.158.177.124/24 (up)", "Routing: OSPF enabled on 10.158.177.10/24 area 0", "ACL 115: permit traffic from 192.168.17.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.158.177.124/24 is up, and ACL 115 permits traffic from 192.168.17.157."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.151.143.228 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.151.143.20.0.0.255 area 0\naccess-list 185 deny ip 192.168.179.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.151.143.228/24 (down)", "Routing: OSPF enabled on 10.151.143.20/24 area 0", "ACL 185: deny traffic from 192.168.179.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.151.143.228/24 is down, and ACL 185 denys traffic from 192.168.179.25."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.66.47.229 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.66.47.20.0.0.255 area 0\naccess-list 132 permit ip 192.168.71.223 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.66.47.229/24 (down)", "Routing: OSPF enabled on 10.66.47.20/24 area 0", "ACL 132: permit traffic from 192.168.71.223"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.66.47.229/24 is down, and ACL 132 permits traffic from 192.168.71.223."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.58.90.69 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.58.90.0.0.0.255 area 0\naccess-list 174 deny ip 192.168.20.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.58.90.69/24 (up)", "Routing: OSPF enabled on 10.58.90.0/24 area 0", "ACL 174: deny traffic from 192.168.20.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.58.90.69/24 is up, and ACL 174 denys traffic from 192.168.20.11."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.13.186.22 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.13.186.0.0.0.255 area 0\naccess-list 194 permit ip 192.168.196.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.13.186.22/24 (down)", "Routing: OSPF enabled on 10.13.186.0/24 area 0", "ACL 194: permit traffic from 192.168.196.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.13.186.22/24 is down, and ACL 194 permits traffic from 192.168.196.109."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.191.56.120 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.191.56.10.0.0.255 area 0\naccess-list 183 deny ip 192.168.58.243 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.191.56.120/24 (down)", "Routing: OSPF enabled on 10.191.56.10/24 area 0", "ACL 183: deny traffic from 192.168.58.243"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.191.56.120/24 is down, and ACL 183 denys traffic from 192.168.58.243."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.72.241.112 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.72.241.10.0.0.255 area 0\naccess-list 102 deny ip 192.168.184.100 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.72.241.112/24 (down)", "Routing: OSPF enabled on 10.72.241.10/24 area 0", "ACL 102: deny traffic from 192.168.184.100"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.72.241.112/24 is down, and ACL 102 denys traffic from 192.168.184.100."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.69.209.177 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.69.209.10.0.0.255 area 0\naccess-list 133 deny ip 192.168.14.248 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.69.209.177/24 (up)", "Routing: OSPF enabled on 10.69.209.10/24 area 0", "ACL 133: deny traffic from 192.168.14.248"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.69.209.177/24 is up, and ACL 133 denys traffic from 192.168.14.248."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.120.49.232 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.120.49.20.0.0.255 area 0\naccess-list 159 deny ip 192.168.190.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.120.49.232/24 (up)", "Routing: OSPF enabled on 10.120.49.20/24 area 0", "ACL 159: deny traffic from 192.168.190.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.120.49.232/24 is up, and ACL 159 denys traffic from 192.168.190.117."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.198.11.52 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.198.11.0.0.0.255 area 0\naccess-list 168 permit ip 192.168.188.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.198.11.52/24 (up)", "Routing: OSPF enabled on 10.198.11.0/24 area 0", "ACL 168: permit traffic from 192.168.188.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.198.11.52/24 is up, and ACL 168 permits traffic from 192.168.188.208."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.82.176.122 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.82.176.10.0.0.255 area 0\naccess-list 188 deny ip 192.168.92.17 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.82.176.122/24 (down)", "Routing: OSPF enabled on 10.82.176.10/24 area 0", "ACL 188: deny traffic from 192.168.92.17"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.82.176.122/24 is down, and ACL 188 denys traffic from 192.168.92.17."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.12.140.132 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.12.140.10.0.0.255 area 0\naccess-list 190 deny ip 192.168.43.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.12.140.132/24 (down)", "Routing: OSPF enabled on 10.12.140.10/24 area 0", "ACL 190: deny traffic from 192.168.43.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.12.140.132/24 is down, and ACL 190 denys traffic from 192.168.43.157."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.186.31.231 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.186.31.20.0.0.255 area 0\naccess-list 104 permit ip 192.168.250.14 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.186.31.231/24 (up)", "Routing: OSPF enabled on 10.186.31.20/24 area 0", "ACL 104: permit traffic from 192.168.250.14"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.186.31.231/24 is up, and ACL 104 permits traffic from 192.168.250.14."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.9.144.104 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.9.144.10.0.0.255 area 0\naccess-list 147 permit ip 192.168.255.18 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.9.144.104/24 (down)", "Routing: OSPF enabled on 10.9.144.10/24 area 0", "ACL 147: permit traffic from 192.168.255.18"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.9.144.104/24 is down, and ACL 147 permits traffic from 192.168.255.18."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.235.253.173 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.235.253.10.0.0.255 area 0\naccess-list 111 deny ip 192.168.104.188 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.235.253.173/24 (down)", "Routing: OSPF enabled on 10.235.253.10/24 area 0", "ACL 111: deny traffic from 192.168.104.188"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.235.253.173/24 is down, and ACL 111 denys traffic from 192.168.104.188."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.7.149.115 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.7.149.10.0.0.255 area 0\naccess-list 122 permit ip 192.168.201.12 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.7.149.115/24 (up)", "Routing: OSPF enabled on 10.7.149.10/24 area 0", "ACL 122: permit traffic from 192.168.201.12"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.7.149.115/24 is up, and ACL 122 permits traffic from 192.168.201.12."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.9.254.50 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.9.254.0.0.0.255 area 0\naccess-list 170 deny ip 192.168.123.97 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.9.254.50/24 (down)", "Routing: OSPF enabled on 10.9.254.0/24 area 0", "ACL 170: deny traffic from 192.168.123.97"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.9.254.50/24 is down, and ACL 170 denys traffic from 192.168.123.97."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.237.70.109 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.237.70.10.0.0.255 area 0\naccess-list 138 permit ip 192.168.70.135 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.237.70.109/24 (up)", "Routing: OSPF enabled on 10.237.70.10/24 area 0", "ACL 138: permit traffic from 192.168.70.135"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.237.70.109/24 is up, and ACL 138 permits traffic from 192.168.70.135."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.168.16.162 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.168.16.10.0.0.255 area 0\naccess-list 160 deny ip 192.168.37.115 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.168.16.162/24 (up)", "Routing: OSPF enabled on 10.168.16.10/24 area 0", "ACL 160: deny traffic from 192.168.37.115"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.168.16.162/24 is up, and ACL 160 denys traffic from 192.168.37.115."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.228.52.25 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.228.52.0.0.0.255 area 0\naccess-list 192 deny ip 192.168.135.139 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.228.52.25/24 (up)", "Routing: OSPF enabled on 10.228.52.0/24 area 0", "ACL 192: deny traffic from 192.168.135.139"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.228.52.25/24 is up, and ACL 192 denys traffic from 192.168.135.139."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.202.251.139 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.202.251.10.0.0.255 area 0\naccess-list 150 deny ip 192.168.124.0 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.202.251.139/24 (up)", "Routing: OSPF enabled on 10.202.251.10/24 area 0", "ACL 150: deny traffic from 192.168.124.0"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.202.251.139/24 is up, and ACL 150 denys traffic from 192.168.124.0."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.2.222.202 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.2.222.20.0.0.255 area 0\naccess-list 160 permit ip 192.168.162.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.2.222.202/24 (down)", "Routing: OSPF enabled on 10.2.222.20/24 area 0", "ACL 160: permit traffic from 192.168.162.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.2.222.202/24 is down, and ACL 160 permits traffic from 192.168.162.113."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.254.83.26 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.254.83.0.0.0.255 area 0\naccess-list 186 deny ip 192.168.117.215 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.254.83.26/24 (up)", "Routing: OSPF enabled on 10.254.83.0/24 area 0", "ACL 186: deny traffic from 192.168.117.215"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.254.83.26/24 is up, and ACL 186 denys traffic from 192.168.117.215."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.231.236.8 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.231.2360.0.0.255 area 0\naccess-list 119 permit ip 192.168.22.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.231.236.8/24 (up)", "Routing: OSPF enabled on 10.231.2360/24 area 0", "ACL 119: permit traffic from 192.168.22.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.231.236.8/24 is up, and ACL 119 permits traffic from 192.168.22.192."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.127.159.149 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.127.159.10.0.0.255 area 0\naccess-list 116 permit ip 192.168.48.203 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.127.159.149/24 (down)", "Routing: OSPF enabled on 10.127.159.10/24 area 0", "ACL 116: permit traffic from 192.168.48.203"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.127.159.149/24 is down, and ACL 116 permits traffic from 192.168.48.203."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.17.162.14 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.17.162.0.0.0.255 area 0\naccess-list 130 permit ip 192.168.112.86 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.17.162.14/24 (up)", "Routing: OSPF enabled on 10.17.162.0/24 area 0", "ACL 130: permit traffic from 192.168.112.86"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.17.162.14/24 is up, and ACL 130 permits traffic from 192.168.112.86."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.2.129.195 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.2.129.10.0.0.255 area 0\naccess-list 149 deny ip 192.168.31.239 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.2.129.195/24 (up)", "Routing: OSPF enabled on 10.2.129.10/24 area 0", "ACL 149: deny traffic from 192.168.31.239"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.2.129.195/24 is up, and ACL 149 denys traffic from 192.168.31.239."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.26.55.79 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.26.55.0.0.0.255 area 0\naccess-list 124 deny ip 192.168.32.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.26.55.79/24 (down)", "Routing: OSPF enabled on 10.26.55.0/24 area 0", "ACL 124: deny traffic from 192.168.32.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.26.55.79/24 is down, and ACL 124 denys traffic from 192.168.32.59."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.167.159.226 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.167.159.20.0.0.255 area 0\naccess-list 173 permit ip 192.168.128.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.167.159.226/24 (down)", "Routing: OSPF enabled on 10.167.159.20/24 area 0", "ACL 173: permit traffic from 192.168.128.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.167.159.226/24 is down, and ACL 173 permits traffic from 192.168.128.196."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.172.69.89 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.172.69.0.0.0.255 area 0\naccess-list 112 permit ip 192.168.119.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.172.69.89/24 (up)", "Routing: OSPF enabled on 10.172.69.0/24 area 0", "ACL 112: permit traffic from 192.168.119.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.172.69.89/24 is up, and ACL 112 permits traffic from 192.168.119.193."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.41.178.164 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.41.178.10.0.0.255 area 0\naccess-list 190 permit ip 192.168.110.205 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.41.178.164/24 (down)", "Routing: OSPF enabled on 10.41.178.10/24 area 0", "ACL 190: permit traffic from 192.168.110.205"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.41.178.164/24 is down, and ACL 190 permits traffic from 192.168.110.205."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.22.80.42 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.22.80.0.0.0.255 area 0\naccess-list 189 deny ip 192.168.156.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.22.80.42/24 (down)", "Routing: OSPF enabled on 10.22.80.0/24 area 0", "ACL 189: deny traffic from 192.168.156.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.22.80.42/24 is down, and ACL 189 denys traffic from 192.168.156.129."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.129.57.45 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.129.57.0.0.0.255 area 0\naccess-list 156 deny ip 192.168.224.124 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.129.57.45/24 (up)", "Routing: OSPF enabled on 10.129.57.0/24 area 0", "ACL 156: deny traffic from 192.168.224.124"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.129.57.45/24 is up, and ACL 156 denys traffic from 192.168.224.124."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.6.52.178 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.6.52.10.0.0.255 area 0\naccess-list 184 permit ip 192.168.131.223 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.6.52.178/24 (up)", "Routing: OSPF enabled on 10.6.52.10/24 area 0", "ACL 184: permit traffic from 192.168.131.223"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.6.52.178/24 is up, and ACL 184 permits traffic from 192.168.131.223."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.138.162.187 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.138.162.10.0.0.255 area 0\naccess-list 102 deny ip 192.168.226.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.138.162.187/24 (down)", "Routing: OSPF enabled on 10.138.162.10/24 area 0", "ACL 102: deny traffic from 192.168.226.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.138.162.187/24 is down, and ACL 102 denys traffic from 192.168.226.221."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.212.69.33 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.212.69.0.0.0.255 area 0\naccess-list 156 deny ip 192.168.0.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.212.69.33/24 (up)", "Routing: OSPF enabled on 10.212.69.0/24 area 0", "ACL 156: deny traffic from 192.168.0.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.212.69.33/24 is up, and ACL 156 denys traffic from 192.168.0.107."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.181.29.42 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.181.29.0.0.0.255 area 0\naccess-list 173 permit ip 192.168.79.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.181.29.42/24 (up)", "Routing: OSPF enabled on 10.181.29.0/24 area 0", "ACL 173: permit traffic from 192.168.79.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.181.29.42/24 is up, and ACL 173 permits traffic from 192.168.79.113."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.53.191.61 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.53.191.0.0.0.255 area 0\naccess-list 144 deny ip 192.168.41.4 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.53.191.61/24 (up)", "Routing: OSPF enabled on 10.53.191.0/24 area 0", "ACL 144: deny traffic from 192.168.41.4"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.53.191.61/24 is up, and ACL 144 denys traffic from 192.168.41.4."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.44.95.36 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.44.95.0.0.0.255 area 0\naccess-list 172 deny ip 192.168.18.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.44.95.36/24 (down)", "Routing: OSPF enabled on 10.44.95.0/24 area 0", "ACL 172: deny traffic from 192.168.18.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.44.95.36/24 is down, and ACL 172 denys traffic from 192.168.18.234."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.65.231.8 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.65.2310.0.0.255 area 0\naccess-list 185 deny ip 192.168.150.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.65.231.8/24 (down)", "Routing: OSPF enabled on 10.65.2310/24 area 0", "ACL 185: deny traffic from 192.168.150.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.65.231.8/24 is down, and ACL 185 denys traffic from 192.168.150.13."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.40.68.78 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.40.68.0.0.0.255 area 0\naccess-list 127 deny ip 192.168.148.36 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.40.68.78/24 (up)", "Routing: OSPF enabled on 10.40.68.0/24 area 0", "ACL 127: deny traffic from 192.168.148.36"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.40.68.78/24 is up, and ACL 127 denys traffic from 192.168.148.36."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.157.235.93 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.157.235.0.0.0.255 area 0\naccess-list 105 permit ip 192.168.5.207 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.157.235.93/24 (up)", "Routing: OSPF enabled on 10.157.235.0/24 area 0", "ACL 105: permit traffic from 192.168.5.207"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.157.235.93/24 is up, and ACL 105 permits traffic from 192.168.5.207."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.117.223.178 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.117.223.10.0.0.255 area 0\naccess-list 165 deny ip 192.168.57.100 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.117.223.178/24 (up)", "Routing: OSPF enabled on 10.117.223.10/24 area 0", "ACL 165: deny traffic from 192.168.57.100"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.117.223.178/24 is up, and ACL 165 denys traffic from 192.168.57.100."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.182.91.246 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.182.91.20.0.0.255 area 0\naccess-list 123 permit ip 192.168.194.197 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.182.91.246/24 (down)", "Routing: OSPF enabled on 10.182.91.20/24 area 0", "ACL 123: permit traffic from 192.168.194.197"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.182.91.246/24 is down, and ACL 123 permits traffic from 192.168.194.197."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.179.73.95 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.179.73.0.0.0.255 area 0\naccess-list 128 permit ip 192.168.161.147 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.179.73.95/24 (up)", "Routing: OSPF enabled on 10.179.73.0/24 area 0", "ACL 128: permit traffic from 192.168.161.147"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.179.73.95/24 is up, and ACL 128 permits traffic from 192.168.161.147."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.231.197.172 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.231.197.10.0.0.255 area 0\naccess-list 182 permit ip 192.168.75.228 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.231.197.172/24 (up)", "Routing: OSPF enabled on 10.231.197.10/24 area 0", "ACL 182: permit traffic from 192.168.75.228"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.231.197.172/24 is up, and ACL 182 permits traffic from 192.168.75.228."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.222.133.30 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.222.133.0.0.0.255 area 0\naccess-list 120 deny ip 192.168.81.16 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.222.133.30/24 (up)", "Routing: OSPF enabled on 10.222.133.0/24 area 0", "ACL 120: deny traffic from 192.168.81.16"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.222.133.30/24 is up, and ACL 120 denys traffic from 192.168.81.16."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.211.169.14 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.211.169.0.0.0.255 area 0\naccess-list 160 deny ip 192.168.144.218 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.211.169.14/24 (down)", "Routing: OSPF enabled on 10.211.169.0/24 area 0", "ACL 160: deny traffic from 192.168.144.218"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.211.169.14/24 is down, and ACL 160 denys traffic from 192.168.144.218."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.222.56.214 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.222.56.20.0.0.255 area 0\naccess-list 116 deny ip 192.168.164.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.222.56.214/24 (down)", "Routing: OSPF enabled on 10.222.56.20/24 area 0", "ACL 116: deny traffic from 192.168.164.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.222.56.214/24 is down, and ACL 116 denys traffic from 192.168.164.185."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.174.34.154 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.174.34.10.0.0.255 area 0\naccess-list 139 permit ip 192.168.186.29 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.174.34.154/24 (up)", "Routing: OSPF enabled on 10.174.34.10/24 area 0", "ACL 139: permit traffic from 192.168.186.29"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.174.34.154/24 is up, and ACL 139 permits traffic from 192.168.186.29."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.209.210.25 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.209.210.0.0.0.255 area 0\naccess-list 160 deny ip 192.168.151.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.209.210.25/24 (up)", "Routing: OSPF enabled on 10.209.210.0/24 area 0", "ACL 160: deny traffic from 192.168.151.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.209.210.25/24 is up, and ACL 160 denys traffic from 192.168.151.94."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.99.196.95 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.99.196.0.0.0.255 area 0\naccess-list 136 permit ip 192.168.102.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.99.196.95/24 (up)", "Routing: OSPF enabled on 10.99.196.0/24 area 0", "ACL 136: permit traffic from 192.168.102.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.99.196.95/24 is up, and ACL 136 permits traffic from 192.168.102.94."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.8.204.86 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.8.204.0.0.0.255 area 0\naccess-list 129 deny ip 192.168.128.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.8.204.86/24 (up)", "Routing: OSPF enabled on 10.8.204.0/24 area 0", "ACL 129: deny traffic from 192.168.128.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.8.204.86/24 is up, and ACL 129 denys traffic from 192.168.128.204."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.237.63.129 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.237.63.10.0.0.255 area 0\naccess-list 171 permit ip 192.168.74.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.237.63.129/24 (up)", "Routing: OSPF enabled on 10.237.63.10/24 area 0", "ACL 171: permit traffic from 192.168.74.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.237.63.129/24 is up, and ACL 171 permits traffic from 192.168.74.117."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.180.184.13 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.180.184.0.0.0.255 area 0\naccess-list 126 permit ip 192.168.19.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.180.184.13/24 (down)", "Routing: OSPF enabled on 10.180.184.0/24 area 0", "ACL 126: permit traffic from 192.168.19.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.180.184.13/24 is down, and ACL 126 permits traffic from 192.168.19.152."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.39.101.194 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.39.101.10.0.0.255 area 0\naccess-list 182 deny ip 192.168.137.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.39.101.194/24 (up)", "Routing: OSPF enabled on 10.39.101.10/24 area 0", "ACL 182: deny traffic from 192.168.137.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.39.101.194/24 is up, and ACL 182 denys traffic from 192.168.137.78."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.135.132.215 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.135.132.20.0.0.255 area 0\naccess-list 135 permit ip 192.168.15.2 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.135.132.215/24 (up)", "Routing: OSPF enabled on 10.135.132.20/24 area 0", "ACL 135: permit traffic from 192.168.15.2"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.135.132.215/24 is up, and ACL 135 permits traffic from 192.168.15.2."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.21.61.236 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.21.61.20.0.0.255 area 0\naccess-list 123 permit ip 192.168.119.236 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.21.61.236/24 (up)", "Routing: OSPF enabled on 10.21.61.20/24 area 0", "ACL 123: permit traffic from 192.168.119.236"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.21.61.236/24 is up, and ACL 123 permits traffic from 192.168.119.236."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.175.175.39 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.175.175.0.0.0.255 area 0\naccess-list 168 permit ip 192.168.33.212 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.175.175.39/24 (down)", "Routing: OSPF enabled on 10.175.175.0/24 area 0", "ACL 168: permit traffic from 192.168.33.212"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.175.175.39/24 is down, and ACL 168 permits traffic from 192.168.33.212."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.211.24.28 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.211.24.0.0.0.255 area 0\naccess-list 146 deny ip 192.168.193.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.211.24.28/24 (up)", "Routing: OSPF enabled on 10.211.24.0/24 area 0", "ACL 146: deny traffic from 192.168.193.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.211.24.28/24 is up, and ACL 146 denys traffic from 192.168.193.56."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.219.70.198 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.219.70.10.0.0.255 area 0\naccess-list 105 deny ip 192.168.217.127 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.219.70.198/24 (up)", "Routing: OSPF enabled on 10.219.70.10/24 area 0", "ACL 105: deny traffic from 192.168.217.127"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.219.70.198/24 is up, and ACL 105 denys traffic from 192.168.217.127."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.26.178.193 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.26.178.10.0.0.255 area 0\naccess-list 198 permit ip 192.168.78.183 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.26.178.193/24 (down)", "Routing: OSPF enabled on 10.26.178.10/24 area 0", "ACL 198: permit traffic from 192.168.78.183"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.26.178.193/24 is down, and ACL 198 permits traffic from 192.168.78.183."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.14.72.65 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.14.72.0.0.0.255 area 0\naccess-list 161 permit ip 192.168.101.139 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.14.72.65/24 (up)", "Routing: OSPF enabled on 10.14.72.0/24 area 0", "ACL 161: permit traffic from 192.168.101.139"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.14.72.65/24 is up, and ACL 161 permits traffic from 192.168.101.139."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.229.231.38 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.229.231.0.0.0.255 area 0\naccess-list 187 deny ip 192.168.41.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.229.231.38/24 (up)", "Routing: OSPF enabled on 10.229.231.0/24 area 0", "ACL 187: deny traffic from 192.168.41.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.229.231.38/24 is up, and ACL 187 denys traffic from 192.168.41.109."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.65.206.187 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.65.206.10.0.0.255 area 0\naccess-list 161 deny ip 192.168.67.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.65.206.187/24 (up)", "Routing: OSPF enabled on 10.65.206.10/24 area 0", "ACL 161: deny traffic from 192.168.67.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.65.206.187/24 is up, and ACL 161 denys traffic from 192.168.67.152."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.114.101.243 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.114.101.20.0.0.255 area 0\naccess-list 109 deny ip 192.168.133.200 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.114.101.243/24 (down)", "Routing: OSPF enabled on 10.114.101.20/24 area 0", "ACL 109: deny traffic from 192.168.133.200"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.114.101.243/24 is down, and ACL 109 denys traffic from 192.168.133.200."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.16.99.188 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.16.99.10.0.0.255 area 0\naccess-list 169 permit ip 192.168.146.137 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.16.99.188/24 (down)", "Routing: OSPF enabled on 10.16.99.10/24 area 0", "ACL 169: permit traffic from 192.168.146.137"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.16.99.188/24 is down, and ACL 169 permits traffic from 192.168.146.137."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.213.223.6 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.213.2230.0.0.255 area 0\naccess-list 138 permit ip 192.168.148.168 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.213.223.6/24 (down)", "Routing: OSPF enabled on 10.213.2230/24 area 0", "ACL 138: permit traffic from 192.168.148.168"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.213.223.6/24 is down, and ACL 138 permits traffic from 192.168.148.168."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.107.22.148 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.107.22.10.0.0.255 area 0\naccess-list 128 deny ip 192.168.72.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.107.22.148/24 (down)", "Routing: OSPF enabled on 10.107.22.10/24 area 0", "ACL 128: deny traffic from 192.168.72.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.107.22.148/24 is down, and ACL 128 denys traffic from 192.168.72.154."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.126.84.141 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.126.84.10.0.0.255 area 0\naccess-list 186 permit ip 192.168.182.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.126.84.141/24 (down)", "Routing: OSPF enabled on 10.126.84.10/24 area 0", "ACL 186: permit traffic from 192.168.182.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.126.84.141/24 is down, and ACL 186 permits traffic from 192.168.182.106."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.148.9.54 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.148.9.0.0.0.255 area 0\naccess-list 147 deny ip 192.168.49.144 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.148.9.54/24 (down)", "Routing: OSPF enabled on 10.148.9.0/24 area 0", "ACL 147: deny traffic from 192.168.49.144"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.148.9.54/24 is down, and ACL 147 denys traffic from 192.168.49.144."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.91.21.138 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.91.21.10.0.0.255 area 0\naccess-list 103 deny ip 192.168.178.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.91.21.138/24 (up)", "Routing: OSPF enabled on 10.91.21.10/24 area 0", "ACL 103: deny traffic from 192.168.178.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.91.21.138/24 is up, and ACL 103 denys traffic from 192.168.178.13."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.101.35.10 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.101.35.0.0.0.255 area 0\naccess-list 141 permit ip 192.168.239.219 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.101.35.10/24 (up)", "Routing: OSPF enabled on 10.101.35.0/24 area 0", "ACL 141: permit traffic from 192.168.239.219"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.101.35.10/24 is up, and ACL 141 permits traffic from 192.168.239.219."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.56.219.65 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.56.219.0.0.0.255 area 0\naccess-list 159 deny ip 192.168.113.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.56.219.65/24 (up)", "Routing: OSPF enabled on 10.56.219.0/24 area 0", "ACL 159: deny traffic from 192.168.113.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.56.219.65/24 is up, and ACL 159 denys traffic from 192.168.113.206."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.162.74.198 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.162.74.10.0.0.255 area 0\naccess-list 189 deny ip 192.168.20.29 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.162.74.198/24 (down)", "Routing: OSPF enabled on 10.162.74.10/24 area 0", "ACL 189: deny traffic from 192.168.20.29"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.162.74.198/24 is down, and ACL 189 denys traffic from 192.168.20.29."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.109.22.240 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.109.22.20.0.0.255 area 0\naccess-list 144 permit ip 192.168.255.15 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.109.22.240/24 (up)", "Routing: OSPF enabled on 10.109.22.20/24 area 0", "ACL 144: permit traffic from 192.168.255.15"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.109.22.240/24 is up, and ACL 144 permits traffic from 192.168.255.15."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.121.54.172 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.121.54.10.0.0.255 area 0\naccess-list 108 permit ip 192.168.33.125 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.121.54.172/24 (up)", "Routing: OSPF enabled on 10.121.54.10/24 area 0", "ACL 108: permit traffic from 192.168.33.125"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.121.54.172/24 is up, and ACL 108 permits traffic from 192.168.33.125."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.166.29.121 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.166.29.10.0.0.255 area 0\naccess-list 135 deny ip 192.168.245.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.166.29.121/24 (down)", "Routing: OSPF enabled on 10.166.29.10/24 area 0", "ACL 135: deny traffic from 192.168.245.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.166.29.121/24 is down, and ACL 135 denys traffic from 192.168.245.37."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.102.166.23 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.102.166.0.0.0.255 area 0\naccess-list 100 permit ip 192.168.134.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.102.166.23/24 (down)", "Routing: OSPF enabled on 10.102.166.0/24 area 0", "ACL 100: permit traffic from 192.168.134.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.102.166.23/24 is down, and ACL 100 permits traffic from 192.168.134.48."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.22.167.79 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.22.167.0.0.0.255 area 0\naccess-list 187 permit ip 192.168.181.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.22.167.79/24 (down)", "Routing: OSPF enabled on 10.22.167.0/24 area 0", "ACL 187: permit traffic from 192.168.181.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.22.167.79/24 is down, and ACL 187 permits traffic from 192.168.181.105."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.255.172.167 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.255.172.10.0.0.255 area 0\naccess-list 170 deny ip 192.168.200.219 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.255.172.167/24 (down)", "Routing: OSPF enabled on 10.255.172.10/24 area 0", "ACL 170: deny traffic from 192.168.200.219"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.255.172.167/24 is down, and ACL 170 denys traffic from 192.168.200.219."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.131.191.105 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.131.191.10.0.0.255 area 0\naccess-list 119 deny ip 192.168.77.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.131.191.105/24 (down)", "Routing: OSPF enabled on 10.131.191.10/24 area 0", "ACL 119: deny traffic from 192.168.77.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.131.191.105/24 is down, and ACL 119 denys traffic from 192.168.77.208."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.131.12.134 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.131.12.10.0.0.255 area 0\naccess-list 141 deny ip 192.168.199.23 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.131.12.134/24 (down)", "Routing: OSPF enabled on 10.131.12.10/24 area 0", "ACL 141: deny traffic from 192.168.199.23"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.131.12.134/24 is down, and ACL 141 denys traffic from 192.168.199.23."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.253.151.162 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.253.151.10.0.0.255 area 0\naccess-list 111 permit ip 192.168.202.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.253.151.162/24 (up)", "Routing: OSPF enabled on 10.253.151.10/24 area 0", "ACL 111: permit traffic from 192.168.202.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.253.151.162/24 is up, and ACL 111 permits traffic from 192.168.202.233."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.194.135.20 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.194.135.0.0.0.255 area 0\naccess-list 140 permit ip 192.168.54.249 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.194.135.20/24 (down)", "Routing: OSPF enabled on 10.194.135.0/24 area 0", "ACL 140: permit traffic from 192.168.54.249"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.194.135.20/24 is down, and ACL 140 permits traffic from 192.168.54.249."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.40.121.79 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.40.121.0.0.0.255 area 0\naccess-list 139 deny ip 192.168.134.0 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.40.121.79/24 (down)", "Routing: OSPF enabled on 10.40.121.0/24 area 0", "ACL 139: deny traffic from 192.168.134.0"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.40.121.79/24 is down, and ACL 139 denys traffic from 192.168.134.0."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.142.200.178 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.142.200.10.0.0.255 area 0\naccess-list 147 permit ip 192.168.1.203 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.142.200.178/24 (up)", "Routing: OSPF enabled on 10.142.200.10/24 area 0", "ACL 147: permit traffic from 192.168.1.203"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.142.200.178/24 is up, and ACL 147 permits traffic from 192.168.1.203."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.127.59.230 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.127.59.20.0.0.255 area 0\naccess-list 159 deny ip 192.168.240.229 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.127.59.230/24 (up)", "Routing: OSPF enabled on 10.127.59.20/24 area 0", "ACL 159: deny traffic from 192.168.240.229"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.127.59.230/24 is up, and ACL 159 denys traffic from 192.168.240.229."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.113.248.5 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.113.2480.0.0.255 area 0\naccess-list 170 permit ip 192.168.112.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.113.248.5/24 (up)", "Routing: OSPF enabled on 10.113.2480/24 area 0", "ACL 170: permit traffic from 192.168.112.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.113.248.5/24 is up, and ACL 170 permits traffic from 192.168.112.114."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.241.114.193 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.241.114.10.0.0.255 area 0\naccess-list 129 deny ip 192.168.47.84 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.241.114.193/24 (down)", "Routing: OSPF enabled on 10.241.114.10/24 area 0", "ACL 129: deny traffic from 192.168.47.84"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.241.114.193/24 is down, and ACL 129 denys traffic from 192.168.47.84."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.88.54.65 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.88.54.0.0.0.255 area 0\naccess-list 136 permit ip 192.168.14.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.88.54.65/24 (down)", "Routing: OSPF enabled on 10.88.54.0/24 area 0", "ACL 136: permit traffic from 192.168.14.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.88.54.65/24 is down, and ACL 136 permits traffic from 192.168.14.121."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.123.44.224 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.123.44.20.0.0.255 area 0\naccess-list 191 deny ip 192.168.23.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.123.44.224/24 (down)", "Routing: OSPF enabled on 10.123.44.20/24 area 0", "ACL 191: deny traffic from 192.168.23.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.123.44.224/24 is down, and ACL 191 denys traffic from 192.168.23.157."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.185.238.97 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.185.238.0.0.0.255 area 0\naccess-list 143 deny ip 192.168.74.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.185.238.97/24 (down)", "Routing: OSPF enabled on 10.185.238.0/24 area 0", "ACL 143: deny traffic from 192.168.74.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.185.238.97/24 is down, and ACL 143 denys traffic from 192.168.74.109."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.106.152.230 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.106.152.20.0.0.255 area 0\naccess-list 114 permit ip 192.168.119.99 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.106.152.230/24 (up)", "Routing: OSPF enabled on 10.106.152.20/24 area 0", "ACL 114: permit traffic from 192.168.119.99"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.106.152.230/24 is up, and ACL 114 permits traffic from 192.168.119.99."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.4.163.29 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.4.163.0.0.0.255 area 0\naccess-list 159 deny ip 192.168.179.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.4.163.29/24 (up)", "Routing: OSPF enabled on 10.4.163.0/24 area 0", "ACL 159: deny traffic from 192.168.179.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.4.163.29/24 is up, and ACL 159 denys traffic from 192.168.179.11."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.102.218.54 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.102.218.0.0.0.255 area 0\naccess-list 128 permit ip 192.168.139.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.102.218.54/24 (up)", "Routing: OSPF enabled on 10.102.218.0/24 area 0", "ACL 128: permit traffic from 192.168.139.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.102.218.54/24 is up, and ACL 128 permits traffic from 192.168.139.85."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.134.220.24 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.134.220.0.0.0.255 area 0\naccess-list 174 deny ip 192.168.52.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.134.220.24/24 (down)", "Routing: OSPF enabled on 10.134.220.0/24 area 0", "ACL 174: deny traffic from 192.168.52.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.134.220.24/24 is down, and ACL 174 denys traffic from 192.168.52.75."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.56.29.8 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.56.290.0.0.255 area 0\naccess-list 103 permit ip 192.168.21.7 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.56.29.8/24 (up)", "Routing: OSPF enabled on 10.56.290/24 area 0", "ACL 103: permit traffic from 192.168.21.7"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.56.29.8/24 is up, and ACL 103 permits traffic from 192.168.21.7."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.212.86.75 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.212.86.0.0.0.255 area 0\naccess-list 195 permit ip 192.168.174.231 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.212.86.75/24 (up)", "Routing: OSPF enabled on 10.212.86.0/24 area 0", "ACL 195: permit traffic from 192.168.174.231"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.212.86.75/24 is up, and ACL 195 permits traffic from 192.168.174.231."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.241.166.58 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.241.166.0.0.0.255 area 0\naccess-list 157 deny ip 192.168.253.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.241.166.58/24 (down)", "Routing: OSPF enabled on 10.241.166.0/24 area 0", "ACL 157: deny traffic from 192.168.253.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.241.166.58/24 is down, and ACL 157 denys traffic from 192.168.253.251."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.98.212.187 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.98.212.10.0.0.255 area 0\naccess-list 168 permit ip 192.168.163.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.98.212.187/24 (up)", "Routing: OSPF enabled on 10.98.212.10/24 area 0", "ACL 168: permit traffic from 192.168.163.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.98.212.187/24 is up, and ACL 168 permits traffic from 192.168.163.107."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.153.78.143 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.153.78.10.0.0.255 area 0\naccess-list 184 permit ip 192.168.6.176 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.153.78.143/24 (down)", "Routing: OSPF enabled on 10.153.78.10/24 area 0", "ACL 184: permit traffic from 192.168.6.176"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.153.78.143/24 is down, and ACL 184 permits traffic from 192.168.6.176."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.126.211.114 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.126.211.10.0.0.255 area 0\naccess-list 160 deny ip 192.168.59.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.126.211.114/24 (up)", "Routing: OSPF enabled on 10.126.211.10/24 area 0", "ACL 160: deny traffic from 192.168.59.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.126.211.114/24 is up, and ACL 160 denys traffic from 192.168.59.10."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.6.64.134 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.6.64.10.0.0.255 area 0\naccess-list 113 deny ip 192.168.173.19 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.6.64.134/24 (down)", "Routing: OSPF enabled on 10.6.64.10/24 area 0", "ACL 113: deny traffic from 192.168.173.19"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.6.64.134/24 is down, and ACL 113 denys traffic from 192.168.173.19."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.122.70.110 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.122.70.10.0.0.255 area 0\naccess-list 142 deny ip 192.168.245.3 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.122.70.110/24 (down)", "Routing: OSPF enabled on 10.122.70.10/24 area 0", "ACL 142: deny traffic from 192.168.245.3"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.122.70.110/24 is down, and ACL 142 denys traffic from 192.168.245.3."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.163.64.241 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.163.64.20.0.0.255 area 0\naccess-list 149 permit ip 192.168.177.65 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.163.64.241/24 (up)", "Routing: OSPF enabled on 10.163.64.20/24 area 0", "ACL 149: permit traffic from 192.168.177.65"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.163.64.241/24 is up, and ACL 149 permits traffic from 192.168.177.65."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.204.8.96 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.204.8.0.0.0.255 area 0\naccess-list 178 permit ip 192.168.3.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.204.8.96/24 (down)", "Routing: OSPF enabled on 10.204.8.0/24 area 0", "ACL 178: permit traffic from 192.168.3.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.204.8.96/24 is down, and ACL 178 permits traffic from 192.168.3.172."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.98.48.240 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.98.48.20.0.0.255 area 0\naccess-list 109 deny ip 192.168.52.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.98.48.240/24 (up)", "Routing: OSPF enabled on 10.98.48.20/24 area 0", "ACL 109: deny traffic from 192.168.52.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.98.48.240/24 is up, and ACL 109 denys traffic from 192.168.52.13."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.73.129.253 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.73.129.20.0.0.255 area 0\naccess-list 128 deny ip 192.168.182.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.73.129.253/24 (down)", "Routing: OSPF enabled on 10.73.129.20/24 area 0", "ACL 128: deny traffic from 192.168.182.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.73.129.253/24 is down, and ACL 128 denys traffic from 192.168.182.234."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.180.2.133 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.180.2.10.0.0.255 area 0\naccess-list 153 permit ip 192.168.79.173 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.180.2.133/24 (down)", "Routing: OSPF enabled on 10.180.2.10/24 area 0", "ACL 153: permit traffic from 192.168.79.173"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.180.2.133/24 is down, and ACL 153 permits traffic from 192.168.79.173."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.186.235.113 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.186.235.10.0.0.255 area 0\naccess-list 132 permit ip 192.168.103.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.186.235.113/24 (up)", "Routing: OSPF enabled on 10.186.235.10/24 area 0", "ACL 132: permit traffic from 192.168.103.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.186.235.113/24 is up, and ACL 132 permits traffic from 192.168.103.185."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.81.75.237 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.81.75.20.0.0.255 area 0\naccess-list 177 deny ip 192.168.19.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.81.75.237/24 (down)", "Routing: OSPF enabled on 10.81.75.20/24 area 0", "ACL 177: deny traffic from 192.168.19.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.81.75.237/24 is down, and ACL 177 denys traffic from 192.168.19.204."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.152.80.90 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.152.80.0.0.0.255 area 0\naccess-list 152 permit ip 192.168.81.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.152.80.90/24 (down)", "Routing: OSPF enabled on 10.152.80.0/24 area 0", "ACL 152: permit traffic from 192.168.81.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.152.80.90/24 is down, and ACL 152 permits traffic from 192.168.81.108."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.39.27.204 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.39.27.20.0.0.255 area 0\naccess-list 156 permit ip 192.168.103.168 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.39.27.204/24 (up)", "Routing: OSPF enabled on 10.39.27.20/24 area 0", "ACL 156: permit traffic from 192.168.103.168"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.39.27.204/24 is up, and ACL 156 permits traffic from 192.168.103.168."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.133.99.136 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.133.99.10.0.0.255 area 0\naccess-list 164 permit ip 192.168.77.29 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.133.99.136/24 (up)", "Routing: OSPF enabled on 10.133.99.10/24 area 0", "ACL 164: permit traffic from 192.168.77.29"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.133.99.136/24 is up, and ACL 164 permits traffic from 192.168.77.29."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.82.35.130 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.82.35.10.0.0.255 area 0\naccess-list 148 permit ip 192.168.71.111 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.82.35.130/24 (down)", "Routing: OSPF enabled on 10.82.35.10/24 area 0", "ACL 148: permit traffic from 192.168.71.111"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.82.35.130/24 is down, and ACL 148 permits traffic from 192.168.71.111."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.65.118.189 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.65.118.10.0.0.255 area 0\naccess-list 165 permit ip 192.168.115.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.65.118.189/24 (up)", "Routing: OSPF enabled on 10.65.118.10/24 area 0", "ACL 165: permit traffic from 192.168.115.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.65.118.189/24 is up, and ACL 165 permits traffic from 192.168.115.94."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.233.151.154 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.233.151.10.0.0.255 area 0\naccess-list 121 deny ip 192.168.88.57 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.233.151.154/24 (down)", "Routing: OSPF enabled on 10.233.151.10/24 area 0", "ACL 121: deny traffic from 192.168.88.57"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.233.151.154/24 is down, and ACL 121 denys traffic from 192.168.88.57."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.44.109.203 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.44.109.20.0.0.255 area 0\naccess-list 150 permit ip 192.168.209.123 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.44.109.203/24 (up)", "Routing: OSPF enabled on 10.44.109.20/24 area 0", "ACL 150: permit traffic from 192.168.209.123"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.44.109.203/24 is up, and ACL 150 permits traffic from 192.168.209.123."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.192.240.77 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.192.240.0.0.0.255 area 0\naccess-list 172 permit ip 192.168.174.26 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.192.240.77/24 (up)", "Routing: OSPF enabled on 10.192.240.0/24 area 0", "ACL 172: permit traffic from 192.168.174.26"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.192.240.77/24 is up, and ACL 172 permits traffic from 192.168.174.26."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.187.159.42 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.187.159.0.0.0.255 area 0\naccess-list 177 permit ip 192.168.144.100 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.187.159.42/24 (down)", "Routing: OSPF enabled on 10.187.159.0/24 area 0", "ACL 177: permit traffic from 192.168.144.100"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.187.159.42/24 is down, and ACL 177 permits traffic from 192.168.144.100."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.22.10.246 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.22.10.20.0.0.255 area 0\naccess-list 116 deny ip 192.168.242.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.22.10.246/24 (down)", "Routing: OSPF enabled on 10.22.10.20/24 area 0", "ACL 116: deny traffic from 192.168.242.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.22.10.246/24 is down, and ACL 116 denys traffic from 192.168.242.136."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.181.114.62 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.181.114.0.0.0.255 area 0\naccess-list 116 permit ip 192.168.237.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.181.114.62/24 (up)", "Routing: OSPF enabled on 10.181.114.0/24 area 0", "ACL 116: permit traffic from 192.168.237.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.181.114.62/24 is up, and ACL 116 permits traffic from 192.168.237.53."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.55.210.89 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.55.210.0.0.0.255 area 0\naccess-list 123 permit ip 192.168.155.195 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.55.210.89/24 (up)", "Routing: OSPF enabled on 10.55.210.0/24 area 0", "ACL 123: permit traffic from 192.168.155.195"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.55.210.89/24 is up, and ACL 123 permits traffic from 192.168.155.195."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.203.157.92 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.203.157.0.0.0.255 area 0\naccess-list 114 permit ip 192.168.14.224 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.203.157.92/24 (up)", "Routing: OSPF enabled on 10.203.157.0/24 area 0", "ACL 114: permit traffic from 192.168.14.224"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.203.157.92/24 is up, and ACL 114 permits traffic from 192.168.14.224."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.173.39.10 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.173.39.0.0.0.255 area 0\naccess-list 163 deny ip 192.168.14.215 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.173.39.10/24 (down)", "Routing: OSPF enabled on 10.173.39.0/24 area 0", "ACL 163: deny traffic from 192.168.14.215"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.173.39.10/24 is down, and ACL 163 denys traffic from 192.168.14.215."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.156.158.2 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.156.1580.0.0.255 area 0\naccess-list 154 permit ip 192.168.5.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.156.158.2/24 (up)", "Routing: OSPF enabled on 10.156.1580/24 area 0", "ACL 154: permit traffic from 192.168.5.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.156.158.2/24 is up, and ACL 154 permits traffic from 192.168.5.251."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.105.62.149 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.105.62.10.0.0.255 area 0\naccess-list 162 permit ip 192.168.255.211 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.105.62.149/24 (down)", "Routing: OSPF enabled on 10.105.62.10/24 area 0", "ACL 162: permit traffic from 192.168.255.211"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.105.62.149/24 is down, and ACL 162 permits traffic from 192.168.255.211."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.114.70.140 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.114.70.10.0.0.255 area 0\naccess-list 152 deny ip 192.168.48.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.114.70.140/24 (up)", "Routing: OSPF enabled on 10.114.70.10/24 area 0", "ACL 152: deny traffic from 192.168.48.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.114.70.140/24 is up, and ACL 152 denys traffic from 192.168.48.77."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.108.154.19 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.108.154.0.0.0.255 area 0\naccess-list 136 permit ip 192.168.89.71 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.108.154.19/24 (down)", "Routing: OSPF enabled on 10.108.154.0/24 area 0", "ACL 136: permit traffic from 192.168.89.71"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.108.154.19/24 is down, and ACL 136 permits traffic from 192.168.89.71."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.41.113.173 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.41.113.10.0.0.255 area 0\naccess-list 134 permit ip 192.168.249.72 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.41.113.173/24 (up)", "Routing: OSPF enabled on 10.41.113.10/24 area 0", "ACL 134: permit traffic from 192.168.249.72"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.41.113.173/24 is up, and ACL 134 permits traffic from 192.168.249.72."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.225.171.22 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.225.171.0.0.0.255 area 0\naccess-list 190 deny ip 192.168.136.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.225.171.22/24 (down)", "Routing: OSPF enabled on 10.225.171.0/24 area 0", "ACL 190: deny traffic from 192.168.136.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.225.171.22/24 is down, and ACL 190 denys traffic from 192.168.136.154."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.69.75.23 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.69.75.0.0.0.255 area 0\naccess-list 178 deny ip 192.168.217.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.69.75.23/24 (down)", "Routing: OSPF enabled on 10.69.75.0/24 area 0", "ACL 178: deny traffic from 192.168.217.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.69.75.23/24 is down, and ACL 178 denys traffic from 192.168.217.69."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.229.133.132 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.229.133.10.0.0.255 area 0\naccess-list 141 permit ip 192.168.22.145 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.229.133.132/24 (up)", "Routing: OSPF enabled on 10.229.133.10/24 area 0", "ACL 141: permit traffic from 192.168.22.145"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.229.133.132/24 is up, and ACL 141 permits traffic from 192.168.22.145."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.160.131.119 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.160.131.10.0.0.255 area 0\naccess-list 132 permit ip 192.168.192.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.160.131.119/24 (down)", "Routing: OSPF enabled on 10.160.131.10/24 area 0", "ACL 132: permit traffic from 192.168.192.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.160.131.119/24 is down, and ACL 132 permits traffic from 192.168.192.11."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.13.254.142 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.13.254.10.0.0.255 area 0\naccess-list 174 deny ip 192.168.152.181 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.13.254.142/24 (up)", "Routing: OSPF enabled on 10.13.254.10/24 area 0", "ACL 174: deny traffic from 192.168.152.181"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.13.254.142/24 is up, and ACL 174 denys traffic from 192.168.152.181."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.107.54.97 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.107.54.0.0.0.255 area 0\naccess-list 104 permit ip 192.168.205.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.107.54.97/24 (down)", "Routing: OSPF enabled on 10.107.54.0/24 area 0", "ACL 104: permit traffic from 192.168.205.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.107.54.97/24 is down, and ACL 104 permits traffic from 192.168.205.233."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.106.156.133 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.106.156.10.0.0.255 area 0\naccess-list 138 deny ip 192.168.199.14 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.106.156.133/24 (up)", "Routing: OSPF enabled on 10.106.156.10/24 area 0", "ACL 138: deny traffic from 192.168.199.14"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.106.156.133/24 is up, and ACL 138 denys traffic from 192.168.199.14."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.25.24.121 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.25.24.10.0.0.255 area 0\naccess-list 132 deny ip 192.168.66.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.25.24.121/24 (up)", "Routing: OSPF enabled on 10.25.24.10/24 area 0", "ACL 132: deny traffic from 192.168.66.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.25.24.121/24 is up, and ACL 132 denys traffic from 192.168.66.136."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.11.83.53 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.11.83.0.0.0.255 area 0\naccess-list 104 permit ip 192.168.108.65 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.11.83.53/24 (down)", "Routing: OSPF enabled on 10.11.83.0/24 area 0", "ACL 104: permit traffic from 192.168.108.65"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.11.83.53/24 is down, and ACL 104 permits traffic from 192.168.108.65."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.1.8.73 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.1.8.0.0.0.255 area 0\naccess-list 165 deny ip 192.168.32.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.1.8.73/24 (up)", "Routing: OSPF enabled on 10.1.8.0/24 area 0", "ACL 165: deny traffic from 192.168.32.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.1.8.73/24 is up, and ACL 165 denys traffic from 192.168.32.105."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.229.74.166 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.229.74.10.0.0.255 area 0\naccess-list 169 deny ip 192.168.89.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.229.74.166/24 (up)", "Routing: OSPF enabled on 10.229.74.10/24 area 0", "ACL 169: deny traffic from 192.168.89.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.229.74.166/24 is up, and ACL 169 denys traffic from 192.168.89.250."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.205.41.114 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.205.41.10.0.0.255 area 0\naccess-list 183 permit ip 192.168.186.153 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.205.41.114/24 (down)", "Routing: OSPF enabled on 10.205.41.10/24 area 0", "ACL 183: permit traffic from 192.168.186.153"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.205.41.114/24 is down, and ACL 183 permits traffic from 192.168.186.153."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.88.195.56 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.88.195.0.0.0.255 area 0\naccess-list 159 permit ip 192.168.124.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.88.195.56/24 (up)", "Routing: OSPF enabled on 10.88.195.0/24 area 0", "ACL 159: permit traffic from 192.168.124.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.88.195.56/24 is up, and ACL 159 permits traffic from 192.168.124.75."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.206.26.9 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.206.260.0.0.255 area 0\naccess-list 197 deny ip 192.168.61.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.206.26.9/24 (up)", "Routing: OSPF enabled on 10.206.260/24 area 0", "ACL 197: deny traffic from 192.168.61.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.206.26.9/24 is up, and ACL 197 denys traffic from 192.168.61.155."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.21.57.224 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.21.57.20.0.0.255 area 0\naccess-list 195 permit ip 192.168.111.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.21.57.224/24 (down)", "Routing: OSPF enabled on 10.21.57.20/24 area 0", "ACL 195: permit traffic from 192.168.111.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.21.57.224/24 is down, and ACL 195 permits traffic from 192.168.111.107."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.229.121.48 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.229.121.0.0.0.255 area 0\naccess-list 198 permit ip 192.168.163.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.229.121.48/24 (up)", "Routing: OSPF enabled on 10.229.121.0/24 area 0", "ACL 198: permit traffic from 192.168.163.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.229.121.48/24 is up, and ACL 198 permits traffic from 192.168.163.105."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.80.130.248 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.80.130.20.0.0.255 area 0\naccess-list 122 deny ip 192.168.163.32 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.80.130.248/24 (up)", "Routing: OSPF enabled on 10.80.130.20/24 area 0", "ACL 122: deny traffic from 192.168.163.32"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.80.130.248/24 is up, and ACL 122 denys traffic from 192.168.163.32."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.198.241.95 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.198.241.0.0.0.255 area 0\naccess-list 190 permit ip 192.168.142.171 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.198.241.95/24 (down)", "Routing: OSPF enabled on 10.198.241.0/24 area 0", "ACL 190: permit traffic from 192.168.142.171"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.198.241.95/24 is down, and ACL 190 permits traffic from 192.168.142.171."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.139.229.118 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.139.229.10.0.0.255 area 0\naccess-list 128 permit ip 192.168.180.131 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.139.229.118/24 (down)", "Routing: OSPF enabled on 10.139.229.10/24 area 0", "ACL 128: permit traffic from 192.168.180.131"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.139.229.118/24 is down, and ACL 128 permits traffic from 192.168.180.131."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.202.121.247 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.202.121.20.0.0.255 area 0\naccess-list 177 deny ip 192.168.194.70 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.202.121.247/24 (down)", "Routing: OSPF enabled on 10.202.121.20/24 area 0", "ACL 177: deny traffic from 192.168.194.70"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.202.121.247/24 is down, and ACL 177 denys traffic from 192.168.194.70."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.8.16.76 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.8.16.0.0.0.255 area 0\naccess-list 118 permit ip 192.168.67.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.8.16.76/24 (down)", "Routing: OSPF enabled on 10.8.16.0/24 area 0", "ACL 118: permit traffic from 192.168.67.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.8.16.76/24 is down, and ACL 118 permits traffic from 192.168.67.192."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.34.210.76 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.34.210.0.0.0.255 area 0\naccess-list 144 permit ip 192.168.223.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.34.210.76/24 (down)", "Routing: OSPF enabled on 10.34.210.0/24 area 0", "ACL 144: permit traffic from 192.168.223.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.34.210.76/24 is down, and ACL 144 permits traffic from 192.168.223.250."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.211.101.117 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.211.101.10.0.0.255 area 0\naccess-list 102 deny ip 192.168.36.224 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.211.101.117/24 (down)", "Routing: OSPF enabled on 10.211.101.10/24 area 0", "ACL 102: deny traffic from 192.168.36.224"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.211.101.117/24 is down, and ACL 102 denys traffic from 192.168.36.224."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.6.194.22 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.6.194.0.0.0.255 area 0\naccess-list 166 permit ip 192.168.178.23 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.6.194.22/24 (up)", "Routing: OSPF enabled on 10.6.194.0/24 area 0", "ACL 166: permit traffic from 192.168.178.23"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.6.194.22/24 is up, and ACL 166 permits traffic from 192.168.178.23."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.71.6.115 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.71.6.10.0.0.255 area 0\naccess-list 184 permit ip 192.168.71.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.71.6.115/24 (up)", "Routing: OSPF enabled on 10.71.6.10/24 area 0", "ACL 184: permit traffic from 192.168.71.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.71.6.115/24 is up, and ACL 184 permits traffic from 192.168.71.59."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.25.40.169 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.25.40.10.0.0.255 area 0\naccess-list 177 deny ip 192.168.204.214 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.25.40.169/24 (down)", "Routing: OSPF enabled on 10.25.40.10/24 area 0", "ACL 177: deny traffic from 192.168.204.214"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.25.40.169/24 is down, and ACL 177 denys traffic from 192.168.204.214."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.206.247.128 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.206.247.10.0.0.255 area 0\naccess-list 142 permit ip 192.168.251.5 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.206.247.128/24 (up)", "Routing: OSPF enabled on 10.206.247.10/24 area 0", "ACL 142: permit traffic from 192.168.251.5"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.206.247.128/24 is up, and ACL 142 permits traffic from 192.168.251.5."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.212.4.179 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.212.4.10.0.0.255 area 0\naccess-list 128 permit ip 192.168.65.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.212.4.179/24 (up)", "Routing: OSPF enabled on 10.212.4.10/24 area 0", "ACL 128: permit traffic from 192.168.65.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.212.4.179/24 is up, and ACL 128 permits traffic from 192.168.65.154."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.204.152.19 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.204.152.0.0.0.255 area 0\naccess-list 147 deny ip 192.168.142.97 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.204.152.19/24 (down)", "Routing: OSPF enabled on 10.204.152.0/24 area 0", "ACL 147: deny traffic from 192.168.142.97"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.204.152.19/24 is down, and ACL 147 denys traffic from 192.168.142.97."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.145.116.10 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.145.116.0.0.0.255 area 0\naccess-list 110 permit ip 192.168.132.62 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.145.116.10/24 (down)", "Routing: OSPF enabled on 10.145.116.0/24 area 0", "ACL 110: permit traffic from 192.168.132.62"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.145.116.10/24 is down, and ACL 110 permits traffic from 192.168.132.62."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.35.89.191 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.35.89.10.0.0.255 area 0\naccess-list 121 deny ip 192.168.239.31 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.35.89.191/24 (up)", "Routing: OSPF enabled on 10.35.89.10/24 area 0", "ACL 121: deny traffic from 192.168.239.31"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.35.89.191/24 is up, and ACL 121 denys traffic from 192.168.239.31."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.118.97.213 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.118.97.20.0.0.255 area 0\naccess-list 192 permit ip 192.168.235.2 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.118.97.213/24 (up)", "Routing: OSPF enabled on 10.118.97.20/24 area 0", "ACL 192: permit traffic from 192.168.235.2"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.118.97.213/24 is up, and ACL 192 permits traffic from 192.168.235.2."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.228.200.30 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.228.200.0.0.0.255 area 0\naccess-list 117 deny ip 192.168.209.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.228.200.30/24 (up)", "Routing: OSPF enabled on 10.228.200.0/24 area 0", "ACL 117: deny traffic from 192.168.209.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.228.200.30/24 is up, and ACL 117 denys traffic from 192.168.209.222."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.199.91.191 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.199.91.10.0.0.255 area 0\naccess-list 126 permit ip 192.168.4.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.199.91.191/24 (down)", "Routing: OSPF enabled on 10.199.91.10/24 area 0", "ACL 126: permit traffic from 192.168.4.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.199.91.191/24 is down, and ACL 126 permits traffic from 192.168.4.186."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.220.16.187 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.220.16.10.0.0.255 area 0\naccess-list 145 deny ip 192.168.212.23 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.220.16.187/24 (down)", "Routing: OSPF enabled on 10.220.16.10/24 area 0", "ACL 145: deny traffic from 192.168.212.23"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.220.16.187/24 is down, and ACL 145 denys traffic from 192.168.212.23."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.211.112.105 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.211.112.10.0.0.255 area 0\naccess-list 102 permit ip 192.168.208.144 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.211.112.105/24 (up)", "Routing: OSPF enabled on 10.211.112.10/24 area 0", "ACL 102: permit traffic from 192.168.208.144"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.211.112.105/24 is up, and ACL 102 permits traffic from 192.168.208.144."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.68.190.71 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.68.190.0.0.0.255 area 0\naccess-list 126 permit ip 192.168.240.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.68.190.71/24 (up)", "Routing: OSPF enabled on 10.68.190.0/24 area 0", "ACL 126: permit traffic from 192.168.240.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.68.190.71/24 is up, and ACL 126 permits traffic from 192.168.240.191."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.13.53.150 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.13.53.10.0.0.255 area 0\naccess-list 198 permit ip 192.168.114.29 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.13.53.150/24 (up)", "Routing: OSPF enabled on 10.13.53.10/24 area 0", "ACL 198: permit traffic from 192.168.114.29"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.13.53.150/24 is up, and ACL 198 permits traffic from 192.168.114.29."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.192.198.225 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.192.198.20.0.0.255 area 0\naccess-list 169 permit ip 192.168.14.175 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.192.198.225/24 (down)", "Routing: OSPF enabled on 10.192.198.20/24 area 0", "ACL 169: permit traffic from 192.168.14.175"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.192.198.225/24 is down, and ACL 169 permits traffic from 192.168.14.175."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.146.221.164 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.146.221.10.0.0.255 area 0\naccess-list 156 permit ip 192.168.171.58 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.146.221.164/24 (down)", "Routing: OSPF enabled on 10.146.221.10/24 area 0", "ACL 156: permit traffic from 192.168.171.58"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.146.221.164/24 is down, and ACL 156 permits traffic from 192.168.171.58."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.230.18.40 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.230.18.0.0.0.255 area 0\naccess-list 132 deny ip 192.168.189.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.230.18.40/24 (down)", "Routing: OSPF enabled on 10.230.18.0/24 area 0", "ACL 132: deny traffic from 192.168.189.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.230.18.40/24 is down, and ACL 132 denys traffic from 192.168.189.38."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.229.195.211 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.229.195.20.0.0.255 area 0\naccess-list 162 deny ip 192.168.233.93 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.229.195.211/24 (up)", "Routing: OSPF enabled on 10.229.195.20/24 area 0", "ACL 162: deny traffic from 192.168.233.93"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.229.195.211/24 is up, and ACL 162 denys traffic from 192.168.233.93."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.249.227.13 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.249.227.0.0.0.255 area 0\naccess-list 184 permit ip 192.168.110.135 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.249.227.13/24 (up)", "Routing: OSPF enabled on 10.249.227.0/24 area 0", "ACL 184: permit traffic from 192.168.110.135"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.249.227.13/24 is up, and ACL 184 permits traffic from 192.168.110.135."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.59.37.245 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.59.37.20.0.0.255 area 0\naccess-list 190 deny ip 192.168.7.133 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.59.37.245/24 (up)", "Routing: OSPF enabled on 10.59.37.20/24 area 0", "ACL 190: deny traffic from 192.168.7.133"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.59.37.245/24 is up, and ACL 190 denys traffic from 192.168.7.133."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.233.136.249 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.233.136.20.0.0.255 area 0\naccess-list 165 permit ip 192.168.215.79 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.233.136.249/24 (down)", "Routing: OSPF enabled on 10.233.136.20/24 area 0", "ACL 165: permit traffic from 192.168.215.79"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.233.136.249/24 is down, and ACL 165 permits traffic from 192.168.215.79."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.144.61.43 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.144.61.0.0.0.255 area 0\naccess-list 187 permit ip 192.168.165.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.144.61.43/24 (up)", "Routing: OSPF enabled on 10.144.61.0/24 area 0", "ACL 187: permit traffic from 192.168.165.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.144.61.43/24 is up, and ACL 187 permits traffic from 192.168.165.193."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.163.120.137 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.163.120.10.0.0.255 area 0\naccess-list 160 permit ip 192.168.111.166 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.163.120.137/24 (down)", "Routing: OSPF enabled on 10.163.120.10/24 area 0", "ACL 160: permit traffic from 192.168.111.166"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.163.120.137/24 is down, and ACL 160 permits traffic from 192.168.111.166."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.250.219.62 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.250.219.0.0.0.255 area 0\naccess-list 180 deny ip 192.168.79.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.250.219.62/24 (up)", "Routing: OSPF enabled on 10.250.219.0/24 area 0", "ACL 180: deny traffic from 192.168.79.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.250.219.62/24 is up, and ACL 180 denys traffic from 192.168.79.206."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.179.229.194 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.179.229.10.0.0.255 area 0\naccess-list 144 permit ip 192.168.52.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.179.229.194/24 (down)", "Routing: OSPF enabled on 10.179.229.10/24 area 0", "ACL 144: permit traffic from 192.168.52.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.179.229.194/24 is down, and ACL 144 permits traffic from 192.168.52.59."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.118.239.203 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.118.239.20.0.0.255 area 0\naccess-list 151 deny ip 192.168.19.119 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.118.239.203/24 (up)", "Routing: OSPF enabled on 10.118.239.20/24 area 0", "ACL 151: deny traffic from 192.168.19.119"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.118.239.203/24 is up, and ACL 151 denys traffic from 192.168.19.119."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.151.80.53 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.151.80.0.0.0.255 area 0\naccess-list 167 permit ip 192.168.239.19 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.151.80.53/24 (down)", "Routing: OSPF enabled on 10.151.80.0/24 area 0", "ACL 167: permit traffic from 192.168.239.19"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.151.80.53/24 is down, and ACL 167 permits traffic from 192.168.239.19."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.143.88.195 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.143.88.10.0.0.255 area 0\naccess-list 191 deny ip 192.168.194.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.143.88.195/24 (down)", "Routing: OSPF enabled on 10.143.88.10/24 area 0", "ACL 191: deny traffic from 192.168.194.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.143.88.195/24 is down, and ACL 191 denys traffic from 192.168.194.56."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.42.3.49 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.42.3.0.0.0.255 area 0\naccess-list 118 permit ip 192.168.182.244 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.42.3.49/24 (down)", "Routing: OSPF enabled on 10.42.3.0/24 area 0", "ACL 118: permit traffic from 192.168.182.244"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.42.3.49/24 is down, and ACL 118 permits traffic from 192.168.182.244."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.36.165.110 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.36.165.10.0.0.255 area 0\naccess-list 119 deny ip 192.168.72.165 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.36.165.110/24 (up)", "Routing: OSPF enabled on 10.36.165.10/24 area 0", "ACL 119: deny traffic from 192.168.72.165"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.36.165.110/24 is up, and ACL 119 denys traffic from 192.168.72.165."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.8.5.116 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.8.5.10.0.0.255 area 0\naccess-list 129 permit ip 192.168.14.232 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.8.5.116/24 (down)", "Routing: OSPF enabled on 10.8.5.10/24 area 0", "ACL 129: permit traffic from 192.168.14.232"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.8.5.116/24 is down, and ACL 129 permits traffic from 192.168.14.232."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.103.94.86 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.103.94.0.0.0.255 area 0\naccess-list 166 permit ip 192.168.46.177 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.103.94.86/24 (up)", "Routing: OSPF enabled on 10.103.94.0/24 area 0", "ACL 166: permit traffic from 192.168.46.177"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.103.94.86/24 is up, and ACL 166 permits traffic from 192.168.46.177."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.87.180.152 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.87.180.10.0.0.255 area 0\naccess-list 183 permit ip 192.168.221.130 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.87.180.152/24 (down)", "Routing: OSPF enabled on 10.87.180.10/24 area 0", "ACL 183: permit traffic from 192.168.221.130"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.87.180.152/24 is down, and ACL 183 permits traffic from 192.168.221.130."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.181.179.95 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.181.179.0.0.0.255 area 0\naccess-list 198 permit ip 192.168.46.200 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.181.179.95/24 (down)", "Routing: OSPF enabled on 10.181.179.0/24 area 0", "ACL 198: permit traffic from 192.168.46.200"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.181.179.95/24 is down, and ACL 198 permits traffic from 192.168.46.200."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.84.106.69 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.84.106.0.0.0.255 area 0\naccess-list 157 permit ip 192.168.250.88 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.84.106.69/24 (down)", "Routing: OSPF enabled on 10.84.106.0/24 area 0", "ACL 157: permit traffic from 192.168.250.88"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.84.106.69/24 is down, and ACL 157 permits traffic from 192.168.250.88."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.137.94.230 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.137.94.20.0.0.255 area 0\naccess-list 103 permit ip 192.168.227.200 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.137.94.230/24 (down)", "Routing: OSPF enabled on 10.137.94.20/24 area 0", "ACL 103: permit traffic from 192.168.227.200"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.137.94.230/24 is down, and ACL 103 permits traffic from 192.168.227.200."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.26.216.52 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.26.216.0.0.0.255 area 0\naccess-list 102 permit ip 192.168.2.158 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.26.216.52/24 (up)", "Routing: OSPF enabled on 10.26.216.0/24 area 0", "ACL 102: permit traffic from 192.168.2.158"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.26.216.52/24 is up, and ACL 102 permits traffic from 192.168.2.158."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.243.142.88 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.243.142.0.0.0.255 area 0\naccess-list 149 permit ip 192.168.104.162 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.243.142.88/24 (down)", "Routing: OSPF enabled on 10.243.142.0/24 area 0", "ACL 149: permit traffic from 192.168.104.162"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.243.142.88/24 is down, and ACL 149 permits traffic from 192.168.104.162."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.132.75.218 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.132.75.20.0.0.255 area 0\naccess-list 179 deny ip 192.168.216.99 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.132.75.218/24 (down)", "Routing: OSPF enabled on 10.132.75.20/24 area 0", "ACL 179: deny traffic from 192.168.216.99"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.132.75.218/24 is down, and ACL 179 denys traffic from 192.168.216.99."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.6.54.249 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.6.54.20.0.0.255 area 0\naccess-list 105 permit ip 192.168.245.71 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.6.54.249/24 (down)", "Routing: OSPF enabled on 10.6.54.20/24 area 0", "ACL 105: permit traffic from 192.168.245.71"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.6.54.249/24 is down, and ACL 105 permits traffic from 192.168.245.71."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.48.30.41 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.48.30.0.0.0.255 area 0\naccess-list 194 permit ip 192.168.34.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.48.30.41/24 (down)", "Routing: OSPF enabled on 10.48.30.0/24 area 0", "ACL 194: permit traffic from 192.168.34.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.48.30.41/24 is down, and ACL 194 permits traffic from 192.168.34.114."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.208.99.58 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.208.99.0.0.0.255 area 0\naccess-list 157 permit ip 192.168.148.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.208.99.58/24 (down)", "Routing: OSPF enabled on 10.208.99.0/24 area 0", "ACL 157: permit traffic from 192.168.148.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.208.99.58/24 is down, and ACL 157 permits traffic from 192.168.148.146."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.40.189.87 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.40.189.0.0.0.255 area 0\naccess-list 187 deny ip 192.168.25.24 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.40.189.87/24 (down)", "Routing: OSPF enabled on 10.40.189.0/24 area 0", "ACL 187: deny traffic from 192.168.25.24"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.40.189.87/24 is down, and ACL 187 denys traffic from 192.168.25.24."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.162.55.91 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.162.55.0.0.0.255 area 0\naccess-list 176 deny ip 192.168.211.122 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.162.55.91/24 (up)", "Routing: OSPF enabled on 10.162.55.0/24 area 0", "ACL 176: deny traffic from 192.168.211.122"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.162.55.91/24 is up, and ACL 176 denys traffic from 192.168.211.122."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.215.123.167 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.215.123.10.0.0.255 area 0\naccess-list 194 permit ip 192.168.237.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.215.123.167/24 (up)", "Routing: OSPF enabled on 10.215.123.10/24 area 0", "ACL 194: permit traffic from 192.168.237.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.215.123.167/24 is up, and ACL 194 permits traffic from 192.168.237.113."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.68.72.237 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.68.72.20.0.0.255 area 0\naccess-list 135 permit ip 192.168.112.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.68.72.237/24 (up)", "Routing: OSPF enabled on 10.68.72.20/24 area 0", "ACL 135: permit traffic from 192.168.112.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.68.72.237/24 is up, and ACL 135 permits traffic from 192.168.112.126."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.253.41.144 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.253.41.10.0.0.255 area 0\naccess-list 130 permit ip 192.168.196.249 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.253.41.144/24 (down)", "Routing: OSPF enabled on 10.253.41.10/24 area 0", "ACL 130: permit traffic from 192.168.196.249"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.253.41.144/24 is down, and ACL 130 permits traffic from 192.168.196.249."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.68.67.60 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.68.67.0.0.0.255 area 0\naccess-list 133 permit ip 192.168.138.30 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.68.67.60/24 (down)", "Routing: OSPF enabled on 10.68.67.0/24 area 0", "ACL 133: permit traffic from 192.168.138.30"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.68.67.60/24 is down, and ACL 133 permits traffic from 192.168.138.30."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.221.195.202 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.221.195.20.0.0.255 area 0\naccess-list 187 deny ip 192.168.82.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.221.195.202/24 (up)", "Routing: OSPF enabled on 10.221.195.20/24 area 0", "ACL 187: deny traffic from 192.168.82.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.221.195.202/24 is up, and ACL 187 denys traffic from 192.168.82.193."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.233.209.183 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.233.209.10.0.0.255 area 0\naccess-list 137 deny ip 192.168.78.86 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.233.209.183/24 (up)", "Routing: OSPF enabled on 10.233.209.10/24 area 0", "ACL 137: deny traffic from 192.168.78.86"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.233.209.183/24 is up, and ACL 137 denys traffic from 192.168.78.86."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.119.11.132 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.119.11.10.0.0.255 area 0\naccess-list 112 permit ip 192.168.3.229 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.119.11.132/24 (up)", "Routing: OSPF enabled on 10.119.11.10/24 area 0", "ACL 112: permit traffic from 192.168.3.229"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.119.11.132/24 is up, and ACL 112 permits traffic from 192.168.3.229."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.30.31.97 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.30.31.0.0.0.255 area 0\naccess-list 178 permit ip 192.168.186.174 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.30.31.97/24 (up)", "Routing: OSPF enabled on 10.30.31.0/24 area 0", "ACL 178: permit traffic from 192.168.186.174"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.30.31.97/24 is up, and ACL 178 permits traffic from 192.168.186.174."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.30.72.213 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.30.72.20.0.0.255 area 0\naccess-list 122 permit ip 192.168.112.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.30.72.213/24 (up)", "Routing: OSPF enabled on 10.30.72.20/24 area 0", "ACL 122: permit traffic from 192.168.112.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.30.72.213/24 is up, and ACL 122 permits traffic from 192.168.112.114."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.141.32.219 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.141.32.20.0.0.255 area 0\naccess-list 159 permit ip 192.168.174.87 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.141.32.219/24 (down)", "Routing: OSPF enabled on 10.141.32.20/24 area 0", "ACL 159: permit traffic from 192.168.174.87"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.141.32.219/24 is down, and ACL 159 permits traffic from 192.168.174.87."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.38.66.198 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.38.66.10.0.0.255 area 0\naccess-list 192 deny ip 192.168.110.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.38.66.198/24 (down)", "Routing: OSPF enabled on 10.38.66.10/24 area 0", "ACL 192: deny traffic from 192.168.110.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.38.66.198/24 is down, and ACL 192 denys traffic from 192.168.110.196."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.54.92.155 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.54.92.10.0.0.255 area 0\naccess-list 163 deny ip 192.168.53.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.54.92.155/24 (down)", "Routing: OSPF enabled on 10.54.92.10/24 area 0", "ACL 163: deny traffic from 192.168.53.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.54.92.155/24 is down, and ACL 163 denys traffic from 192.168.53.126."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.136.13.43 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.136.13.0.0.0.255 area 0\naccess-list 149 permit ip 192.168.149.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.136.13.43/24 (up)", "Routing: OSPF enabled on 10.136.13.0/24 area 0", "ACL 149: permit traffic from 192.168.149.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.136.13.43/24 is up, and ACL 149 permits traffic from 192.168.149.234."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.26.92.159 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.26.92.10.0.0.255 area 0\naccess-list 133 permit ip 192.168.91.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.26.92.159/24 (down)", "Routing: OSPF enabled on 10.26.92.10/24 area 0", "ACL 133: permit traffic from 192.168.91.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.26.92.159/24 is down, and ACL 133 permits traffic from 192.168.91.221."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.88.193.105 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.88.193.10.0.0.255 area 0\naccess-list 199 deny ip 192.168.214.255 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.88.193.105/24 (down)", "Routing: OSPF enabled on 10.88.193.10/24 area 0", "ACL 199: deny traffic from 192.168.214.255"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.88.193.105/24 is down, and ACL 199 denys traffic from 192.168.214.255."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.95.11.108 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.95.11.10.0.0.255 area 0\naccess-list 193 deny ip 192.168.43.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.95.11.108/24 (down)", "Routing: OSPF enabled on 10.95.11.10/24 area 0", "ACL 193: deny traffic from 192.168.43.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.95.11.108/24 is down, and ACL 193 denys traffic from 192.168.43.49."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.251.221.118 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.251.221.10.0.0.255 area 0\naccess-list 126 permit ip 192.168.170.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.251.221.118/24 (up)", "Routing: OSPF enabled on 10.251.221.10/24 area 0", "ACL 126: permit traffic from 192.168.170.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.251.221.118/24 is up, and ACL 126 permits traffic from 192.168.170.251."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.113.29.237 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.113.29.20.0.0.255 area 0\naccess-list 175 deny ip 192.168.175.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.113.29.237/24 (up)", "Routing: OSPF enabled on 10.113.29.20/24 area 0", "ACL 175: deny traffic from 192.168.175.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.113.29.237/24 is up, and ACL 175 denys traffic from 192.168.175.95."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.65.166.161 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.65.166.10.0.0.255 area 0\naccess-list 110 deny ip 192.168.28.253 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.65.166.161/24 (down)", "Routing: OSPF enabled on 10.65.166.10/24 area 0", "ACL 110: deny traffic from 192.168.28.253"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.65.166.161/24 is down, and ACL 110 denys traffic from 192.168.28.253."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.27.26.88 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.27.26.0.0.0.255 area 0\naccess-list 173 deny ip 192.168.97.253 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.27.26.88/24 (down)", "Routing: OSPF enabled on 10.27.26.0/24 area 0", "ACL 173: deny traffic from 192.168.97.253"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.27.26.88/24 is down, and ACL 173 denys traffic from 192.168.97.253."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.126.188.14 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.126.188.0.0.0.255 area 0\naccess-list 158 deny ip 192.168.128.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.126.188.14/24 (down)", "Routing: OSPF enabled on 10.126.188.0/24 area 0", "ACL 158: deny traffic from 192.168.128.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.126.188.14/24 is down, and ACL 158 denys traffic from 192.168.128.185."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.92.189.207 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.92.189.20.0.0.255 area 0\naccess-list 176 deny ip 192.168.223.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.92.189.207/24 (up)", "Routing: OSPF enabled on 10.92.189.20/24 area 0", "ACL 176: deny traffic from 192.168.223.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.92.189.207/24 is up, and ACL 176 denys traffic from 192.168.223.221."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.61.157.198 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.61.157.10.0.0.255 area 0\naccess-list 191 deny ip 192.168.38.227 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.61.157.198/24 (down)", "Routing: OSPF enabled on 10.61.157.10/24 area 0", "ACL 191: deny traffic from 192.168.38.227"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.61.157.198/24 is down, and ACL 191 denys traffic from 192.168.38.227."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.134.101.238 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.134.101.20.0.0.255 area 0\naccess-list 164 deny ip 192.168.223.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.134.101.238/24 (down)", "Routing: OSPF enabled on 10.134.101.20/24 area 0", "ACL 164: deny traffic from 192.168.223.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.134.101.238/24 is down, and ACL 164 denys traffic from 192.168.223.69."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.134.218.121 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.134.218.10.0.0.255 area 0\naccess-list 192 permit ip 192.168.228.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.134.218.121/24 (up)", "Routing: OSPF enabled on 10.134.218.10/24 area 0", "ACL 192: permit traffic from 192.168.228.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.134.218.121/24 is up, and ACL 192 permits traffic from 192.168.228.234."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.153.142.29 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.153.142.0.0.0.255 area 0\naccess-list 143 permit ip 192.168.28.52 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.153.142.29/24 (up)", "Routing: OSPF enabled on 10.153.142.0/24 area 0", "ACL 143: permit traffic from 192.168.28.52"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.153.142.29/24 is up, and ACL 143 permits traffic from 192.168.28.52."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.22.170.31 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.22.170.0.0.0.255 area 0\naccess-list 114 deny ip 192.168.171.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.22.170.31/24 (up)", "Routing: OSPF enabled on 10.22.170.0/24 area 0", "ACL 114: deny traffic from 192.168.171.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.22.170.31/24 is up, and ACL 114 denys traffic from 192.168.171.20."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.237.112.107 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.237.112.10.0.0.255 area 0\naccess-list 141 deny ip 192.168.187.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.237.112.107/24 (up)", "Routing: OSPF enabled on 10.237.112.10/24 area 0", "ACL 141: deny traffic from 192.168.187.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.237.112.107/24 is up, and ACL 141 denys traffic from 192.168.187.59."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.92.157.192 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.92.157.10.0.0.255 area 0\naccess-list 167 permit ip 192.168.131.162 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.92.157.192/24 (down)", "Routing: OSPF enabled on 10.92.157.10/24 area 0", "ACL 167: permit traffic from 192.168.131.162"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.92.157.192/24 is down, and ACL 167 permits traffic from 192.168.131.162."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.211.181.82 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.211.181.0.0.0.255 area 0\naccess-list 125 deny ip 192.168.163.102 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.211.181.82/24 (down)", "Routing: OSPF enabled on 10.211.181.0/24 area 0", "ACL 125: deny traffic from 192.168.163.102"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.211.181.82/24 is down, and ACL 125 denys traffic from 192.168.163.102."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.152.252.66 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.152.252.0.0.0.255 area 0\naccess-list 158 deny ip 192.168.108.45 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.152.252.66/24 (up)", "Routing: OSPF enabled on 10.152.252.0/24 area 0", "ACL 158: deny traffic from 192.168.108.45"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.152.252.66/24 is up, and ACL 158 denys traffic from 192.168.108.45."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.74.88.104 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.74.88.10.0.0.255 area 0\naccess-list 113 deny ip 192.168.160.63 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.74.88.104/24 (up)", "Routing: OSPF enabled on 10.74.88.10/24 area 0", "ACL 113: deny traffic from 192.168.160.63"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.74.88.104/24 is up, and ACL 113 denys traffic from 192.168.160.63."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.52.218.34 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.52.218.0.0.0.255 area 0\naccess-list 198 deny ip 192.168.167.143 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.52.218.34/24 (up)", "Routing: OSPF enabled on 10.52.218.0/24 area 0", "ACL 198: deny traffic from 192.168.167.143"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.52.218.34/24 is up, and ACL 198 denys traffic from 192.168.167.143."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.3.40.114 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.3.40.10.0.0.255 area 0\naccess-list 147 permit ip 192.168.255.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.3.40.114/24 (down)", "Routing: OSPF enabled on 10.3.40.10/24 area 0", "ACL 147: permit traffic from 192.168.255.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.3.40.114/24 is down, and ACL 147 permits traffic from 192.168.255.154."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.61.123.136 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.61.123.10.0.0.255 area 0\naccess-list 135 permit ip 192.168.135.184 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.61.123.136/24 (up)", "Routing: OSPF enabled on 10.61.123.10/24 area 0", "ACL 135: permit traffic from 192.168.135.184"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.61.123.136/24 is up, and ACL 135 permits traffic from 192.168.135.184."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.218.243.253 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.218.243.20.0.0.255 area 0\naccess-list 129 permit ip 192.168.33.145 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.218.243.253/24 (down)", "Routing: OSPF enabled on 10.218.243.20/24 area 0", "ACL 129: permit traffic from 192.168.33.145"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.218.243.253/24 is down, and ACL 129 permits traffic from 192.168.33.145."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.131.141.228 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.131.141.20.0.0.255 area 0\naccess-list 167 deny ip 192.168.34.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.131.141.228/24 (down)", "Routing: OSPF enabled on 10.131.141.20/24 area 0", "ACL 167: deny traffic from 192.168.34.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.131.141.228/24 is down, and ACL 167 denys traffic from 192.168.34.11."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.252.81.33 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.252.81.0.0.0.255 area 0\naccess-list 198 permit ip 192.168.78.141 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.252.81.33/24 (up)", "Routing: OSPF enabled on 10.252.81.0/24 area 0", "ACL 198: permit traffic from 192.168.78.141"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.252.81.33/24 is up, and ACL 198 permits traffic from 192.168.78.141."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.237.33.184 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.237.33.10.0.0.255 area 0\naccess-list 108 deny ip 192.168.58.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.237.33.184/24 (up)", "Routing: OSPF enabled on 10.237.33.10/24 area 0", "ACL 108: deny traffic from 192.168.58.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.237.33.184/24 is up, and ACL 108 denys traffic from 192.168.58.77."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.152.184.159 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.152.184.10.0.0.255 area 0\naccess-list 122 permit ip 192.168.224.205 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.152.184.159/24 (down)", "Routing: OSPF enabled on 10.152.184.10/24 area 0", "ACL 122: permit traffic from 192.168.224.205"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.152.184.159/24 is down, and ACL 122 permits traffic from 192.168.224.205."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.201.24.120 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.201.24.10.0.0.255 area 0\naccess-list 133 permit ip 192.168.13.179 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.201.24.120/24 (down)", "Routing: OSPF enabled on 10.201.24.10/24 area 0", "ACL 133: permit traffic from 192.168.13.179"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.201.24.120/24 is down, and ACL 133 permits traffic from 192.168.13.179."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.158.111.19 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.158.111.0.0.0.255 area 0\naccess-list 116 permit ip 192.168.36.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.158.111.19/24 (up)", "Routing: OSPF enabled on 10.158.111.0/24 area 0", "ACL 116: permit traffic from 192.168.36.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.158.111.19/24 is up, and ACL 116 permits traffic from 192.168.36.250."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.157.72.63 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.157.72.0.0.0.255 area 0\naccess-list 165 deny ip 192.168.237.153 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.157.72.63/24 (down)", "Routing: OSPF enabled on 10.157.72.0/24 area 0", "ACL 165: deny traffic from 192.168.237.153"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.157.72.63/24 is down, and ACL 165 denys traffic from 192.168.237.153."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.173.179.156 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.173.179.10.0.0.255 area 0\naccess-list 153 permit ip 192.168.218.3 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.173.179.156/24 (down)", "Routing: OSPF enabled on 10.173.179.10/24 area 0", "ACL 153: permit traffic from 192.168.218.3"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.173.179.156/24 is down, and ACL 153 permits traffic from 192.168.218.3."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.93.135.214 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.93.135.20.0.0.255 area 0\naccess-list 187 deny ip 192.168.239.243 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.93.135.214/24 (up)", "Routing: OSPF enabled on 10.93.135.20/24 area 0", "ACL 187: deny traffic from 192.168.239.243"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.93.135.214/24 is up, and ACL 187 denys traffic from 192.168.239.243."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.29.149.221 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.29.149.20.0.0.255 area 0\naccess-list 151 permit ip 192.168.230.2 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.29.149.221/24 (down)", "Routing: OSPF enabled on 10.29.149.20/24 area 0", "ACL 151: permit traffic from 192.168.230.2"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.29.149.221/24 is down, and ACL 151 permits traffic from 192.168.230.2."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.169.129.243 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.169.129.20.0.0.255 area 0\naccess-list 133 permit ip 192.168.212.79 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.169.129.243/24 (up)", "Routing: OSPF enabled on 10.169.129.20/24 area 0", "ACL 133: permit traffic from 192.168.212.79"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.169.129.243/24 is up, and ACL 133 permits traffic from 192.168.212.79."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.157.82.101 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.157.82.10.0.0.255 area 0\naccess-list 135 permit ip 192.168.164.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.157.82.101/24 (down)", "Routing: OSPF enabled on 10.157.82.10/24 area 0", "ACL 135: permit traffic from 192.168.164.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.157.82.101/24 is down, and ACL 135 permits traffic from 192.168.164.49."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.211.118.167 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.211.118.10.0.0.255 area 0\naccess-list 161 permit ip 192.168.50.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.211.118.167/24 (up)", "Routing: OSPF enabled on 10.211.118.10/24 area 0", "ACL 161: permit traffic from 192.168.50.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.211.118.167/24 is up, and ACL 161 permits traffic from 192.168.50.85."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.29.101.45 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.29.101.0.0.0.255 area 0\naccess-list 112 deny ip 192.168.33.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.29.101.45/24 (up)", "Routing: OSPF enabled on 10.29.101.0/24 area 0", "ACL 112: deny traffic from 192.168.33.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.29.101.45/24 is up, and ACL 112 denys traffic from 192.168.33.172."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.155.85.13 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.155.85.0.0.0.255 area 0\naccess-list 109 permit ip 192.168.226.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.155.85.13/24 (down)", "Routing: OSPF enabled on 10.155.85.0/24 area 0", "ACL 109: permit traffic from 192.168.226.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.155.85.13/24 is down, and ACL 109 permits traffic from 192.168.226.185."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.123.113.8 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.123.1130.0.0.255 area 0\naccess-list 169 deny ip 192.168.184.110 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.123.113.8/24 (down)", "Routing: OSPF enabled on 10.123.1130/24 area 0", "ACL 169: deny traffic from 192.168.184.110"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.123.113.8/24 is down, and ACL 169 denys traffic from 192.168.184.110."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.140.118.9 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.140.1180.0.0.255 area 0\naccess-list 191 permit ip 192.168.124.166 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.140.118.9/24 (down)", "Routing: OSPF enabled on 10.140.1180/24 area 0", "ACL 191: permit traffic from 192.168.124.166"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.140.118.9/24 is down, and ACL 191 permits traffic from 192.168.124.166."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.149.127.110 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.149.127.10.0.0.255 area 0\naccess-list 132 permit ip 192.168.78.1 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.149.127.110/24 (up)", "Routing: OSPF enabled on 10.149.127.10/24 area 0", "ACL 132: permit traffic from 192.168.78.1"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.149.127.110/24 is up, and ACL 132 permits traffic from 192.168.78.1."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.18.75.113 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.18.75.10.0.0.255 area 0\naccess-list 130 deny ip 192.168.245.43 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.18.75.113/24 (down)", "Routing: OSPF enabled on 10.18.75.10/24 area 0", "ACL 130: deny traffic from 192.168.245.43"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.18.75.113/24 is down, and ACL 130 denys traffic from 192.168.245.43."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.7.156.144 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.7.156.10.0.0.255 area 0\naccess-list 128 deny ip 192.168.109.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.7.156.144/24 (up)", "Routing: OSPF enabled on 10.7.156.10/24 area 0", "ACL 128: deny traffic from 192.168.109.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.7.156.144/24 is up, and ACL 128 denys traffic from 192.168.109.154."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.105.7.23 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.105.7.0.0.0.255 area 0\naccess-list 123 deny ip 192.168.190.215 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.105.7.23/24 (down)", "Routing: OSPF enabled on 10.105.7.0/24 area 0", "ACL 123: deny traffic from 192.168.190.215"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.105.7.23/24 is down, and ACL 123 denys traffic from 192.168.190.215."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.133.47.227 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.133.47.20.0.0.255 area 0\naccess-list 107 permit ip 192.168.129.122 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.133.47.227/24 (down)", "Routing: OSPF enabled on 10.133.47.20/24 area 0", "ACL 107: permit traffic from 192.168.129.122"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.133.47.227/24 is down, and ACL 107 permits traffic from 192.168.129.122."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.47.233.179 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.47.233.10.0.0.255 area 0\naccess-list 173 deny ip 192.168.187.71 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.47.233.179/24 (down)", "Routing: OSPF enabled on 10.47.233.10/24 area 0", "ACL 173: deny traffic from 192.168.187.71"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.47.233.179/24 is down, and ACL 173 denys traffic from 192.168.187.71."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.148.3.33 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.148.3.0.0.0.255 area 0\naccess-list 193 deny ip 192.168.247.167 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.148.3.33/24 (up)", "Routing: OSPF enabled on 10.148.3.0/24 area 0", "ACL 193: deny traffic from 192.168.247.167"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.148.3.33/24 is up, and ACL 193 denys traffic from 192.168.247.167."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.3.168.61 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.3.168.0.0.0.255 area 0\naccess-list 132 permit ip 192.168.148.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.3.168.61/24 (down)", "Routing: OSPF enabled on 10.3.168.0/24 area 0", "ACL 132: permit traffic from 192.168.148.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.3.168.61/24 is down, and ACL 132 permits traffic from 192.168.148.116."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.35.164.193 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.35.164.10.0.0.255 area 0\naccess-list 101 permit ip 192.168.246.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.35.164.193/24 (down)", "Routing: OSPF enabled on 10.35.164.10/24 area 0", "ACL 101: permit traffic from 192.168.246.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.35.164.193/24 is down, and ACL 101 permits traffic from 192.168.246.113."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.54.192.225 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.54.192.20.0.0.255 area 0\naccess-list 195 permit ip 192.168.70.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.54.192.225/24 (down)", "Routing: OSPF enabled on 10.54.192.20/24 area 0", "ACL 195: permit traffic from 192.168.70.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.54.192.225/24 is down, and ACL 195 permits traffic from 192.168.70.154."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.138.190.56 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.138.190.0.0.0.255 area 0\naccess-list 160 deny ip 192.168.104.112 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.138.190.56/24 (down)", "Routing: OSPF enabled on 10.138.190.0/24 area 0", "ACL 160: deny traffic from 192.168.104.112"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.138.190.56/24 is down, and ACL 160 denys traffic from 192.168.104.112."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.237.217.236 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.237.217.20.0.0.255 area 0\naccess-list 152 permit ip 192.168.13.179 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.237.217.236/24 (down)", "Routing: OSPF enabled on 10.237.217.20/24 area 0", "ACL 152: permit traffic from 192.168.13.179"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.237.217.236/24 is down, and ACL 152 permits traffic from 192.168.13.179."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.128.139.154 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.128.139.10.0.0.255 area 0\naccess-list 122 deny ip 192.168.248.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.128.139.154/24 (down)", "Routing: OSPF enabled on 10.128.139.10/24 area 0", "ACL 122: deny traffic from 192.168.248.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.128.139.154/24 is down, and ACL 122 denys traffic from 192.168.248.245."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.169.1.3 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.169.10.0.0.255 area 0\naccess-list 150 deny ip 192.168.137.171 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.169.1.3/24 (up)", "Routing: OSPF enabled on 10.169.10/24 area 0", "ACL 150: deny traffic from 192.168.137.171"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.169.1.3/24 is up, and ACL 150 denys traffic from 192.168.137.171."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.124.129.227 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.124.129.20.0.0.255 area 0\naccess-list 194 deny ip 192.168.129.226 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.124.129.227/24 (up)", "Routing: OSPF enabled on 10.124.129.20/24 area 0", "ACL 194: deny traffic from 192.168.129.226"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.124.129.227/24 is up, and ACL 194 denys traffic from 192.168.129.226."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.244.91.186 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.244.91.10.0.0.255 area 0\naccess-list 174 deny ip 192.168.216.156 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.244.91.186/24 (up)", "Routing: OSPF enabled on 10.244.91.10/24 area 0", "ACL 174: deny traffic from 192.168.216.156"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.244.91.186/24 is up, and ACL 174 denys traffic from 192.168.216.156."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.237.207.225 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.237.207.20.0.0.255 area 0\naccess-list 129 deny ip 192.168.61.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.237.207.225/24 (down)", "Routing: OSPF enabled on 10.237.207.20/24 area 0", "ACL 129: deny traffic from 192.168.61.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.237.207.225/24 is down, and ACL 129 denys traffic from 192.168.61.148."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.70.102.241 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.70.102.20.0.0.255 area 0\naccess-list 125 deny ip 192.168.251.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.70.102.241/24 (up)", "Routing: OSPF enabled on 10.70.102.20/24 area 0", "ACL 125: deny traffic from 192.168.251.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.70.102.241/24 is up, and ACL 125 denys traffic from 192.168.251.245."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.252.27.36 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.252.27.0.0.0.255 area 0\naccess-list 147 deny ip 192.168.14.219 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.252.27.36/24 (up)", "Routing: OSPF enabled on 10.252.27.0/24 area 0", "ACL 147: deny traffic from 192.168.14.219"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.252.27.36/24 is up, and ACL 147 denys traffic from 192.168.14.219."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.62.156.49 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.62.156.0.0.0.255 area 0\naccess-list 184 permit ip 192.168.60.249 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.62.156.49/24 (down)", "Routing: OSPF enabled on 10.62.156.0/24 area 0", "ACL 184: permit traffic from 192.168.60.249"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.62.156.49/24 is down, and ACL 184 permits traffic from 192.168.60.249."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.5.51.27 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.5.51.0.0.0.255 area 0\naccess-list 178 permit ip 192.168.155.8 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.5.51.27/24 (down)", "Routing: OSPF enabled on 10.5.51.0/24 area 0", "ACL 178: permit traffic from 192.168.155.8"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.5.51.27/24 is down, and ACL 178 permits traffic from 192.168.155.8."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.13.190.97 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.13.190.0.0.0.255 area 0\naccess-list 154 permit ip 192.168.53.207 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.13.190.97/24 (up)", "Routing: OSPF enabled on 10.13.190.0/24 area 0", "ACL 154: permit traffic from 192.168.53.207"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.13.190.97/24 is up, and ACL 154 permits traffic from 192.168.53.207."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.101.14.45 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.101.14.0.0.0.255 area 0\naccess-list 133 deny ip 192.168.81.200 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.101.14.45/24 (down)", "Routing: OSPF enabled on 10.101.14.0/24 area 0", "ACL 133: deny traffic from 192.168.81.200"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.101.14.45/24 is down, and ACL 133 denys traffic from 192.168.81.200."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.171.250.121 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.171.250.10.0.0.255 area 0\naccess-list 189 permit ip 192.168.189.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.171.250.121/24 (up)", "Routing: OSPF enabled on 10.171.250.10/24 area 0", "ACL 189: permit traffic from 192.168.189.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.171.250.121/24 is up, and ACL 189 permits traffic from 192.168.189.242."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.9.132.37 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.9.132.0.0.0.255 area 0\naccess-list 111 deny ip 192.168.202.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.9.132.37/24 (up)", "Routing: OSPF enabled on 10.9.132.0/24 area 0", "ACL 111: deny traffic from 192.168.202.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.9.132.37/24 is up, and ACL 111 denys traffic from 192.168.202.238."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.85.17.104 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.85.17.10.0.0.255 area 0\naccess-list 170 deny ip 192.168.26.125 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.85.17.104/24 (up)", "Routing: OSPF enabled on 10.85.17.10/24 area 0", "ACL 170: deny traffic from 192.168.26.125"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.85.17.104/24 is up, and ACL 170 denys traffic from 192.168.26.125."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.54.204.9 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.54.2040.0.0.255 area 0\naccess-list 102 deny ip 192.168.185.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.54.204.9/24 (down)", "Routing: OSPF enabled on 10.54.2040/24 area 0", "ACL 102: deny traffic from 192.168.185.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.54.204.9/24 is down, and ACL 102 denys traffic from 192.168.185.77."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.53.143.53 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.53.143.0.0.0.255 area 0\naccess-list 160 permit ip 192.168.111.227 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.53.143.53/24 (down)", "Routing: OSPF enabled on 10.53.143.0/24 area 0", "ACL 160: permit traffic from 192.168.111.227"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.53.143.53/24 is down, and ACL 160 permits traffic from 192.168.111.227."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.186.3.140 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.186.3.10.0.0.255 area 0\naccess-list 126 permit ip 192.168.39.218 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.186.3.140/24 (up)", "Routing: OSPF enabled on 10.186.3.10/24 area 0", "ACL 126: permit traffic from 192.168.39.218"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.186.3.140/24 is up, and ACL 126 permits traffic from 192.168.39.218."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.173.3.117 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.173.3.10.0.0.255 area 0\naccess-list 132 permit ip 192.168.21.91 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.173.3.117/24 (up)", "Routing: OSPF enabled on 10.173.3.10/24 area 0", "ACL 132: permit traffic from 192.168.21.91"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.173.3.117/24 is up, and ACL 132 permits traffic from 192.168.21.91."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.226.235.207 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.226.235.20.0.0.255 area 0\naccess-list 163 deny ip 192.168.154.190 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.226.235.207/24 (down)", "Routing: OSPF enabled on 10.226.235.20/24 area 0", "ACL 163: deny traffic from 192.168.154.190"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.226.235.207/24 is down, and ACL 163 denys traffic from 192.168.154.190."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.198.99.74 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.198.99.0.0.0.255 area 0\naccess-list 103 deny ip 192.168.20.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.198.99.74/24 (up)", "Routing: OSPF enabled on 10.198.99.0/24 area 0", "ACL 103: deny traffic from 192.168.20.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.198.99.74/24 is up, and ACL 103 denys traffic from 192.168.20.254."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.27.63.104 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.27.63.10.0.0.255 area 0\naccess-list 107 permit ip 192.168.235.130 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.27.63.104/24 (up)", "Routing: OSPF enabled on 10.27.63.10/24 area 0", "ACL 107: permit traffic from 192.168.235.130"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.27.63.104/24 is up, and ACL 107 permits traffic from 192.168.235.130."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.179.58.219 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.179.58.20.0.0.255 area 0\naccess-list 143 deny ip 192.168.162.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.179.58.219/24 (down)", "Routing: OSPF enabled on 10.179.58.20/24 area 0", "ACL 143: deny traffic from 192.168.162.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.179.58.219/24 is down, and ACL 143 denys traffic from 192.168.162.192."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.192.61.137 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.192.61.10.0.0.255 area 0\naccess-list 152 permit ip 192.168.234.42 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.192.61.137/24 (up)", "Routing: OSPF enabled on 10.192.61.10/24 area 0", "ACL 152: permit traffic from 192.168.234.42"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.192.61.137/24 is up, and ACL 152 permits traffic from 192.168.234.42."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.76.157.174 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.76.157.10.0.0.255 area 0\naccess-list 194 deny ip 192.168.131.51 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.76.157.174/24 (down)", "Routing: OSPF enabled on 10.76.157.10/24 area 0", "ACL 194: deny traffic from 192.168.131.51"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.76.157.174/24 is down, and ACL 194 denys traffic from 192.168.131.51."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.179.209.242 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.179.209.20.0.0.255 area 0\naccess-list 101 deny ip 192.168.141.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.179.209.242/24 (down)", "Routing: OSPF enabled on 10.179.209.20/24 area 0", "ACL 101: deny traffic from 192.168.141.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.179.209.242/24 is down, and ACL 101 denys traffic from 192.168.141.220."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.233.133.192 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.233.133.10.0.0.255 area 0\naccess-list 127 deny ip 192.168.83.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.233.133.192/24 (down)", "Routing: OSPF enabled on 10.233.133.10/24 area 0", "ACL 127: deny traffic from 192.168.83.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.233.133.192/24 is down, and ACL 127 denys traffic from 192.168.83.59."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.102.93.93 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.102.93.0.0.0.255 area 0\naccess-list 100 deny ip 192.168.111.63 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.102.93.93/24 (down)", "Routing: OSPF enabled on 10.102.93.0/24 area 0", "ACL 100: deny traffic from 192.168.111.63"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.102.93.93/24 is down, and ACL 100 denys traffic from 192.168.111.63."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.240.114.76 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.240.114.0.0.0.255 area 0\naccess-list 176 deny ip 192.168.189.116 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.240.114.76/24 (down)", "Routing: OSPF enabled on 10.240.114.0/24 area 0", "ACL 176: deny traffic from 192.168.189.116"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.240.114.76/24 is down, and ACL 176 denys traffic from 192.168.189.116."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.75.162.86 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.75.162.0.0.0.255 area 0\naccess-list 195 permit ip 192.168.233.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.75.162.86/24 (down)", "Routing: OSPF enabled on 10.75.162.0/24 area 0", "ACL 195: permit traffic from 192.168.233.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.75.162.86/24 is down, and ACL 195 permits traffic from 192.168.233.49."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.89.210.225 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.89.210.20.0.0.255 area 0\naccess-list 158 permit ip 192.168.63.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.89.210.225/24 (down)", "Routing: OSPF enabled on 10.89.210.20/24 area 0", "ACL 158: permit traffic from 192.168.63.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.89.210.225/24 is down, and ACL 158 permits traffic from 192.168.63.251."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.76.179.127 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.76.179.10.0.0.255 area 0\naccess-list 195 deny ip 192.168.3.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.76.179.127/24 (down)", "Routing: OSPF enabled on 10.76.179.10/24 area 0", "ACL 195: deny traffic from 192.168.3.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.76.179.127/24 is down, and ACL 195 denys traffic from 192.168.3.206."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.43.175.53 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.43.175.0.0.0.255 area 0\naccess-list 181 permit ip 192.168.200.170 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.43.175.53/24 (down)", "Routing: OSPF enabled on 10.43.175.0/24 area 0", "ACL 181: permit traffic from 192.168.200.170"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.43.175.53/24 is down, and ACL 181 permits traffic from 192.168.200.170."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.7.175.238 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.7.175.20.0.0.255 area 0\naccess-list 197 deny ip 192.168.227.201 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.7.175.238/24 (down)", "Routing: OSPF enabled on 10.7.175.20/24 area 0", "ACL 197: deny traffic from 192.168.227.201"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.7.175.238/24 is down, and ACL 197 denys traffic from 192.168.227.201."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.119.45.26 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.119.45.0.0.0.255 area 0\naccess-list 127 deny ip 192.168.55.8 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.119.45.26/24 (up)", "Routing: OSPF enabled on 10.119.45.0/24 area 0", "ACL 127: deny traffic from 192.168.55.8"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.119.45.26/24 is up, and ACL 127 denys traffic from 192.168.55.8."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.61.250.99 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.61.250.0.0.0.255 area 0\naccess-list 198 permit ip 192.168.217.217 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.61.250.99/24 (up)", "Routing: OSPF enabled on 10.61.250.0/24 area 0", "ACL 198: permit traffic from 192.168.217.217"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.61.250.99/24 is up, and ACL 198 permits traffic from 192.168.217.217."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.26.113.187 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.26.113.10.0.0.255 area 0\naccess-list 169 deny ip 192.168.34.209 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.26.113.187/24 (up)", "Routing: OSPF enabled on 10.26.113.10/24 area 0", "ACL 169: deny traffic from 192.168.34.209"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.26.113.187/24 is up, and ACL 169 denys traffic from 192.168.34.209."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.48.74.201 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.48.74.20.0.0.255 area 0\naccess-list 150 deny ip 192.168.228.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.48.74.201/24 (up)", "Routing: OSPF enabled on 10.48.74.20/24 area 0", "ACL 150: deny traffic from 192.168.228.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.48.74.201/24 is up, and ACL 150 denys traffic from 192.168.228.245."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.171.194.238 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.171.194.20.0.0.255 area 0\naccess-list 179 permit ip 192.168.236.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.171.194.238/24 (up)", "Routing: OSPF enabled on 10.171.194.20/24 area 0", "ACL 179: permit traffic from 192.168.236.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.171.194.238/24 is up, and ACL 179 permits traffic from 192.168.236.160."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.206.154.122 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.206.154.10.0.0.255 area 0\naccess-list 168 deny ip 192.168.3.35 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.206.154.122/24 (up)", "Routing: OSPF enabled on 10.206.154.10/24 area 0", "ACL 168: deny traffic from 192.168.3.35"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.206.154.122/24 is up, and ACL 168 denys traffic from 192.168.3.35."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.126.62.253 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.126.62.20.0.0.255 area 0\naccess-list 155 deny ip 192.168.152.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.126.62.253/24 (up)", "Routing: OSPF enabled on 10.126.62.20/24 area 0", "ACL 155: deny traffic from 192.168.152.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.126.62.253/24 is up, and ACL 155 denys traffic from 192.168.152.9."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.73.54.135 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.73.54.10.0.0.255 area 0\naccess-list 138 permit ip 192.168.38.76 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.73.54.135/24 (up)", "Routing: OSPF enabled on 10.73.54.10/24 area 0", "ACL 138: permit traffic from 192.168.38.76"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.73.54.135/24 is up, and ACL 138 permits traffic from 192.168.38.76."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.148.224.19 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.148.224.0.0.0.255 area 0\naccess-list 118 permit ip 192.168.46.188 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.148.224.19/24 (down)", "Routing: OSPF enabled on 10.148.224.0/24 area 0", "ACL 118: permit traffic from 192.168.46.188"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.148.224.19/24 is down, and ACL 118 permits traffic from 192.168.46.188."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.63.33.28 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.63.33.0.0.0.255 area 0\naccess-list 164 deny ip 192.168.229.188 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.63.33.28/24 (down)", "Routing: OSPF enabled on 10.63.33.0/24 area 0", "ACL 164: deny traffic from 192.168.229.188"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.63.33.28/24 is down, and ACL 164 denys traffic from 192.168.229.188."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.224.32.74 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.224.32.0.0.0.255 area 0\naccess-list 115 permit ip 192.168.79.226 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.224.32.74/24 (down)", "Routing: OSPF enabled on 10.224.32.0/24 area 0", "ACL 115: permit traffic from 192.168.79.226"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.224.32.74/24 is down, and ACL 115 permits traffic from 192.168.79.226."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.226.138.201 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.226.138.20.0.0.255 area 0\naccess-list 179 permit ip 192.168.244.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.226.138.201/24 (down)", "Routing: OSPF enabled on 10.226.138.20/24 area 0", "ACL 179: permit traffic from 192.168.244.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.226.138.201/24 is down, and ACL 179 permits traffic from 192.168.244.20."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.205.108.129 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.205.108.10.0.0.255 area 0\naccess-list 143 permit ip 192.168.216.187 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.205.108.129/24 (up)", "Routing: OSPF enabled on 10.205.108.10/24 area 0", "ACL 143: permit traffic from 192.168.216.187"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.205.108.129/24 is up, and ACL 143 permits traffic from 192.168.216.187."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.110.43.12 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.110.43.0.0.0.255 area 0\naccess-list 186 deny ip 192.168.32.12 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.110.43.12/24 (down)", "Routing: OSPF enabled on 10.110.43.0/24 area 0", "ACL 186: deny traffic from 192.168.32.12"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.110.43.12/24 is down, and ACL 186 denys traffic from 192.168.32.12."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.89.171.136 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.89.171.10.0.0.255 area 0\naccess-list 186 permit ip 192.168.0.198 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.89.171.136/24 (down)", "Routing: OSPF enabled on 10.89.171.10/24 area 0", "ACL 186: permit traffic from 192.168.0.198"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.89.171.136/24 is down, and ACL 186 permits traffic from 192.168.0.198."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.131.186.197 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.131.186.10.0.0.255 area 0\naccess-list 154 permit ip 192.168.74.55 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.131.186.197/24 (up)", "Routing: OSPF enabled on 10.131.186.10/24 area 0", "ACL 154: permit traffic from 192.168.74.55"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.131.186.197/24 is up, and ACL 154 permits traffic from 192.168.74.55."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.199.101.30 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.199.101.0.0.0.255 area 0\naccess-list 130 permit ip 192.168.90.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.199.101.30/24 (down)", "Routing: OSPF enabled on 10.199.101.0/24 area 0", "ACL 130: permit traffic from 192.168.90.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.199.101.30/24 is down, and ACL 130 permits traffic from 192.168.90.254."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.165.87.125 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.165.87.10.0.0.255 area 0\naccess-list 139 deny ip 192.168.9.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.165.87.125/24 (up)", "Routing: OSPF enabled on 10.165.87.10/24 area 0", "ACL 139: deny traffic from 192.168.9.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.165.87.125/24 is up, and ACL 139 denys traffic from 192.168.9.148."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.101.85.132 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.101.85.10.0.0.255 area 0\naccess-list 128 permit ip 192.168.115.239 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.101.85.132/24 (up)", "Routing: OSPF enabled on 10.101.85.10/24 area 0", "ACL 128: permit traffic from 192.168.115.239"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.101.85.132/24 is up, and ACL 128 permits traffic from 192.168.115.239."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.1.254.252 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.1.254.20.0.0.255 area 0\naccess-list 138 permit ip 192.168.110.72 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.1.254.252/24 (up)", "Routing: OSPF enabled on 10.1.254.20/24 area 0", "ACL 138: permit traffic from 192.168.110.72"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.1.254.252/24 is up, and ACL 138 permits traffic from 192.168.110.72."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.179.191.102 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.179.191.10.0.0.255 area 0\naccess-list 190 permit ip 192.168.12.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.179.191.102/24 (down)", "Routing: OSPF enabled on 10.179.191.10/24 area 0", "ACL 190: permit traffic from 192.168.12.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.179.191.102/24 is down, and ACL 190 permits traffic from 192.168.12.146."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.107.179.116 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.107.179.10.0.0.255 area 0\naccess-list 119 permit ip 192.168.178.80 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.107.179.116/24 (down)", "Routing: OSPF enabled on 10.107.179.10/24 area 0", "ACL 119: permit traffic from 192.168.178.80"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.107.179.116/24 is down, and ACL 119 permits traffic from 192.168.178.80."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.217.41.40 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.217.41.0.0.0.255 area 0\naccess-list 135 deny ip 192.168.36.18 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.217.41.40/24 (down)", "Routing: OSPF enabled on 10.217.41.0/24 area 0", "ACL 135: deny traffic from 192.168.36.18"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.217.41.40/24 is down, and ACL 135 denys traffic from 192.168.36.18."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.231.140.163 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.231.140.10.0.0.255 area 0\naccess-list 153 deny ip 192.168.46.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.231.140.163/24 (down)", "Routing: OSPF enabled on 10.231.140.10/24 area 0", "ACL 153: deny traffic from 192.168.46.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.231.140.163/24 is down, and ACL 153 denys traffic from 192.168.46.136."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.215.140.99 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.215.140.0.0.0.255 area 0\naccess-list 126 deny ip 192.168.40.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.215.140.99/24 (up)", "Routing: OSPF enabled on 10.215.140.0/24 area 0", "ACL 126: deny traffic from 192.168.40.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.215.140.99/24 is up, and ACL 126 denys traffic from 192.168.40.105."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.135.1.115 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.135.1.10.0.0.255 area 0\naccess-list 162 deny ip 192.168.100.35 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.135.1.115/24 (up)", "Routing: OSPF enabled on 10.135.1.10/24 area 0", "ACL 162: deny traffic from 192.168.100.35"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.135.1.115/24 is up, and ACL 162 denys traffic from 192.168.100.35."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.196.146.247 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.196.146.20.0.0.255 area 0\naccess-list 157 permit ip 192.168.105.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.196.146.247/24 (down)", "Routing: OSPF enabled on 10.196.146.20/24 area 0", "ACL 157: permit traffic from 192.168.105.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.196.146.247/24 is down, and ACL 157 permits traffic from 192.168.105.134."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.204.99.46 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.204.99.0.0.0.255 area 0\naccess-list 171 deny ip 192.168.216.110 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.204.99.46/24 (up)", "Routing: OSPF enabled on 10.204.99.0/24 area 0", "ACL 171: deny traffic from 192.168.216.110"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.204.99.46/24 is up, and ACL 171 denys traffic from 192.168.216.110."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.26.119.78 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.26.119.0.0.0.255 area 0\naccess-list 155 permit ip 192.168.119.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.26.119.78/24 (down)", "Routing: OSPF enabled on 10.26.119.0/24 area 0", "ACL 155: permit traffic from 192.168.119.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.26.119.78/24 is down, and ACL 155 permits traffic from 192.168.119.94."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.119.153.22 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.119.153.0.0.0.255 area 0\naccess-list 142 deny ip 192.168.210.167 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.119.153.22/24 (up)", "Routing: OSPF enabled on 10.119.153.0/24 area 0", "ACL 142: deny traffic from 192.168.210.167"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.119.153.22/24 is up, and ACL 142 denys traffic from 192.168.210.167."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.246.14.84 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.246.14.0.0.0.255 area 0\naccess-list 168 permit ip 192.168.247.123 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.246.14.84/24 (down)", "Routing: OSPF enabled on 10.246.14.0/24 area 0", "ACL 168: permit traffic from 192.168.247.123"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.246.14.84/24 is down, and ACL 168 permits traffic from 192.168.247.123."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.47.49.43 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.47.49.0.0.0.255 area 0\naccess-list 163 permit ip 192.168.11.184 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.47.49.43/24 (up)", "Routing: OSPF enabled on 10.47.49.0/24 area 0", "ACL 163: permit traffic from 192.168.11.184"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.47.49.43/24 is up, and ACL 163 permits traffic from 192.168.11.184."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.11.181.5 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.11.1810.0.0.255 area 0\naccess-list 171 deny ip 192.168.10.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.11.181.5/24 (up)", "Routing: OSPF enabled on 10.11.1810/24 area 0", "ACL 171: deny traffic from 192.168.10.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.11.181.5/24 is up, and ACL 171 denys traffic from 192.168.10.129."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.190.238.70 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.190.238.0.0.0.255 area 0\naccess-list 138 deny ip 192.168.206.6 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.190.238.70/24 (up)", "Routing: OSPF enabled on 10.190.238.0/24 area 0", "ACL 138: deny traffic from 192.168.206.6"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.190.238.70/24 is up, and ACL 138 denys traffic from 192.168.206.6."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.230.92.199 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.230.92.10.0.0.255 area 0\naccess-list 173 deny ip 192.168.136.96 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.230.92.199/24 (up)", "Routing: OSPF enabled on 10.230.92.10/24 area 0", "ACL 173: deny traffic from 192.168.136.96"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.230.92.199/24 is up, and ACL 173 denys traffic from 192.168.136.96."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.63.47.139 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.63.47.10.0.0.255 area 0\naccess-list 123 permit ip 192.168.168.181 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.63.47.139/24 (down)", "Routing: OSPF enabled on 10.63.47.10/24 area 0", "ACL 123: permit traffic from 192.168.168.181"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.63.47.139/24 is down, and ACL 123 permits traffic from 192.168.168.181."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.34.196.224 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.34.196.20.0.0.255 area 0\naccess-list 101 permit ip 192.168.38.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.34.196.224/24 (down)", "Routing: OSPF enabled on 10.34.196.20/24 area 0", "ACL 101: permit traffic from 192.168.38.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.34.196.224/24 is down, and ACL 101 permits traffic from 192.168.38.242."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.153.250.128 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.153.250.10.0.0.255 area 0\naccess-list 191 permit ip 192.168.88.235 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.153.250.128/24 (up)", "Routing: OSPF enabled on 10.153.250.10/24 area 0", "ACL 191: permit traffic from 192.168.88.235"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.153.250.128/24 is up, and ACL 191 permits traffic from 192.168.88.235."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.45.63.238 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.45.63.20.0.0.255 area 0\naccess-list 190 permit ip 192.168.234.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.45.63.238/24 (up)", "Routing: OSPF enabled on 10.45.63.20/24 area 0", "ACL 190: permit traffic from 192.168.234.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.45.63.238/24 is up, and ACL 190 permits traffic from 192.168.234.77."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.70.118.210 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.70.118.20.0.0.255 area 0\naccess-list 103 permit ip 192.168.32.90 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.70.118.210/24 (up)", "Routing: OSPF enabled on 10.70.118.20/24 area 0", "ACL 103: permit traffic from 192.168.32.90"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.70.118.210/24 is up, and ACL 103 permits traffic from 192.168.32.90."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.133.52.240 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.133.52.20.0.0.255 area 0\naccess-list 186 deny ip 192.168.65.219 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.133.52.240/24 (up)", "Routing: OSPF enabled on 10.133.52.20/24 area 0", "ACL 186: deny traffic from 192.168.65.219"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.133.52.240/24 is up, and ACL 186 denys traffic from 192.168.65.219."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.40.39.35 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.40.39.0.0.0.255 area 0\naccess-list 108 deny ip 192.168.12.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.40.39.35/24 (down)", "Routing: OSPF enabled on 10.40.39.0/24 area 0", "ACL 108: deny traffic from 192.168.12.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.40.39.35/24 is down, and ACL 108 denys traffic from 192.168.12.134."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.117.164.252 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.117.164.20.0.0.255 area 0\naccess-list 140 deny ip 192.168.245.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.117.164.252/24 (down)", "Routing: OSPF enabled on 10.117.164.20/24 area 0", "ACL 140: deny traffic from 192.168.245.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.117.164.252/24 is down, and ACL 140 denys traffic from 192.168.245.77."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.73.168.10 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.73.168.0.0.0.255 area 0\naccess-list 142 deny ip 192.168.168.82 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.73.168.10/24 (down)", "Routing: OSPF enabled on 10.73.168.0/24 area 0", "ACL 142: deny traffic from 192.168.168.82"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.73.168.10/24 is down, and ACL 142 denys traffic from 192.168.168.82."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.134.133.194 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.134.133.10.0.0.255 area 0\naccess-list 174 deny ip 192.168.169.247 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.134.133.194/24 (down)", "Routing: OSPF enabled on 10.134.133.10/24 area 0", "ACL 174: deny traffic from 192.168.169.247"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.134.133.194/24 is down, and ACL 174 denys traffic from 192.168.169.247."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.143.236.169 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.143.236.10.0.0.255 area 0\naccess-list 179 permit ip 192.168.118.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.143.236.169/24 (down)", "Routing: OSPF enabled on 10.143.236.10/24 area 0", "ACL 179: permit traffic from 192.168.118.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.143.236.169/24 is down, and ACL 179 permits traffic from 192.168.118.245."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.129.248.145 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.129.248.10.0.0.255 area 0\naccess-list 164 permit ip 192.168.151.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.129.248.145/24 (up)", "Routing: OSPF enabled on 10.129.248.10/24 area 0", "ACL 164: permit traffic from 192.168.151.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.129.248.145/24 is up, and ACL 164 permits traffic from 192.168.151.109."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.63.32.184 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.63.32.10.0.0.255 area 0\naccess-list 153 permit ip 192.168.213.195 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.63.32.184/24 (up)", "Routing: OSPF enabled on 10.63.32.10/24 area 0", "ACL 153: permit traffic from 192.168.213.195"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.63.32.184/24 is up, and ACL 153 permits traffic from 192.168.213.195."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.164.137.129 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.164.137.10.0.0.255 area 0\naccess-list 176 deny ip 192.168.159.165 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.164.137.129/24 (down)", "Routing: OSPF enabled on 10.164.137.10/24 area 0", "ACL 176: deny traffic from 192.168.159.165"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.164.137.129/24 is down, and ACL 176 denys traffic from 192.168.159.165."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.222.195.101 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.222.195.10.0.0.255 area 0\naccess-list 174 permit ip 192.168.215.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.222.195.101/24 (down)", "Routing: OSPF enabled on 10.222.195.10/24 area 0", "ACL 174: permit traffic from 192.168.215.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.222.195.101/24 is down, and ACL 174 permits traffic from 192.168.215.20."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.248.151.169 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.248.151.10.0.0.255 area 0\naccess-list 145 deny ip 192.168.14.241 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.248.151.169/24 (down)", "Routing: OSPF enabled on 10.248.151.10/24 area 0", "ACL 145: deny traffic from 192.168.14.241"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.248.151.169/24 is down, and ACL 145 denys traffic from 192.168.14.241."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.242.86.55 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.242.86.0.0.0.255 area 0\naccess-list 150 deny ip 192.168.217.73 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.242.86.55/24 (up)", "Routing: OSPF enabled on 10.242.86.0/24 area 0", "ACL 150: deny traffic from 192.168.217.73"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.242.86.55/24 is up, and ACL 150 denys traffic from 192.168.217.73."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.135.82.29 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.135.82.0.0.0.255 area 0\naccess-list 111 permit ip 192.168.173.218 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.135.82.29/24 (down)", "Routing: OSPF enabled on 10.135.82.0/24 area 0", "ACL 111: permit traffic from 192.168.173.218"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.135.82.29/24 is down, and ACL 111 permits traffic from 192.168.173.218."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.56.136.50 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.56.136.0.0.0.255 area 0\naccess-list 111 permit ip 192.168.57.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.56.136.50/24 (down)", "Routing: OSPF enabled on 10.56.136.0/24 area 0", "ACL 111: permit traffic from 192.168.57.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.56.136.50/24 is down, and ACL 111 permits traffic from 192.168.57.25."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.3.180.11 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.3.180.0.0.0.255 area 0\naccess-list 167 permit ip 192.168.181.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.3.180.11/24 (down)", "Routing: OSPF enabled on 10.3.180.0/24 area 0", "ACL 167: permit traffic from 192.168.181.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.3.180.11/24 is down, and ACL 167 permits traffic from 192.168.181.134."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.2.143.35 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.2.143.0.0.0.255 area 0\naccess-list 152 permit ip 192.168.35.5 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.2.143.35/24 (down)", "Routing: OSPF enabled on 10.2.143.0/24 area 0", "ACL 152: permit traffic from 192.168.35.5"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.2.143.35/24 is down, and ACL 152 permits traffic from 192.168.35.5."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.30.9.237 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.30.9.20.0.0.255 area 0\naccess-list 146 permit ip 192.168.116.187 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.30.9.237/24 (up)", "Routing: OSPF enabled on 10.30.9.20/24 area 0", "ACL 146: permit traffic from 192.168.116.187"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.30.9.237/24 is up, and ACL 146 permits traffic from 192.168.116.187."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.26.26.138 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.26.26.10.0.0.255 area 0\naccess-list 153 permit ip 192.168.213.224 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.26.26.138/24 (up)", "Routing: OSPF enabled on 10.26.26.10/24 area 0", "ACL 153: permit traffic from 192.168.213.224"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.26.26.138/24 is up, and ACL 153 permits traffic from 192.168.213.224."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.201.224.164 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.201.224.10.0.0.255 area 0\naccess-list 128 permit ip 192.168.246.175 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.201.224.164/24 (up)", "Routing: OSPF enabled on 10.201.224.10/24 area 0", "ACL 128: permit traffic from 192.168.246.175"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.201.224.164/24 is up, and ACL 128 permits traffic from 192.168.246.175."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.25.137.188 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.25.137.10.0.0.255 area 0\naccess-list 173 permit ip 192.168.109.215 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.25.137.188/24 (down)", "Routing: OSPF enabled on 10.25.137.10/24 area 0", "ACL 173: permit traffic from 192.168.109.215"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.25.137.188/24 is down, and ACL 173 permits traffic from 192.168.109.215."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.216.236.105 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.216.236.10.0.0.255 area 0\naccess-list 116 permit ip 192.168.210.33 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.216.236.105/24 (down)", "Routing: OSPF enabled on 10.216.236.10/24 area 0", "ACL 116: permit traffic from 192.168.210.33"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.216.236.105/24 is down, and ACL 116 permits traffic from 192.168.210.33."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.172.54.214 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.172.54.20.0.0.255 area 0\naccess-list 150 permit ip 192.168.87.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.172.54.214/24 (down)", "Routing: OSPF enabled on 10.172.54.20/24 area 0", "ACL 150: permit traffic from 192.168.87.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.172.54.214/24 is down, and ACL 150 permits traffic from 192.168.87.251."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.16.55.231 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.16.55.20.0.0.255 area 0\naccess-list 190 deny ip 192.168.255.209 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.16.55.231/24 (down)", "Routing: OSPF enabled on 10.16.55.20/24 area 0", "ACL 190: deny traffic from 192.168.255.209"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.16.55.231/24 is down, and ACL 190 denys traffic from 192.168.255.209."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.192.2.188 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.192.2.10.0.0.255 area 0\naccess-list 194 deny ip 192.168.51.151 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.192.2.188/24 (down)", "Routing: OSPF enabled on 10.192.2.10/24 area 0", "ACL 194: deny traffic from 192.168.51.151"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.192.2.188/24 is down, and ACL 194 denys traffic from 192.168.51.151."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.57.130.77 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.57.130.0.0.0.255 area 0\naccess-list 165 deny ip 192.168.213.51 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.57.130.77/24 (up)", "Routing: OSPF enabled on 10.57.130.0/24 area 0", "ACL 165: deny traffic from 192.168.213.51"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.57.130.77/24 is up, and ACL 165 denys traffic from 192.168.213.51."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.225.123.43 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.225.123.0.0.0.255 area 0\naccess-list 120 deny ip 192.168.158.122 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.225.123.43/24 (up)", "Routing: OSPF enabled on 10.225.123.0/24 area 0", "ACL 120: deny traffic from 192.168.158.122"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.225.123.43/24 is up, and ACL 120 denys traffic from 192.168.158.122."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.61.162.251 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.61.162.20.0.0.255 area 0\naccess-list 133 permit ip 192.168.232.98 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.61.162.251/24 (down)", "Routing: OSPF enabled on 10.61.162.20/24 area 0", "ACL 133: permit traffic from 192.168.232.98"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.61.162.251/24 is down, and ACL 133 permits traffic from 192.168.232.98."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.104.90.93 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.104.90.0.0.0.255 area 0\naccess-list 164 deny ip 192.168.29.164 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.104.90.93/24 (up)", "Routing: OSPF enabled on 10.104.90.0/24 area 0", "ACL 164: deny traffic from 192.168.29.164"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.104.90.93/24 is up, and ACL 164 denys traffic from 192.168.29.164."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.20.144.131 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.20.144.10.0.0.255 area 0\naccess-list 185 deny ip 192.168.173.93 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.20.144.131/24 (up)", "Routing: OSPF enabled on 10.20.144.10/24 area 0", "ACL 185: deny traffic from 192.168.173.93"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.20.144.131/24 is up, and ACL 185 denys traffic from 192.168.173.93."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.161.243.155 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.161.243.10.0.0.255 area 0\naccess-list 118 permit ip 192.168.39.36 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.161.243.155/24 (up)", "Routing: OSPF enabled on 10.161.243.10/24 area 0", "ACL 118: permit traffic from 192.168.39.36"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.161.243.155/24 is up, and ACL 118 permits traffic from 192.168.39.36."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.41.93.247 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.41.93.20.0.0.255 area 0\naccess-list 159 permit ip 192.168.244.165 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.41.93.247/24 (down)", "Routing: OSPF enabled on 10.41.93.20/24 area 0", "ACL 159: permit traffic from 192.168.244.165"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.41.93.247/24 is down, and ACL 159 permits traffic from 192.168.244.165."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.199.60.72 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.199.60.0.0.0.255 area 0\naccess-list 166 deny ip 192.168.129.147 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.199.60.72/24 (down)", "Routing: OSPF enabled on 10.199.60.0/24 area 0", "ACL 166: deny traffic from 192.168.129.147"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.199.60.72/24 is down, and ACL 166 denys traffic from 192.168.129.147."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.177.43.223 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.177.43.20.0.0.255 area 0\naccess-list 121 permit ip 192.168.190.124 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.177.43.223/24 (up)", "Routing: OSPF enabled on 10.177.43.20/24 area 0", "ACL 121: permit traffic from 192.168.190.124"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.177.43.223/24 is up, and ACL 121 permits traffic from 192.168.190.124."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.194.80.174 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.194.80.10.0.0.255 area 0\naccess-list 148 permit ip 192.168.80.102 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.194.80.174/24 (down)", "Routing: OSPF enabled on 10.194.80.10/24 area 0", "ACL 148: permit traffic from 192.168.80.102"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.194.80.174/24 is down, and ACL 148 permits traffic from 192.168.80.102."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.10.67.250 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.10.67.20.0.0.255 area 0\naccess-list 170 deny ip 192.168.206.217 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.10.67.250/24 (down)", "Routing: OSPF enabled on 10.10.67.20/24 area 0", "ACL 170: deny traffic from 192.168.206.217"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.10.67.250/24 is down, and ACL 170 denys traffic from 192.168.206.217."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.22.9.93 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.22.9.0.0.0.255 area 0\naccess-list 173 permit ip 192.168.65.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.22.9.93/24 (down)", "Routing: OSPF enabled on 10.22.9.0/24 area 0", "ACL 173: permit traffic from 192.168.65.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.22.9.93/24 is down, and ACL 173 permits traffic from 192.168.65.192."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.190.76.251 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.190.76.20.0.0.255 area 0\naccess-list 140 deny ip 192.168.52.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.190.76.251/24 (down)", "Routing: OSPF enabled on 10.190.76.20/24 area 0", "ACL 140: deny traffic from 192.168.52.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.190.76.251/24 is down, and ACL 140 denys traffic from 192.168.52.220."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.148.71.6 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.148.710.0.0.255 area 0\naccess-list 168 deny ip 192.168.77.81 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.148.71.6/24 (down)", "Routing: OSPF enabled on 10.148.710/24 area 0", "ACL 168: deny traffic from 192.168.77.81"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.148.71.6/24 is down, and ACL 168 denys traffic from 192.168.77.81."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.10.64.167 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.10.64.10.0.0.255 area 0\naccess-list 191 permit ip 192.168.58.65 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.10.64.167/24 (down)", "Routing: OSPF enabled on 10.10.64.10/24 area 0", "ACL 191: permit traffic from 192.168.58.65"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.10.64.167/24 is down, and ACL 191 permits traffic from 192.168.58.65."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.167.197.227 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.167.197.20.0.0.255 area 0\naccess-list 121 permit ip 192.168.246.164 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.167.197.227/24 (down)", "Routing: OSPF enabled on 10.167.197.20/24 area 0", "ACL 121: permit traffic from 192.168.246.164"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.167.197.227/24 is down, and ACL 121 permits traffic from 192.168.246.164."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.100.147.118 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.100.147.10.0.0.255 area 0\naccess-list 155 permit ip 192.168.41.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.100.147.118/24 (down)", "Routing: OSPF enabled on 10.100.147.10/24 area 0", "ACL 155: permit traffic from 192.168.41.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.100.147.118/24 is down, and ACL 155 permits traffic from 192.168.41.251."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.229.142.166 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.229.142.10.0.0.255 area 0\naccess-list 193 permit ip 192.168.2.50 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.229.142.166/24 (up)", "Routing: OSPF enabled on 10.229.142.10/24 area 0", "ACL 193: permit traffic from 192.168.2.50"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.229.142.166/24 is up, and ACL 193 permits traffic from 192.168.2.50."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.239.154.129 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.239.154.10.0.0.255 area 0\naccess-list 154 deny ip 192.168.205.122 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.239.154.129/24 (down)", "Routing: OSPF enabled on 10.239.154.10/24 area 0", "ACL 154: deny traffic from 192.168.205.122"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.239.154.129/24 is down, and ACL 154 denys traffic from 192.168.205.122."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.111.88.106 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.111.88.10.0.0.255 area 0\naccess-list 102 deny ip 192.168.62.95 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.111.88.106/24 (down)", "Routing: OSPF enabled on 10.111.88.10/24 area 0", "ACL 102: deny traffic from 192.168.62.95"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.111.88.106/24 is down, and ACL 102 denys traffic from 192.168.62.95."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.193.218.21 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.193.218.0.0.0.255 area 0\naccess-list 197 permit ip 192.168.183.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.193.218.21/24 (down)", "Routing: OSPF enabled on 10.193.218.0/24 area 0", "ACL 197: permit traffic from 192.168.183.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.193.218.21/24 is down, and ACL 197 permits traffic from 192.168.183.9."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.131.255.81 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.131.255.0.0.0.255 area 0\naccess-list 191 deny ip 192.168.117.170 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.131.255.81/24 (down)", "Routing: OSPF enabled on 10.131.255.0/24 area 0", "ACL 191: deny traffic from 192.168.117.170"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.131.255.81/24 is down, and ACL 191 denys traffic from 192.168.117.170."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.18.41.180 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.18.41.10.0.0.255 area 0\naccess-list 120 deny ip 192.168.244.104 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.18.41.180/24 (up)", "Routing: OSPF enabled on 10.18.41.10/24 area 0", "ACL 120: deny traffic from 192.168.244.104"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.18.41.180/24 is up, and ACL 120 denys traffic from 192.168.244.104."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.217.121.141 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.217.121.10.0.0.255 area 0\naccess-list 132 deny ip 192.168.66.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.217.121.141/24 (down)", "Routing: OSPF enabled on 10.217.121.10/24 area 0", "ACL 132: deny traffic from 192.168.66.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.217.121.141/24 is down, and ACL 132 denys traffic from 192.168.66.186."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.7.210.171 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.7.210.10.0.0.255 area 0\naccess-list 167 permit ip 192.168.72.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.7.210.171/24 (down)", "Routing: OSPF enabled on 10.7.210.10/24 area 0", "ACL 167: permit traffic from 192.168.72.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.7.210.171/24 is down, and ACL 167 permits traffic from 192.168.72.191."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.73.35.64 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.73.35.0.0.0.255 area 0\naccess-list 156 deny ip 192.168.247.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.73.35.64/24 (up)", "Routing: OSPF enabled on 10.73.35.0/24 area 0", "ACL 156: deny traffic from 192.168.247.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.73.35.64/24 is up, and ACL 156 denys traffic from 192.168.247.11."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.12.205.163 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.12.205.10.0.0.255 area 0\naccess-list 111 deny ip 192.168.20.39 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.12.205.163/24 (down)", "Routing: OSPF enabled on 10.12.205.10/24 area 0", "ACL 111: deny traffic from 192.168.20.39"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.12.205.163/24 is down, and ACL 111 denys traffic from 192.168.20.39."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.8.133.82 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.8.133.0.0.0.255 area 0\naccess-list 118 permit ip 192.168.14.15 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.8.133.82/24 (down)", "Routing: OSPF enabled on 10.8.133.0/24 area 0", "ACL 118: permit traffic from 192.168.14.15"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.8.133.82/24 is down, and ACL 118 permits traffic from 192.168.14.15."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.82.128.147 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.82.128.10.0.0.255 area 0\naccess-list 174 permit ip 192.168.250.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.82.128.147/24 (down)", "Routing: OSPF enabled on 10.82.128.10/24 area 0", "ACL 174: permit traffic from 192.168.250.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.82.128.147/24 is down, and ACL 174 permits traffic from 192.168.250.59."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.160.251.103 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.160.251.10.0.0.255 area 0\naccess-list 192 deny ip 192.168.153.105 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.160.251.103/24 (up)", "Routing: OSPF enabled on 10.160.251.10/24 area 0", "ACL 192: deny traffic from 192.168.153.105"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.160.251.103/24 is up, and ACL 192 denys traffic from 192.168.153.105."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.132.56.207 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.132.56.20.0.0.255 area 0\naccess-list 134 deny ip 192.168.11.211 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.132.56.207/24 (down)", "Routing: OSPF enabled on 10.132.56.20/24 area 0", "ACL 134: deny traffic from 192.168.11.211"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.132.56.207/24 is down, and ACL 134 denys traffic from 192.168.11.211."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.136.223.127 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.136.223.10.0.0.255 area 0\naccess-list 195 deny ip 192.168.128.14 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.136.223.127/24 (down)", "Routing: OSPF enabled on 10.136.223.10/24 area 0", "ACL 195: deny traffic from 192.168.128.14"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.136.223.127/24 is down, and ACL 195 denys traffic from 192.168.128.14."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.106.241.168 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.106.241.10.0.0.255 area 0\naccess-list 126 deny ip 192.168.84.195 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.106.241.168/24 (up)", "Routing: OSPF enabled on 10.106.241.10/24 area 0", "ACL 126: deny traffic from 192.168.84.195"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.106.241.168/24 is up, and ACL 126 denys traffic from 192.168.84.195."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.153.141.109 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.153.141.10.0.0.255 area 0\naccess-list 113 deny ip 192.168.208.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.153.141.109/24 (up)", "Routing: OSPF enabled on 10.153.141.10/24 area 0", "ACL 113: deny traffic from 192.168.208.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.153.141.109/24 is up, and ACL 113 denys traffic from 192.168.208.245."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.122.91.25 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.122.91.0.0.0.255 area 0\naccess-list 123 permit ip 192.168.1.44 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.122.91.25/24 (up)", "Routing: OSPF enabled on 10.122.91.0/24 area 0", "ACL 123: permit traffic from 192.168.1.44"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.122.91.25/24 is up, and ACL 123 permits traffic from 192.168.1.44."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.89.189.103 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.89.189.10.0.0.255 area 0\naccess-list 196 deny ip 192.168.56.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.89.189.103/24 (up)", "Routing: OSPF enabled on 10.89.189.10/24 area 0", "ACL 196: deny traffic from 192.168.56.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.89.189.103/24 is up, and ACL 196 denys traffic from 192.168.56.126."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.233.104.44 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.233.104.0.0.0.255 area 0\naccess-list 148 deny ip 192.168.225.87 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.233.104.44/24 (down)", "Routing: OSPF enabled on 10.233.104.0/24 area 0", "ACL 148: deny traffic from 192.168.225.87"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.233.104.44/24 is down, and ACL 148 denys traffic from 192.168.225.87."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.45.148.14 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.45.148.0.0.0.255 area 0\naccess-list 153 deny ip 192.168.52.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.45.148.14/24 (down)", "Routing: OSPF enabled on 10.45.148.0/24 area 0", "ACL 153: deny traffic from 192.168.52.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.45.148.14/24 is down, and ACL 153 denys traffic from 192.168.52.129."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.75.95.189 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.75.95.10.0.0.255 area 0\naccess-list 129 deny ip 192.168.128.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.75.95.189/24 (down)", "Routing: OSPF enabled on 10.75.95.10/24 area 0", "ACL 129: deny traffic from 192.168.128.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.75.95.189/24 is down, and ACL 129 denys traffic from 192.168.128.121."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.84.76.115 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.84.76.10.0.0.255 area 0\naccess-list 182 permit ip 192.168.78.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.84.76.115/24 (up)", "Routing: OSPF enabled on 10.84.76.10/24 area 0", "ACL 182: permit traffic from 192.168.78.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.84.76.115/24 is up, and ACL 182 permits traffic from 192.168.78.92."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.72.253.222 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.72.253.20.0.0.255 area 0\naccess-list 101 deny ip 192.168.218.103 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.72.253.222/24 (up)", "Routing: OSPF enabled on 10.72.253.20/24 area 0", "ACL 101: deny traffic from 192.168.218.103"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.72.253.222/24 is up, and ACL 101 denys traffic from 192.168.218.103."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.131.91.190 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.131.91.10.0.0.255 area 0\naccess-list 128 deny ip 192.168.171.2 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.131.91.190/24 (down)", "Routing: OSPF enabled on 10.131.91.10/24 area 0", "ACL 128: deny traffic from 192.168.171.2"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.131.91.190/24 is down, and ACL 128 denys traffic from 192.168.171.2."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.229.237.243 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.229.237.20.0.0.255 area 0\naccess-list 117 deny ip 192.168.140.217 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.229.237.243/24 (down)", "Routing: OSPF enabled on 10.229.237.20/24 area 0", "ACL 117: deny traffic from 192.168.140.217"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.229.237.243/24 is down, and ACL 117 denys traffic from 192.168.140.217."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.100.137.126 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.100.137.10.0.0.255 area 0\naccess-list 102 deny ip 192.168.111.211 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.100.137.126/24 (down)", "Routing: OSPF enabled on 10.100.137.10/24 area 0", "ACL 102: deny traffic from 192.168.111.211"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.100.137.126/24 is down, and ACL 102 denys traffic from 192.168.111.211."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.162.222.158 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.162.222.10.0.0.255 area 0\naccess-list 154 permit ip 192.168.85.80 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.162.222.158/24 (up)", "Routing: OSPF enabled on 10.162.222.10/24 area 0", "ACL 154: permit traffic from 192.168.85.80"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.162.222.158/24 is up, and ACL 154 permits traffic from 192.168.85.80."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.18.84.152 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.18.84.10.0.0.255 area 0\naccess-list 101 permit ip 192.168.88.34 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.18.84.152/24 (down)", "Routing: OSPF enabled on 10.18.84.10/24 area 0", "ACL 101: permit traffic from 192.168.88.34"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.18.84.152/24 is down, and ACL 101 permits traffic from 192.168.88.34."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.206.208.26 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.206.208.0.0.0.255 area 0\naccess-list 135 permit ip 192.168.47.45 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.206.208.26/24 (down)", "Routing: OSPF enabled on 10.206.208.0/24 area 0", "ACL 135: permit traffic from 192.168.47.45"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.206.208.26/24 is down, and ACL 135 permits traffic from 192.168.47.45."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.71.154.198 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.71.154.10.0.0.255 area 0\naccess-list 194 permit ip 192.168.196.142 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.71.154.198/24 (down)", "Routing: OSPF enabled on 10.71.154.10/24 area 0", "ACL 194: permit traffic from 192.168.196.142"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.71.154.198/24 is down, and ACL 194 permits traffic from 192.168.196.142."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.9.140.218 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.9.140.20.0.0.255 area 0\naccess-list 142 deny ip 192.168.64.226 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.9.140.218/24 (down)", "Routing: OSPF enabled on 10.9.140.20/24 area 0", "ACL 142: deny traffic from 192.168.64.226"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.9.140.218/24 is down, and ACL 142 denys traffic from 192.168.64.226."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.144.101.38 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.144.101.0.0.0.255 area 0\naccess-list 146 deny ip 192.168.171.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.144.101.38/24 (up)", "Routing: OSPF enabled on 10.144.101.0/24 area 0", "ACL 146: deny traffic from 192.168.171.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.144.101.38/24 is up, and ACL 146 denys traffic from 192.168.171.199."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.88.205.132 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.88.205.10.0.0.255 area 0\naccess-list 163 deny ip 192.168.96.2 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.88.205.132/24 (down)", "Routing: OSPF enabled on 10.88.205.10/24 area 0", "ACL 163: deny traffic from 192.168.96.2"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.88.205.132/24 is down, and ACL 163 denys traffic from 192.168.96.2."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.116.17.32 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.116.17.0.0.0.255 area 0\naccess-list 184 deny ip 192.168.23.12 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.116.17.32/24 (up)", "Routing: OSPF enabled on 10.116.17.0/24 area 0", "ACL 184: deny traffic from 192.168.23.12"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.116.17.32/24 is up, and ACL 184 denys traffic from 192.168.23.12."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.228.30.87 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.228.30.0.0.0.255 area 0\naccess-list 103 permit ip 192.168.60.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.228.30.87/24 (down)", "Routing: OSPF enabled on 10.228.30.0/24 area 0", "ACL 103: permit traffic from 192.168.60.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.228.30.87/24 is down, and ACL 103 permits traffic from 192.168.60.136."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.68.74.12 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.68.74.0.0.0.255 area 0\naccess-list 169 permit ip 192.168.229.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.68.74.12/24 (up)", "Routing: OSPF enabled on 10.68.74.0/24 area 0", "ACL 169: permit traffic from 192.168.229.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.68.74.12/24 is up, and ACL 169 permits traffic from 192.168.229.192."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.41.100.246 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.41.100.20.0.0.255 area 0\naccess-list 111 deny ip 192.168.181.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.41.100.246/24 (up)", "Routing: OSPF enabled on 10.41.100.20/24 area 0", "ACL 111: deny traffic from 192.168.181.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.41.100.246/24 is up, and ACL 111 denys traffic from 192.168.181.49."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.238.175.117 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.238.175.10.0.0.255 area 0\naccess-list 185 deny ip 192.168.248.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.238.175.117/24 (down)", "Routing: OSPF enabled on 10.238.175.10/24 area 0", "ACL 185: deny traffic from 192.168.248.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.238.175.117/24 is down, and ACL 185 denys traffic from 192.168.248.254."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.173.43.235 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.173.43.20.0.0.255 area 0\naccess-list 138 deny ip 192.168.124.219 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.173.43.235/24 (down)", "Routing: OSPF enabled on 10.173.43.20/24 area 0", "ACL 138: deny traffic from 192.168.124.219"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.173.43.235/24 is down, and ACL 138 denys traffic from 192.168.124.219."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.239.76.68 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.239.76.0.0.0.255 area 0\naccess-list 117 permit ip 192.168.135.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.239.76.68/24 (down)", "Routing: OSPF enabled on 10.239.76.0/24 area 0", "ACL 117: permit traffic from 192.168.135.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.239.76.68/24 is down, and ACL 117 permits traffic from 192.168.135.193."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.245.25.64 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.245.25.0.0.0.255 area 0\naccess-list 101 permit ip 192.168.8.235 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.245.25.64/24 (down)", "Routing: OSPF enabled on 10.245.25.0/24 area 0", "ACL 101: permit traffic from 192.168.8.235"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.245.25.64/24 is down, and ACL 101 permits traffic from 192.168.8.235."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.90.16.115 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.90.16.10.0.0.255 area 0\naccess-list 150 permit ip 192.168.67.6 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.90.16.115/24 (down)", "Routing: OSPF enabled on 10.90.16.10/24 area 0", "ACL 150: permit traffic from 192.168.67.6"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.90.16.115/24 is down, and ACL 150 permits traffic from 192.168.67.6."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.60.186.201 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.60.186.20.0.0.255 area 0\naccess-list 194 permit ip 192.168.123.1 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.60.186.201/24 (down)", "Routing: OSPF enabled on 10.60.186.20/24 area 0", "ACL 194: permit traffic from 192.168.123.1"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.60.186.201/24 is down, and ACL 194 permits traffic from 192.168.123.1."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.27.118.164 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.27.118.10.0.0.255 area 0\naccess-list 192 permit ip 192.168.192.71 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.27.118.164/24 (up)", "Routing: OSPF enabled on 10.27.118.10/24 area 0", "ACL 192: permit traffic from 192.168.192.71"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.27.118.164/24 is up, and ACL 192 permits traffic from 192.168.192.71."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.194.81.248 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.194.81.20.0.0.255 area 0\naccess-list 131 permit ip 192.168.188.231 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.194.81.248/24 (up)", "Routing: OSPF enabled on 10.194.81.20/24 area 0", "ACL 131: permit traffic from 192.168.188.231"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.194.81.248/24 is up, and ACL 131 permits traffic from 192.168.188.231."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.60.177.96 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.60.177.0.0.0.255 area 0\naccess-list 134 permit ip 192.168.98.171 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.60.177.96/24 (up)", "Routing: OSPF enabled on 10.60.177.0/24 area 0", "ACL 134: permit traffic from 192.168.98.171"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.60.177.96/24 is up, and ACL 134 permits traffic from 192.168.98.171."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.9.50.66 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.9.50.0.0.0.255 area 0\naccess-list 117 deny ip 192.168.171.189 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.9.50.66/24 (up)", "Routing: OSPF enabled on 10.9.50.0/24 area 0", "ACL 117: deny traffic from 192.168.171.189"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.9.50.66/24 is up, and ACL 117 denys traffic from 192.168.171.189."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.82.232.58 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.82.232.0.0.0.255 area 0\naccess-list 193 deny ip 192.168.194.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.82.232.58/24 (down)", "Routing: OSPF enabled on 10.82.232.0/24 area 0", "ACL 193: deny traffic from 192.168.194.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.82.232.58/24 is down, and ACL 193 denys traffic from 192.168.194.208."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.137.237.112 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.137.237.10.0.0.255 area 0\naccess-list 177 deny ip 192.168.244.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.137.237.112/24 (down)", "Routing: OSPF enabled on 10.137.237.10/24 area 0", "ACL 177: deny traffic from 192.168.244.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.137.237.112/24 is down, and ACL 177 denys traffic from 192.168.244.238."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.214.63.137 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.214.63.10.0.0.255 area 0\naccess-list 115 permit ip 192.168.36.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.214.63.137/24 (up)", "Routing: OSPF enabled on 10.214.63.10/24 area 0", "ACL 115: permit traffic from 192.168.36.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.214.63.137/24 is up, and ACL 115 permits traffic from 192.168.36.37."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.41.167.144 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.41.167.10.0.0.255 area 0\naccess-list 197 deny ip 192.168.221.197 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.41.167.144/24 (up)", "Routing: OSPF enabled on 10.41.167.10/24 area 0", "ACL 197: deny traffic from 192.168.221.197"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.41.167.144/24 is up, and ACL 197 denys traffic from 192.168.221.197."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.244.195.231 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.244.195.20.0.0.255 area 0\naccess-list 129 deny ip 192.168.191.223 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.244.195.231/24 (down)", "Routing: OSPF enabled on 10.244.195.20/24 area 0", "ACL 129: deny traffic from 192.168.191.223"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.244.195.231/24 is down, and ACL 129 denys traffic from 192.168.191.223."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.214.246.180 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.214.246.10.0.0.255 area 0\naccess-list 142 deny ip 192.168.232.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.214.246.180/24 (down)", "Routing: OSPF enabled on 10.214.246.10/24 area 0", "ACL 142: deny traffic from 192.168.232.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.214.246.180/24 is down, and ACL 142 denys traffic from 192.168.232.92."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.17.152.250 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.17.152.20.0.0.255 area 0\naccess-list 198 deny ip 192.168.82.202 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.17.152.250/24 (down)", "Routing: OSPF enabled on 10.17.152.20/24 area 0", "ACL 198: deny traffic from 192.168.82.202"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.17.152.250/24 is down, and ACL 198 denys traffic from 192.168.82.202."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.164.126.78 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.164.126.0.0.0.255 area 0\naccess-list 191 deny ip 192.168.13.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.164.126.78/24 (up)", "Routing: OSPF enabled on 10.164.126.0/24 area 0", "ACL 191: deny traffic from 192.168.13.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.164.126.78/24 is up, and ACL 191 denys traffic from 192.168.13.108."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.109.252.51 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.109.252.0.0.0.255 area 0\naccess-list 130 deny ip 192.168.91.182 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.109.252.51/24 (up)", "Routing: OSPF enabled on 10.109.252.0/24 area 0", "ACL 130: deny traffic from 192.168.91.182"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.109.252.51/24 is up, and ACL 130 denys traffic from 192.168.91.182."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.98.175.28 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.98.175.0.0.0.255 area 0\naccess-list 146 permit ip 192.168.127.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.98.175.28/24 (up)", "Routing: OSPF enabled on 10.98.175.0/24 area 0", "ACL 146: permit traffic from 192.168.127.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.98.175.28/24 is up, and ACL 146 permits traffic from 192.168.127.222."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.150.126.5 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.150.1260.0.0.255 area 0\naccess-list 130 permit ip 192.168.112.231 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.150.126.5/24 (up)", "Routing: OSPF enabled on 10.150.1260/24 area 0", "ACL 130: permit traffic from 192.168.112.231"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.150.126.5/24 is up, and ACL 130 permits traffic from 192.168.112.231."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.158.185.231 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.158.185.20.0.0.255 area 0\naccess-list 157 deny ip 192.168.89.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.158.185.231/24 (down)", "Routing: OSPF enabled on 10.158.185.20/24 area 0", "ACL 157: deny traffic from 192.168.89.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.158.185.231/24 is down, and ACL 157 denys traffic from 192.168.89.117."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.78.189.30 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.78.189.0.0.0.255 area 0\naccess-list 184 deny ip 192.168.78.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.78.189.30/24 (down)", "Routing: OSPF enabled on 10.78.189.0/24 area 0", "ACL 184: deny traffic from 192.168.78.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.78.189.30/24 is down, and ACL 184 denys traffic from 192.168.78.172."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.178.69.132 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.178.69.10.0.0.255 area 0\naccess-list 189 permit ip 192.168.6.247 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.178.69.132/24 (down)", "Routing: OSPF enabled on 10.178.69.10/24 area 0", "ACL 189: permit traffic from 192.168.6.247"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.178.69.132/24 is down, and ACL 189 permits traffic from 192.168.6.247."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.8.60.247 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.8.60.20.0.0.255 area 0\naccess-list 144 permit ip 192.168.113.91 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.8.60.247/24 (down)", "Routing: OSPF enabled on 10.8.60.20/24 area 0", "ACL 144: permit traffic from 192.168.113.91"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.8.60.247/24 is down, and ACL 144 permits traffic from 192.168.113.91."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.233.49.246 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.233.49.20.0.0.255 area 0\naccess-list 196 deny ip 192.168.69.137 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.233.49.246/24 (down)", "Routing: OSPF enabled on 10.233.49.20/24 area 0", "ACL 196: deny traffic from 192.168.69.137"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.233.49.246/24 is down, and ACL 196 denys traffic from 192.168.69.137."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.1.235.219 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.1.235.20.0.0.255 area 0\naccess-list 187 permit ip 192.168.231.140 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.1.235.219/24 (down)", "Routing: OSPF enabled on 10.1.235.20/24 area 0", "ACL 187: permit traffic from 192.168.231.140"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.1.235.219/24 is down, and ACL 187 permits traffic from 192.168.231.140."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.252.78.232 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.252.78.20.0.0.255 area 0\naccess-list 158 deny ip 192.168.221.99 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.252.78.232/24 (up)", "Routing: OSPF enabled on 10.252.78.20/24 area 0", "ACL 158: deny traffic from 192.168.221.99"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.252.78.232/24 is up, and ACL 158 denys traffic from 192.168.221.99."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.134.80.249 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.134.80.20.0.0.255 area 0\naccess-list 180 permit ip 192.168.56.98 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.134.80.249/24 (down)", "Routing: OSPF enabled on 10.134.80.20/24 area 0", "ACL 180: permit traffic from 192.168.56.98"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.134.80.249/24 is down, and ACL 180 permits traffic from 192.168.56.98."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.41.246.223 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.41.246.20.0.0.255 area 0\naccess-list 171 permit ip 192.168.54.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.41.246.223/24 (down)", "Routing: OSPF enabled on 10.41.246.20/24 area 0", "ACL 171: permit traffic from 192.168.54.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.41.246.223/24 is down, and ACL 171 permits traffic from 192.168.54.121."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.44.50.87 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.44.50.0.0.0.255 area 0\naccess-list 188 permit ip 192.168.166.150 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.44.50.87/24 (up)", "Routing: OSPF enabled on 10.44.50.0/24 area 0", "ACL 188: permit traffic from 192.168.166.150"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.44.50.87/24 is up, and ACL 188 permits traffic from 192.168.166.150."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.26.164.45 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.26.164.0.0.0.255 area 0\naccess-list 138 deny ip 192.168.100.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.26.164.45/24 (up)", "Routing: OSPF enabled on 10.26.164.0/24 area 0", "ACL 138: deny traffic from 192.168.100.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.26.164.45/24 is up, and ACL 138 denys traffic from 192.168.100.108."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.28.86.138 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.28.86.10.0.0.255 area 0\naccess-list 133 deny ip 192.168.209.30 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.28.86.138/24 (up)", "Routing: OSPF enabled on 10.28.86.10/24 area 0", "ACL 133: deny traffic from 192.168.209.30"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.28.86.138/24 is up, and ACL 133 denys traffic from 192.168.209.30."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.34.255.42 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.34.255.0.0.0.255 area 0\naccess-list 159 permit ip 192.168.120.159 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.34.255.42/24 (up)", "Routing: OSPF enabled on 10.34.255.0/24 area 0", "ACL 159: permit traffic from 192.168.120.159"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.34.255.42/24 is up, and ACL 159 permits traffic from 192.168.120.159."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.161.208.71 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.161.208.0.0.0.255 area 0\naccess-list 189 deny ip 192.168.56.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.161.208.71/24 (down)", "Routing: OSPF enabled on 10.161.208.0/24 area 0", "ACL 189: deny traffic from 192.168.56.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.161.208.71/24 is down, and ACL 189 denys traffic from 192.168.56.136."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.243.125.189 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.243.125.10.0.0.255 area 0\naccess-list 170 permit ip 192.168.65.224 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.243.125.189/24 (down)", "Routing: OSPF enabled on 10.243.125.10/24 area 0", "ACL 170: permit traffic from 192.168.65.224"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.243.125.189/24 is down, and ACL 170 permits traffic from 192.168.65.224."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.82.2.224 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.82.2.20.0.0.255 area 0\naccess-list 126 permit ip 192.168.219.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.82.2.224/24 (down)", "Routing: OSPF enabled on 10.82.2.20/24 area 0", "ACL 126: permit traffic from 192.168.219.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.82.2.224/24 is down, and ACL 126 permits traffic from 192.168.219.193."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.3.236.232 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.3.236.20.0.0.255 area 0\naccess-list 113 deny ip 192.168.162.19 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.3.236.232/24 (down)", "Routing: OSPF enabled on 10.3.236.20/24 area 0", "ACL 113: deny traffic from 192.168.162.19"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.3.236.232/24 is down, and ACL 113 denys traffic from 192.168.162.19."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.161.25.189 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.161.25.10.0.0.255 area 0\naccess-list 106 permit ip 192.168.222.132 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.161.25.189/24 (down)", "Routing: OSPF enabled on 10.161.25.10/24 area 0", "ACL 106: permit traffic from 192.168.222.132"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.161.25.189/24 is down, and ACL 106 permits traffic from 192.168.222.132."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.146.116.131 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.146.116.10.0.0.255 area 0\naccess-list 100 deny ip 192.168.195.137 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.146.116.131/24 (up)", "Routing: OSPF enabled on 10.146.116.10/24 area 0", "ACL 100: deny traffic from 192.168.195.137"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.146.116.131/24 is up, and ACL 100 denys traffic from 192.168.195.137."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.215.184.169 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.215.184.10.0.0.255 area 0\naccess-list 187 permit ip 192.168.120.96 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.215.184.169/24 (down)", "Routing: OSPF enabled on 10.215.184.10/24 area 0", "ACL 187: permit traffic from 192.168.120.96"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.215.184.169/24 is down, and ACL 187 permits traffic from 192.168.120.96."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.19.153.254 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.19.153.20.0.0.255 area 0\naccess-list 109 permit ip 192.168.225.182 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.19.153.254/24 (up)", "Routing: OSPF enabled on 10.19.153.20/24 area 0", "ACL 109: permit traffic from 192.168.225.182"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.19.153.254/24 is up, and ACL 109 permits traffic from 192.168.225.182."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.45.208.221 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.45.208.20.0.0.255 area 0\naccess-list 107 permit ip 192.168.28.109 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.45.208.221/24 (up)", "Routing: OSPF enabled on 10.45.208.20/24 area 0", "ACL 107: permit traffic from 192.168.28.109"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.45.208.221/24 is up, and ACL 107 permits traffic from 192.168.28.109."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.1.62.146 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.1.62.10.0.0.255 area 0\naccess-list 112 permit ip 192.168.173.161 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.1.62.146/24 (up)", "Routing: OSPF enabled on 10.1.62.10/24 area 0", "ACL 112: permit traffic from 192.168.173.161"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.1.62.146/24 is up, and ACL 112 permits traffic from 192.168.173.161."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.120.141.72 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.120.141.0.0.0.255 area 0\naccess-list 134 deny ip 192.168.98.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.120.141.72/24 (down)", "Routing: OSPF enabled on 10.120.141.0/24 area 0", "ACL 134: deny traffic from 192.168.98.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.120.141.72/24 is down, and ACL 134 denys traffic from 192.168.98.10."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.245.101.252 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.245.101.20.0.0.255 area 0\naccess-list 161 deny ip 192.168.2.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.245.101.252/24 (down)", "Routing: OSPF enabled on 10.245.101.20/24 area 0", "ACL 161: deny traffic from 192.168.2.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.245.101.252/24 is down, and ACL 161 denys traffic from 192.168.2.9."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.6.186.34 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.6.186.0.0.0.255 area 0\naccess-list 111 permit ip 192.168.69.246 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.6.186.34/24 (up)", "Routing: OSPF enabled on 10.6.186.0/24 area 0", "ACL 111: permit traffic from 192.168.69.246"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.6.186.34/24 is up, and ACL 111 permits traffic from 192.168.69.246."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.44.56.66 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.44.56.0.0.0.255 area 0\naccess-list 146 deny ip 192.168.159.179 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.44.56.66/24 (up)", "Routing: OSPF enabled on 10.44.56.0/24 area 0", "ACL 146: deny traffic from 192.168.159.179"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.44.56.66/24 is up, and ACL 146 denys traffic from 192.168.159.179."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.120.234.51 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.120.234.0.0.0.255 area 0\naccess-list 160 permit ip 192.168.13.151 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.120.234.51/24 (down)", "Routing: OSPF enabled on 10.120.234.0/24 area 0", "ACL 160: permit traffic from 192.168.13.151"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.120.234.51/24 is down, and ACL 160 permits traffic from 192.168.13.151."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.235.250.229 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.235.250.20.0.0.255 area 0\naccess-list 131 deny ip 192.168.12.64 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.235.250.229/24 (down)", "Routing: OSPF enabled on 10.235.250.20/24 area 0", "ACL 131: deny traffic from 192.168.12.64"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.235.250.229/24 is down, and ACL 131 denys traffic from 192.168.12.64."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.44.14.160 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.44.14.10.0.0.255 area 0\naccess-list 140 deny ip 192.168.1.66 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.44.14.160/24 (up)", "Routing: OSPF enabled on 10.44.14.10/24 area 0", "ACL 140: deny traffic from 192.168.1.66"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.44.14.160/24 is up, and ACL 140 denys traffic from 192.168.1.66."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.237.38.170 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.237.38.10.0.0.255 area 0\naccess-list 193 deny ip 192.168.88.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.237.38.170/24 (down)", "Routing: OSPF enabled on 10.237.38.10/24 area 0", "ACL 193: deny traffic from 192.168.88.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.237.38.170/24 is down, and ACL 193 denys traffic from 192.168.88.221."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.47.93.90 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.47.93.0.0.0.255 area 0\naccess-list 104 permit ip 192.168.125.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.47.93.90/24 (up)", "Routing: OSPF enabled on 10.47.93.0/24 area 0", "ACL 104: permit traffic from 192.168.125.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.47.93.90/24 is up, and ACL 104 permits traffic from 192.168.125.13."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.97.66.117 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.97.66.10.0.0.255 area 0\naccess-list 189 permit ip 192.168.228.169 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.97.66.117/24 (down)", "Routing: OSPF enabled on 10.97.66.10/24 area 0", "ACL 189: permit traffic from 192.168.228.169"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.97.66.117/24 is down, and ACL 189 permits traffic from 192.168.228.169."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.87.210.26 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.87.210.0.0.0.255 area 0\naccess-list 132 permit ip 192.168.106.228 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.87.210.26/24 (down)", "Routing: OSPF enabled on 10.87.210.0/24 area 0", "ACL 132: permit traffic from 192.168.106.228"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.87.210.26/24 is down, and ACL 132 permits traffic from 192.168.106.228."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.151.112.166 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.151.112.10.0.0.255 area 0\naccess-list 118 deny ip 192.168.253.162 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.151.112.166/24 (down)", "Routing: OSPF enabled on 10.151.112.10/24 area 0", "ACL 118: deny traffic from 192.168.253.162"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.151.112.166/24 is down, and ACL 118 denys traffic from 192.168.253.162."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.150.54.107 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.150.54.10.0.0.255 area 0\naccess-list 175 permit ip 192.168.84.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.150.54.107/24 (down)", "Routing: OSPF enabled on 10.150.54.10/24 area 0", "ACL 175: permit traffic from 192.168.84.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.150.54.107/24 is down, and ACL 175 permits traffic from 192.168.84.172."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.137.121.36 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.137.121.0.0.0.255 area 0\naccess-list 145 deny ip 192.168.178.8 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.137.121.36/24 (up)", "Routing: OSPF enabled on 10.137.121.0/24 area 0", "ACL 145: deny traffic from 192.168.178.8"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.137.121.36/24 is up, and ACL 145 denys traffic from 192.168.178.8."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.132.61.12 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.132.61.0.0.0.255 area 0\naccess-list 135 deny ip 192.168.26.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.132.61.12/24 (down)", "Routing: OSPF enabled on 10.132.61.0/24 area 0", "ACL 135: deny traffic from 192.168.26.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.132.61.12/24 is down, and ACL 135 denys traffic from 192.168.26.113."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.163.83.218 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.163.83.20.0.0.255 area 0\naccess-list 123 permit ip 192.168.110.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.163.83.218/24 (up)", "Routing: OSPF enabled on 10.163.83.20/24 area 0", "ACL 123: permit traffic from 192.168.110.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.163.83.218/24 is up, and ACL 123 permits traffic from 192.168.110.38."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.25.169.118 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.25.169.10.0.0.255 area 0\naccess-list 185 deny ip 192.168.189.246 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.25.169.118/24 (up)", "Routing: OSPF enabled on 10.25.169.10/24 area 0", "ACL 185: deny traffic from 192.168.189.246"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.25.169.118/24 is up, and ACL 185 denys traffic from 192.168.189.246."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.50.1.40 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.50.1.0.0.0.255 area 0\naccess-list 118 permit ip 192.168.183.248 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.50.1.40/24 (up)", "Routing: OSPF enabled on 10.50.1.0/24 area 0", "ACL 118: permit traffic from 192.168.183.248"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.50.1.40/24 is up, and ACL 118 permits traffic from 192.168.183.248."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.160.84.67 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.160.84.0.0.0.255 area 0\naccess-list 185 deny ip 192.168.84.70 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.160.84.67/24 (down)", "Routing: OSPF enabled on 10.160.84.0/24 area 0", "ACL 185: deny traffic from 192.168.84.70"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.160.84.67/24 is down, and ACL 185 denys traffic from 192.168.84.70."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.77.155.67 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.77.155.0.0.0.255 area 0\naccess-list 110 deny ip 192.168.74.225 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.77.155.67/24 (up)", "Routing: OSPF enabled on 10.77.155.0/24 area 0", "ACL 110: deny traffic from 192.168.74.225"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.77.155.67/24 is up, and ACL 110 denys traffic from 192.168.74.225."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.109.145.36 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.109.145.0.0.0.255 area 0\naccess-list 116 deny ip 192.168.106.45 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.109.145.36/24 (up)", "Routing: OSPF enabled on 10.109.145.0/24 area 0", "ACL 116: deny traffic from 192.168.106.45"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.109.145.36/24 is up, and ACL 116 denys traffic from 192.168.106.45."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.123.45.111 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.123.45.10.0.0.255 area 0\naccess-list 114 permit ip 192.168.68.173 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.123.45.111/24 (down)", "Routing: OSPF enabled on 10.123.45.10/24 area 0", "ACL 114: permit traffic from 192.168.68.173"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.123.45.111/24 is down, and ACL 114 permits traffic from 192.168.68.173."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.88.205.173 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.88.205.10.0.0.255 area 0\naccess-list 161 deny ip 192.168.3.210 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.88.205.173/24 (up)", "Routing: OSPF enabled on 10.88.205.10/24 area 0", "ACL 161: deny traffic from 192.168.3.210"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.88.205.173/24 is up, and ACL 161 denys traffic from 192.168.3.210."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.86.204.108 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.86.204.10.0.0.255 area 0\naccess-list 145 deny ip 192.168.50.87 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.86.204.108/24 (up)", "Routing: OSPF enabled on 10.86.204.10/24 area 0", "ACL 145: deny traffic from 192.168.50.87"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.86.204.108/24 is up, and ACL 145 denys traffic from 192.168.50.87."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.1.6.153 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.1.6.10.0.0.255 area 0\naccess-list 115 permit ip 192.168.223.63 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.1.6.153/24 (up)", "Routing: OSPF enabled on 10.1.6.10/24 area 0", "ACL 115: permit traffic from 192.168.223.63"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.1.6.153/24 is up, and ACL 115 permits traffic from 192.168.223.63."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.21.183.231 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.21.183.20.0.0.255 area 0\naccess-list 169 permit ip 192.168.140.252 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.21.183.231/24 (down)", "Routing: OSPF enabled on 10.21.183.20/24 area 0", "ACL 169: permit traffic from 192.168.140.252"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.21.183.231/24 is down, and ACL 169 permits traffic from 192.168.140.252."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.239.198.124 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.239.198.10.0.0.255 area 0\naccess-list 104 permit ip 192.168.122.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.239.198.124/24 (down)", "Routing: OSPF enabled on 10.239.198.10/24 area 0", "ACL 104: permit traffic from 192.168.122.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.239.198.124/24 is down, and ACL 104 permits traffic from 192.168.122.185."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.149.8.152 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.149.8.10.0.0.255 area 0\naccess-list 106 deny ip 192.168.18.177 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.149.8.152/24 (up)", "Routing: OSPF enabled on 10.149.8.10/24 area 0", "ACL 106: deny traffic from 192.168.18.177"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.149.8.152/24 is up, and ACL 106 denys traffic from 192.168.18.177."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.118.141.135 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.118.141.10.0.0.255 area 0\naccess-list 171 deny ip 192.168.191.103 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.118.141.135/24 (down)", "Routing: OSPF enabled on 10.118.141.10/24 area 0", "ACL 171: deny traffic from 192.168.191.103"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.118.141.135/24 is down, and ACL 171 denys traffic from 192.168.191.103."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.38.242.20 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.38.242.0.0.0.255 area 0\naccess-list 130 deny ip 192.168.227.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.38.242.20/24 (down)", "Routing: OSPF enabled on 10.38.242.0/24 area 0", "ACL 130: deny traffic from 192.168.227.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.38.242.20/24 is down, and ACL 130 denys traffic from 192.168.227.94."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.214.92.36 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.214.92.0.0.0.255 area 0\naccess-list 111 deny ip 192.168.5.86 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.214.92.36/24 (down)", "Routing: OSPF enabled on 10.214.92.0/24 area 0", "ACL 111: deny traffic from 192.168.5.86"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.214.92.36/24 is down, and ACL 111 denys traffic from 192.168.5.86."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.0.167.16 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.0.167.0.0.0.255 area 0\naccess-list 161 deny ip 192.168.65.224 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.0.167.16/24 (up)", "Routing: OSPF enabled on 10.0.167.0/24 area 0", "ACL 161: deny traffic from 192.168.65.224"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.0.167.16/24 is up, and ACL 161 denys traffic from 192.168.65.224."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.8.27.122 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.8.27.10.0.0.255 area 0\naccess-list 134 permit ip 192.168.120.90 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.8.27.122/24 (down)", "Routing: OSPF enabled on 10.8.27.10/24 area 0", "ACL 134: permit traffic from 192.168.120.90"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.8.27.122/24 is down, and ACL 134 permits traffic from 192.168.120.90."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.207.57.219 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.207.57.20.0.0.255 area 0\naccess-list 109 deny ip 192.168.1.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.207.57.219/24 (down)", "Routing: OSPF enabled on 10.207.57.20/24 area 0", "ACL 109: deny traffic from 192.168.1.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.207.57.219/24 is down, and ACL 109 denys traffic from 192.168.1.10."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.174.243.30 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.174.243.0.0.0.255 area 0\naccess-list 114 deny ip 192.168.135.144 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.174.243.30/24 (down)", "Routing: OSPF enabled on 10.174.243.0/24 area 0", "ACL 114: deny traffic from 192.168.135.144"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.174.243.30/24 is down, and ACL 114 denys traffic from 192.168.135.144."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.173.233.185 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.173.233.10.0.0.255 area 0\naccess-list 172 permit ip 192.168.165.207 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.173.233.185/24 (down)", "Routing: OSPF enabled on 10.173.233.10/24 area 0", "ACL 172: permit traffic from 192.168.165.207"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.173.233.185/24 is down, and ACL 172 permits traffic from 192.168.165.207."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.98.164.72 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.98.164.0.0.0.255 area 0\naccess-list 183 permit ip 192.168.60.131 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.98.164.72/24 (down)", "Routing: OSPF enabled on 10.98.164.0/24 area 0", "ACL 183: permit traffic from 192.168.60.131"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.98.164.72/24 is down, and ACL 183 permits traffic from 192.168.60.131."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.116.95.110 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.116.95.10.0.0.255 area 0\naccess-list 100 deny ip 192.168.83.219 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.116.95.110/24 (up)", "Routing: OSPF enabled on 10.116.95.10/24 area 0", "ACL 100: deny traffic from 192.168.83.219"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.116.95.110/24 is up, and ACL 100 denys traffic from 192.168.83.219."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.149.245.198 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.149.245.10.0.0.255 area 0\naccess-list 125 deny ip 192.168.68.156 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.149.245.198/24 (down)", "Routing: OSPF enabled on 10.149.245.10/24 area 0", "ACL 125: deny traffic from 192.168.68.156"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.149.245.198/24 is down, and ACL 125 denys traffic from 192.168.68.156."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.19.94.3 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.19.940.0.0.255 area 0\naccess-list 197 permit ip 192.168.247.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.19.94.3/24 (down)", "Routing: OSPF enabled on 10.19.940/24 area 0", "ACL 197: permit traffic from 192.168.247.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.19.94.3/24 is down, and ACL 197 permits traffic from 192.168.247.172."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.196.173.176 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.196.173.10.0.0.255 area 0\naccess-list 180 deny ip 192.168.14.27 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.196.173.176/24 (up)", "Routing: OSPF enabled on 10.196.173.10/24 area 0", "ACL 180: deny traffic from 192.168.14.27"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.196.173.176/24 is up, and ACL 180 denys traffic from 192.168.14.27."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.25.62.196 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.25.62.10.0.0.255 area 0\naccess-list 103 permit ip 192.168.248.207 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.25.62.196/24 (up)", "Routing: OSPF enabled on 10.25.62.10/24 area 0", "ACL 103: permit traffic from 192.168.248.207"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.25.62.196/24 is up, and ACL 103 permits traffic from 192.168.248.207."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.187.138.151 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.187.138.10.0.0.255 area 0\naccess-list 136 permit ip 192.168.137.70 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.187.138.151/24 (up)", "Routing: OSPF enabled on 10.187.138.10/24 area 0", "ACL 136: permit traffic from 192.168.137.70"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.187.138.151/24 is up, and ACL 136 permits traffic from 192.168.137.70."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.24.73.146 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.24.73.10.0.0.255 area 0\naccess-list 183 permit ip 192.168.114.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.24.73.146/24 (up)", "Routing: OSPF enabled on 10.24.73.10/24 area 0", "ACL 183: permit traffic from 192.168.114.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.24.73.146/24 is up, and ACL 183 permits traffic from 192.168.114.136."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.114.153.82 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.114.153.0.0.0.255 area 0\naccess-list 130 permit ip 192.168.199.133 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.114.153.82/24 (down)", "Routing: OSPF enabled on 10.114.153.0/24 area 0", "ACL 130: permit traffic from 192.168.199.133"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.114.153.82/24 is down, and ACL 130 permits traffic from 192.168.199.133."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.150.166.1 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.150.1660.0.0.255 area 0\naccess-list 124 deny ip 192.168.240.23 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.150.166.1/24 (down)", "Routing: OSPF enabled on 10.150.1660/24 area 0", "ACL 124: deny traffic from 192.168.240.23"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.150.166.1/24 is down, and ACL 124 denys traffic from 192.168.240.23."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.198.158.224 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.198.158.20.0.0.255 area 0\naccess-list 173 deny ip 192.168.241.232 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.198.158.224/24 (down)", "Routing: OSPF enabled on 10.198.158.20/24 area 0", "ACL 173: deny traffic from 192.168.241.232"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.198.158.224/24 is down, and ACL 173 denys traffic from 192.168.241.232."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.236.19.22 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.236.19.0.0.0.255 area 0\naccess-list 134 permit ip 192.168.95.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.236.19.22/24 (down)", "Routing: OSPF enabled on 10.236.19.0/24 area 0", "ACL 134: permit traffic from 192.168.95.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.236.19.22/24 is down, and ACL 134 permits traffic from 192.168.95.204."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.177.222.136 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.177.222.10.0.0.255 area 0\naccess-list 182 permit ip 192.168.202.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.177.222.136/24 (down)", "Routing: OSPF enabled on 10.177.222.10/24 area 0", "ACL 182: permit traffic from 192.168.202.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.177.222.136/24 is down, and ACL 182 permits traffic from 192.168.202.25."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.39.220.97 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.39.220.0.0.0.255 area 0\naccess-list 138 deny ip 192.168.238.82 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.39.220.97/24 (up)", "Routing: OSPF enabled on 10.39.220.0/24 area 0", "ACL 138: deny traffic from 192.168.238.82"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.39.220.97/24 is up, and ACL 138 denys traffic from 192.168.238.82."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.236.251.198 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.236.251.10.0.0.255 area 0\naccess-list 150 permit ip 192.168.231.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.236.251.198/24 (down)", "Routing: OSPF enabled on 10.236.251.10/24 area 0", "ACL 150: permit traffic from 192.168.231.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.236.251.198/24 is down, and ACL 150 permits traffic from 192.168.231.78."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.68.54.1 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.68.540.0.0.255 area 0\naccess-list 125 deny ip 192.168.148.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.68.54.1/24 (up)", "Routing: OSPF enabled on 10.68.540/24 area 0", "ACL 125: deny traffic from 192.168.148.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.68.54.1/24 is up, and ACL 125 denys traffic from 192.168.148.56."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.39.216.105 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.39.216.10.0.0.255 area 0\naccess-list 109 deny ip 192.168.150.111 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.39.216.105/24 (up)", "Routing: OSPF enabled on 10.39.216.10/24 area 0", "ACL 109: deny traffic from 192.168.150.111"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.39.216.105/24 is up, and ACL 109 denys traffic from 192.168.150.111."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.45.166.125 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.45.166.10.0.0.255 area 0\naccess-list 172 deny ip 192.168.249.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.45.166.125/24 (up)", "Routing: OSPF enabled on 10.45.166.10/24 area 0", "ACL 172: deny traffic from 192.168.249.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.45.166.125/24 is up, and ACL 172 denys traffic from 192.168.249.20."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.55.15.169 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.55.15.10.0.0.255 area 0\naccess-list 123 permit ip 192.168.126.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.55.15.169/24 (down)", "Routing: OSPF enabled on 10.55.15.10/24 area 0", "ACL 123: permit traffic from 192.168.126.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.55.15.169/24 is down, and ACL 123 permits traffic from 192.168.126.25."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.245.239.241 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.245.239.20.0.0.255 area 0\naccess-list 193 permit ip 192.168.203.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.245.239.241/24 (down)", "Routing: OSPF enabled on 10.245.239.20/24 area 0", "ACL 193: permit traffic from 192.168.203.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.245.239.241/24 is down, and ACL 193 permits traffic from 192.168.203.129."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.62.145.190 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.62.145.10.0.0.255 area 0\naccess-list 187 permit ip 192.168.74.145 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.62.145.190/24 (down)", "Routing: OSPF enabled on 10.62.145.10/24 area 0", "ACL 187: permit traffic from 192.168.74.145"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.62.145.190/24 is down, and ACL 187 permits traffic from 192.168.74.145."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.104.92.85 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.104.92.0.0.0.255 area 0\naccess-list 108 deny ip 192.168.84.23 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.104.92.85/24 (up)", "Routing: OSPF enabled on 10.104.92.0/24 area 0", "ACL 108: deny traffic from 192.168.84.23"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.104.92.85/24 is up, and ACL 108 denys traffic from 192.168.84.23."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.106.222.149 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.106.222.10.0.0.255 area 0\naccess-list 138 deny ip 192.168.134.138 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.106.222.149/24 (down)", "Routing: OSPF enabled on 10.106.222.10/24 area 0", "ACL 138: deny traffic from 192.168.134.138"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.106.222.149/24 is down, and ACL 138 denys traffic from 192.168.134.138."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.39.197.250 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.39.197.20.0.0.255 area 0\naccess-list 101 permit ip 192.168.96.233 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.39.197.250/24 (up)", "Routing: OSPF enabled on 10.39.197.20/24 area 0", "ACL 101: permit traffic from 192.168.96.233"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.39.197.250/24 is up, and ACL 101 permits traffic from 192.168.96.233."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.231.160.33 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.231.160.0.0.0.255 area 0\naccess-list 128 deny ip 192.168.243.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.231.160.33/24 (down)", "Routing: OSPF enabled on 10.231.160.0/24 area 0", "ACL 128: deny traffic from 192.168.243.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.231.160.33/24 is down, and ACL 128 denys traffic from 192.168.243.242."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.116.171.208 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.116.171.20.0.0.255 area 0\naccess-list 156 permit ip 192.168.25.213 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.116.171.208/24 (down)", "Routing: OSPF enabled on 10.116.171.20/24 area 0", "ACL 156: permit traffic from 192.168.25.213"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.116.171.208/24 is down, and ACL 156 permits traffic from 192.168.25.213."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.55.220.8 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.55.2200.0.0.255 area 0\naccess-list 182 deny ip 192.168.225.115 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.55.220.8/24 (down)", "Routing: OSPF enabled on 10.55.2200/24 area 0", "ACL 182: deny traffic from 192.168.225.115"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.55.220.8/24 is down, and ACL 182 denys traffic from 192.168.225.115."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.6.175.70 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.6.175.0.0.0.255 area 0\naccess-list 158 permit ip 192.168.215.83 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.6.175.70/24 (down)", "Routing: OSPF enabled on 10.6.175.0/24 area 0", "ACL 158: permit traffic from 192.168.215.83"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.6.175.70/24 is down, and ACL 158 permits traffic from 192.168.215.83."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.128.225.125 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.128.225.10.0.0.255 area 0\naccess-list 131 permit ip 192.168.181.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.128.225.125/24 (down)", "Routing: OSPF enabled on 10.128.225.10/24 area 0", "ACL 131: permit traffic from 192.168.181.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.128.225.125/24 is down, and ACL 131 permits traffic from 192.168.181.38."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.204.46.4 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.204.460.0.0.255 area 0\naccess-list 125 permit ip 192.168.103.241 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.204.46.4/24 (up)", "Routing: OSPF enabled on 10.204.460/24 area 0", "ACL 125: permit traffic from 192.168.103.241"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.204.46.4/24 is up, and ACL 125 permits traffic from 192.168.103.241."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.109.129.41 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.109.129.0.0.0.255 area 0\naccess-list 113 permit ip 192.168.73.229 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.109.129.41/24 (up)", "Routing: OSPF enabled on 10.109.129.0/24 area 0", "ACL 113: permit traffic from 192.168.73.229"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.109.129.41/24 is up, and ACL 113 permits traffic from 192.168.73.229."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.56.240.174 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.56.240.10.0.0.255 area 0\naccess-list 100 permit ip 192.168.209.219 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.56.240.174/24 (down)", "Routing: OSPF enabled on 10.56.240.10/24 area 0", "ACL 100: permit traffic from 192.168.209.219"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.56.240.174/24 is down, and ACL 100 permits traffic from 192.168.209.219."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.154.99.245 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.154.99.20.0.0.255 area 0\naccess-list 157 deny ip 192.168.176.250 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.154.99.245/24 (down)", "Routing: OSPF enabled on 10.154.99.20/24 area 0", "ACL 157: deny traffic from 192.168.176.250"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.154.99.245/24 is down, and ACL 157 denys traffic from 192.168.176.250."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.105.5.139 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.105.5.10.0.0.255 area 0\naccess-list 145 deny ip 192.168.203.81 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.105.5.139/24 (up)", "Routing: OSPF enabled on 10.105.5.10/24 area 0", "ACL 145: deny traffic from 192.168.203.81"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.105.5.139/24 is up, and ACL 145 denys traffic from 192.168.203.81."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.11.245.225 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.11.245.20.0.0.255 area 0\naccess-list 141 deny ip 192.168.168.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.11.245.225/24 (up)", "Routing: OSPF enabled on 10.11.245.20/24 area 0", "ACL 141: deny traffic from 192.168.168.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.11.245.225/24 is up, and ACL 141 denys traffic from 192.168.168.154."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.103.72.221 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.103.72.20.0.0.255 area 0\naccess-list 122 deny ip 192.168.142.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.103.72.221/24 (up)", "Routing: OSPF enabled on 10.103.72.20/24 area 0", "ACL 122: deny traffic from 192.168.142.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.103.72.221/24 is up, and ACL 122 denys traffic from 192.168.142.136."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.62.31.146 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.62.31.10.0.0.255 area 0\naccess-list 190 permit ip 192.168.57.243 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.62.31.146/24 (down)", "Routing: OSPF enabled on 10.62.31.10/24 area 0", "ACL 190: permit traffic from 192.168.57.243"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.62.31.146/24 is down, and ACL 190 permits traffic from 192.168.57.243."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.197.247.69 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.197.247.0.0.0.255 area 0\naccess-list 149 deny ip 192.168.217.173 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.197.247.69/24 (down)", "Routing: OSPF enabled on 10.197.247.0/24 area 0", "ACL 149: deny traffic from 192.168.217.173"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.197.247.69/24 is down, and ACL 149 denys traffic from 192.168.217.173."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.191.150.166 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.191.150.10.0.0.255 area 0\naccess-list 148 permit ip 192.168.54.39 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.191.150.166/24 (up)", "Routing: OSPF enabled on 10.191.150.10/24 area 0", "ACL 148: permit traffic from 192.168.54.39"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.191.150.166/24 is up, and ACL 148 permits traffic from 192.168.54.39."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.133.5.220 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.133.5.20.0.0.255 area 0\naccess-list 161 deny ip 192.168.76.44 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.133.5.220/24 (up)", "Routing: OSPF enabled on 10.133.5.20/24 area 0", "ACL 161: deny traffic from 192.168.76.44"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.133.5.220/24 is up, and ACL 161 denys traffic from 192.168.76.44."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.95.20.244 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.95.20.20.0.0.255 area 0\naccess-list 143 permit ip 192.168.58.52 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.95.20.244/24 (down)", "Routing: OSPF enabled on 10.95.20.20/24 area 0", "ACL 143: permit traffic from 192.168.58.52"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.95.20.244/24 is down, and ACL 143 permits traffic from 192.168.58.52."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.96.228.23 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.96.228.0.0.0.255 area 0\naccess-list 157 permit ip 192.168.224.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.96.228.23/24 (down)", "Routing: OSPF enabled on 10.96.228.0/24 area 0", "ACL 157: permit traffic from 192.168.224.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.96.228.23/24 is down, and ACL 157 permits traffic from 192.168.224.155."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.180.132.200 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.180.132.20.0.0.255 area 0\naccess-list 159 deny ip 192.168.65.164 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.180.132.200/24 (down)", "Routing: OSPF enabled on 10.180.132.20/24 area 0", "ACL 159: deny traffic from 192.168.65.164"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.180.132.200/24 is down, and ACL 159 denys traffic from 192.168.65.164."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.214.30.229 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.214.30.20.0.0.255 area 0\naccess-list 138 deny ip 192.168.115.235 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.214.30.229/24 (up)", "Routing: OSPF enabled on 10.214.30.20/24 area 0", "ACL 138: deny traffic from 192.168.115.235"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.214.30.229/24 is up, and ACL 138 denys traffic from 192.168.115.235."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.132.204.116 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.132.204.10.0.0.255 area 0\naccess-list 103 deny ip 192.168.31.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.132.204.116/24 (down)", "Routing: OSPF enabled on 10.132.204.10/24 area 0", "ACL 103: deny traffic from 192.168.31.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.132.204.116/24 is down, and ACL 103 denys traffic from 192.168.31.234."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.152.58.122 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.152.58.10.0.0.255 area 0\naccess-list 114 deny ip 192.168.84.178 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.152.58.122/24 (down)", "Routing: OSPF enabled on 10.152.58.10/24 area 0", "ACL 114: deny traffic from 192.168.84.178"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.152.58.122/24 is down, and ACL 114 denys traffic from 192.168.84.178."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.173.169.3 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.173.1690.0.0.255 area 0\naccess-list 131 deny ip 192.168.109.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.173.169.3/24 (up)", "Routing: OSPF enabled on 10.173.1690/24 area 0", "ACL 131: deny traffic from 192.168.109.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.173.169.3/24 is up, and ACL 131 denys traffic from 192.168.109.160."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.24.248.122 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.24.248.10.0.0.255 area 0\naccess-list 154 deny ip 192.168.82.163 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.24.248.122/24 (down)", "Routing: OSPF enabled on 10.24.248.10/24 area 0", "ACL 154: deny traffic from 192.168.82.163"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.24.248.122/24 is down, and ACL 154 denys traffic from 192.168.82.163."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.199.81.33 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.199.81.0.0.0.255 area 0\naccess-list 183 permit ip 192.168.143.173 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.199.81.33/24 (up)", "Routing: OSPF enabled on 10.199.81.0/24 area 0", "ACL 183: permit traffic from 192.168.143.173"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.199.81.33/24 is up, and ACL 183 permits traffic from 192.168.143.173."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.119.121.28 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.119.121.0.0.0.255 area 0\naccess-list 166 deny ip 192.168.246.198 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.119.121.28/24 (up)", "Routing: OSPF enabled on 10.119.121.0/24 area 0", "ACL 166: deny traffic from 192.168.246.198"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.119.121.28/24 is up, and ACL 166 denys traffic from 192.168.246.198."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.139.144.93 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.139.144.0.0.0.255 area 0\naccess-list 161 permit ip 192.168.103.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.139.144.93/24 (up)", "Routing: OSPF enabled on 10.139.144.0/24 area 0", "ACL 161: permit traffic from 192.168.103.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.139.144.93/24 is up, and ACL 161 permits traffic from 192.168.103.106."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.164.150.231 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.164.150.20.0.0.255 area 0\naccess-list 156 permit ip 192.168.207.202 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.164.150.231/24 (up)", "Routing: OSPF enabled on 10.164.150.20/24 area 0", "ACL 156: permit traffic from 192.168.207.202"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.164.150.231/24 is up, and ACL 156 permits traffic from 192.168.207.202."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.38.240.82 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.38.240.0.0.0.255 area 0\naccess-list 175 deny ip 192.168.62.111 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.38.240.82/24 (down)", "Routing: OSPF enabled on 10.38.240.0/24 area 0", "ACL 175: deny traffic from 192.168.62.111"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.38.240.82/24 is down, and ACL 175 denys traffic from 192.168.62.111."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.241.21.189 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.241.21.10.0.0.255 area 0\naccess-list 169 permit ip 192.168.255.25 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.241.21.189/24 (up)", "Routing: OSPF enabled on 10.241.21.10/24 area 0", "ACL 169: permit traffic from 192.168.255.25"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.241.21.189/24 is up, and ACL 169 permits traffic from 192.168.255.25."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.3.127.57 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.3.127.0.0.0.255 area 0\naccess-list 118 deny ip 192.168.159.14 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.3.127.57/24 (down)", "Routing: OSPF enabled on 10.3.127.0/24 area 0", "ACL 118: deny traffic from 192.168.159.14"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.3.127.57/24 is down, and ACL 118 denys traffic from 192.168.159.14."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.63.14.202 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.63.14.20.0.0.255 area 0\naccess-list 119 deny ip 192.168.169.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.63.14.202/24 (up)", "Routing: OSPF enabled on 10.63.14.20/24 area 0", "ACL 119: deny traffic from 192.168.169.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.63.14.202/24 is up, and ACL 119 denys traffic from 192.168.169.152."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.96.148.10 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.96.148.0.0.0.255 area 0\naccess-list 109 deny ip 192.168.57.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.96.148.10/24 (up)", "Routing: OSPF enabled on 10.96.148.0/24 area 0", "ACL 109: deny traffic from 192.168.57.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.96.148.10/24 is up, and ACL 109 denys traffic from 192.168.57.230."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.40.27.193 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.40.27.10.0.0.255 area 0\naccess-list 126 deny ip 192.168.226.58 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.40.27.193/24 (down)", "Routing: OSPF enabled on 10.40.27.10/24 area 0", "ACL 126: deny traffic from 192.168.226.58"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.40.27.193/24 is down, and ACL 126 denys traffic from 192.168.226.58."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.76.244.98 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.76.244.0.0.0.255 area 0\naccess-list 136 permit ip 192.168.162.180 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.76.244.98/24 (up)", "Routing: OSPF enabled on 10.76.244.0/24 area 0", "ACL 136: permit traffic from 192.168.162.180"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.76.244.98/24 is up, and ACL 136 permits traffic from 192.168.162.180."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.213.157.145 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.213.157.10.0.0.255 area 0\naccess-list 191 deny ip 192.168.19.27 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.213.157.145/24 (down)", "Routing: OSPF enabled on 10.213.157.10/24 area 0", "ACL 191: deny traffic from 192.168.19.27"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.213.157.145/24 is down, and ACL 191 denys traffic from 192.168.19.27."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.45.187.199 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.45.187.10.0.0.255 area 0\naccess-list 135 permit ip 192.168.103.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.45.187.199/24 (down)", "Routing: OSPF enabled on 10.45.187.10/24 area 0", "ACL 135: permit traffic from 192.168.103.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.45.187.199/24 is down, and ACL 135 permits traffic from 192.168.103.78."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.134.197.37 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.134.197.0.0.0.255 area 0\naccess-list 164 deny ip 192.168.20.159 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.134.197.37/24 (up)", "Routing: OSPF enabled on 10.134.197.0/24 area 0", "ACL 164: deny traffic from 192.168.20.159"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.134.197.37/24 is up, and ACL 164 denys traffic from 192.168.20.159."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.156.239.240 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.156.239.20.0.0.255 area 0\naccess-list 198 deny ip 192.168.254.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.156.239.240/24 (up)", "Routing: OSPF enabled on 10.156.239.20/24 area 0", "ACL 198: deny traffic from 192.168.254.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.156.239.240/24 is up, and ACL 198 denys traffic from 192.168.254.222."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.198.91.193 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.198.91.10.0.0.255 area 0\naccess-list 114 deny ip 192.168.62.212 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.198.91.193/24 (down)", "Routing: OSPF enabled on 10.198.91.10/24 area 0", "ACL 114: deny traffic from 192.168.62.212"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.198.91.193/24 is down, and ACL 114 denys traffic from 192.168.62.212."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.224.15.78 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.224.15.0.0.0.255 area 0\naccess-list 116 deny ip 192.168.189.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.224.15.78/24 (down)", "Routing: OSPF enabled on 10.224.15.0/24 area 0", "ACL 116: deny traffic from 192.168.189.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.224.15.78/24 is down, and ACL 116 denys traffic from 192.168.189.94."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.201.159.218 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.201.159.20.0.0.255 area 0\naccess-list 110 deny ip 192.168.59.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.201.159.218/24 (down)", "Routing: OSPF enabled on 10.201.159.20/24 area 0", "ACL 110: deny traffic from 192.168.59.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.201.159.218/24 is down, and ACL 110 denys traffic from 192.168.59.108."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.209.247.136 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.209.247.10.0.0.255 area 0\naccess-list 188 deny ip 192.168.84.255 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.209.247.136/24 (up)", "Routing: OSPF enabled on 10.209.247.10/24 area 0", "ACL 188: deny traffic from 192.168.84.255"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.209.247.136/24 is up, and ACL 188 denys traffic from 192.168.84.255."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.100.226.132 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.100.226.10.0.0.255 area 0\naccess-list 191 permit ip 192.168.224.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.100.226.132/24 (up)", "Routing: OSPF enabled on 10.100.226.10/24 area 0", "ACL 191: permit traffic from 192.168.224.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.100.226.132/24 is up, and ACL 191 permits traffic from 192.168.224.113."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.215.123.106 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.215.123.10.0.0.255 area 0\naccess-list 136 permit ip 192.168.69.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.215.123.106/24 (up)", "Routing: OSPF enabled on 10.215.123.10/24 area 0", "ACL 136: permit traffic from 192.168.69.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.215.123.106/24 is up, and ACL 136 permits traffic from 192.168.69.152."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.126.32.1 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.126.320.0.0.255 area 0\naccess-list 133 permit ip 192.168.154.158 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.126.32.1/24 (down)", "Routing: OSPF enabled on 10.126.320/24 area 0", "ACL 133: permit traffic from 192.168.154.158"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.126.32.1/24 is down, and ACL 133 permits traffic from 192.168.154.158."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.81.104.251 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.81.104.20.0.0.255 area 0\naccess-list 160 deny ip 192.168.79.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.81.104.251/24 (up)", "Routing: OSPF enabled on 10.81.104.20/24 area 0", "ACL 160: deny traffic from 192.168.79.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.81.104.251/24 is up, and ACL 160 denys traffic from 192.168.79.113."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.22.69.187 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.22.69.10.0.0.255 area 0\naccess-list 108 permit ip 192.168.200.151 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.22.69.187/24 (down)", "Routing: OSPF enabled on 10.22.69.10/24 area 0", "ACL 108: permit traffic from 192.168.200.151"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.22.69.187/24 is down, and ACL 108 permits traffic from 192.168.200.151."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.172.218.215 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.172.218.20.0.0.255 area 0\naccess-list 107 permit ip 192.168.130.232 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.172.218.215/24 (up)", "Routing: OSPF enabled on 10.172.218.20/24 area 0", "ACL 107: permit traffic from 192.168.130.232"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.172.218.215/24 is up, and ACL 107 permits traffic from 192.168.130.232."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.42.165.82 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.42.165.0.0.0.255 area 0\naccess-list 153 deny ip 192.168.162.143 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.42.165.82/24 (down)", "Routing: OSPF enabled on 10.42.165.0/24 area 0", "ACL 153: deny traffic from 192.168.162.143"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.42.165.82/24 is down, and ACL 153 denys traffic from 192.168.162.143."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.239.119.220 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.239.119.20.0.0.255 area 0\naccess-list 172 permit ip 192.168.31.64 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.239.119.220/24 (down)", "Routing: OSPF enabled on 10.239.119.20/24 area 0", "ACL 172: permit traffic from 192.168.31.64"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.239.119.220/24 is down, and ACL 172 permits traffic from 192.168.31.64."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.150.218.118 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.150.218.10.0.0.255 area 0\naccess-list 195 deny ip 192.168.229.123 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.150.218.118/24 (down)", "Routing: OSPF enabled on 10.150.218.10/24 area 0", "ACL 195: deny traffic from 192.168.229.123"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.150.218.118/24 is down, and ACL 195 denys traffic from 192.168.229.123."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.30.62.153 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.30.62.10.0.0.255 area 0\naccess-list 102 deny ip 192.168.205.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.30.62.153/24 (down)", "Routing: OSPF enabled on 10.30.62.10/24 area 0", "ACL 102: deny traffic from 192.168.205.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.30.62.153/24 is down, and ACL 102 denys traffic from 192.168.205.221."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.100.164.139 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.100.164.10.0.0.255 area 0\naccess-list 176 permit ip 192.168.50.188 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.100.164.139/24 (up)", "Routing: OSPF enabled on 10.100.164.10/24 area 0", "ACL 176: permit traffic from 192.168.50.188"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.100.164.139/24 is up, and ACL 176 permits traffic from 192.168.50.188."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.192.83.13 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.192.83.0.0.0.255 area 0\naccess-list 107 permit ip 192.168.238.60 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.192.83.13/24 (down)", "Routing: OSPF enabled on 10.192.83.0/24 area 0", "ACL 107: permit traffic from 192.168.238.60"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.192.83.13/24 is down, and ACL 107 permits traffic from 192.168.238.60."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.185.252.20 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.185.252.0.0.0.255 area 0\naccess-list 130 permit ip 192.168.198.23 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.185.252.20/24 (down)", "Routing: OSPF enabled on 10.185.252.0/24 area 0", "ACL 130: permit traffic from 192.168.198.23"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.185.252.20/24 is down, and ACL 130 permits traffic from 192.168.198.23."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.89.199.203 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.89.199.20.0.0.255 area 0\naccess-list 156 permit ip 192.168.91.51 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.89.199.203/24 (down)", "Routing: OSPF enabled on 10.89.199.20/24 area 0", "ACL 156: permit traffic from 192.168.91.51"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.89.199.203/24 is down, and ACL 156 permits traffic from 192.168.91.51."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.39.139.115 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.39.139.10.0.0.255 area 0\naccess-list 179 deny ip 192.168.224.193 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.39.139.115/24 (down)", "Routing: OSPF enabled on 10.39.139.10/24 area 0", "ACL 179: deny traffic from 192.168.224.193"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.39.139.115/24 is down, and ACL 179 denys traffic from 192.168.224.193."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.154.104.103 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.154.104.10.0.0.255 area 0\naccess-list 163 permit ip 192.168.235.229 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.154.104.103/24 (down)", "Routing: OSPF enabled on 10.154.104.10/24 area 0", "ACL 163: permit traffic from 192.168.235.229"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.154.104.103/24 is down, and ACL 163 permits traffic from 192.168.235.229."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.59.162.150 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.59.162.10.0.0.255 area 0\naccess-list 166 permit ip 192.168.38.118 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.59.162.150/24 (down)", "Routing: OSPF enabled on 10.59.162.10/24 area 0", "ACL 166: permit traffic from 192.168.38.118"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.59.162.150/24 is down, and ACL 166 permits traffic from 192.168.38.118."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.240.48.207 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.240.48.20.0.0.255 area 0\naccess-list 159 permit ip 192.168.34.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.240.48.207/24 (down)", "Routing: OSPF enabled on 10.240.48.20/24 area 0", "ACL 159: permit traffic from 192.168.34.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.240.48.207/24 is down, and ACL 159 permits traffic from 192.168.34.48."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.133.240.103 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.133.240.10.0.0.255 area 0\naccess-list 184 permit ip 192.168.170.90 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.133.240.103/24 (down)", "Routing: OSPF enabled on 10.133.240.10/24 area 0", "ACL 184: permit traffic from 192.168.170.90"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.133.240.103/24 is down, and ACL 184 permits traffic from 192.168.170.90."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.221.28.148 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.221.28.10.0.0.255 area 0\naccess-list 146 permit ip 192.168.59.169 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.221.28.148/24 (down)", "Routing: OSPF enabled on 10.221.28.10/24 area 0", "ACL 146: permit traffic from 192.168.59.169"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.221.28.148/24 is down, and ACL 146 permits traffic from 192.168.59.169."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.85.79.31 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.85.79.0.0.0.255 area 0\naccess-list 129 deny ip 192.168.16.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.85.79.31/24 (down)", "Routing: OSPF enabled on 10.85.79.0/24 area 0", "ACL 129: deny traffic from 192.168.16.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.85.79.31/24 is down, and ACL 129 denys traffic from 192.168.16.160."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.224.7.88 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.224.7.0.0.0.255 area 0\naccess-list 169 permit ip 192.168.50.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.224.7.88/24 (up)", "Routing: OSPF enabled on 10.224.7.0/24 area 0", "ACL 169: permit traffic from 192.168.50.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.224.7.88/24 is up, and ACL 169 permits traffic from 192.168.50.186."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.47.109.152 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.47.109.10.0.0.255 area 0\naccess-list 156 deny ip 192.168.94.110 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.47.109.152/24 (down)", "Routing: OSPF enabled on 10.47.109.10/24 area 0", "ACL 156: deny traffic from 192.168.94.110"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.47.109.152/24 is down, and ACL 156 denys traffic from 192.168.94.110."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.106.100.92 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.106.100.0.0.0.255 area 0\naccess-list 155 permit ip 192.168.14.61 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.106.100.92/24 (up)", "Routing: OSPF enabled on 10.106.100.0/24 area 0", "ACL 155: permit traffic from 192.168.14.61"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.106.100.92/24 is up, and ACL 155 permits traffic from 192.168.14.61."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.75.158.74 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.75.158.0.0.0.255 area 0\naccess-list 155 deny ip 192.168.252.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.75.158.74/24 (up)", "Routing: OSPF enabled on 10.75.158.0/24 area 0", "ACL 155: deny traffic from 192.168.252.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.75.158.74/24 is up, and ACL 155 denys traffic from 192.168.252.121."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.178.195.40 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.178.195.0.0.0.255 area 0\naccess-list 106 permit ip 192.168.123.54 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.178.195.40/24 (down)", "Routing: OSPF enabled on 10.178.195.0/24 area 0", "ACL 106: permit traffic from 192.168.123.54"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.178.195.40/24 is down, and ACL 106 permits traffic from 192.168.123.54."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.173.250.132 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.173.250.10.0.0.255 area 0\naccess-list 155 deny ip 192.168.186.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.173.250.132/24 (down)", "Routing: OSPF enabled on 10.173.250.10/24 area 0", "ACL 155: deny traffic from 192.168.186.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.173.250.132/24 is down, and ACL 155 denys traffic from 192.168.186.120."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.240.41.246 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.240.41.20.0.0.255 area 0\naccess-list 106 permit ip 192.168.128.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.240.41.246/24 (up)", "Routing: OSPF enabled on 10.240.41.20/24 area 0", "ACL 106: permit traffic from 192.168.128.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.240.41.246/24 is up, and ACL 106 permits traffic from 192.168.128.37."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.158.81.65 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.158.81.0.0.0.255 area 0\naccess-list 130 deny ip 192.168.182.64 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.158.81.65/24 (up)", "Routing: OSPF enabled on 10.158.81.0/24 area 0", "ACL 130: deny traffic from 192.168.182.64"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.158.81.65/24 is up, and ACL 130 denys traffic from 192.168.182.64."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.95.89.207 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.95.89.20.0.0.255 area 0\naccess-list 173 permit ip 192.168.17.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.95.89.207/24 (down)", "Routing: OSPF enabled on 10.95.89.20/24 area 0", "ACL 173: permit traffic from 192.168.17.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.95.89.207/24 is down, and ACL 173 permits traffic from 192.168.17.92."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.185.107.113 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.185.107.10.0.0.255 area 0\naccess-list 175 permit ip 192.168.221.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.185.107.113/24 (down)", "Routing: OSPF enabled on 10.185.107.10/24 area 0", "ACL 175: permit traffic from 192.168.221.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.185.107.113/24 is down, and ACL 175 permits traffic from 192.168.221.53."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.61.173.248 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.61.173.20.0.0.255 area 0\naccess-list 167 deny ip 192.168.246.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.61.173.248/24 (up)", "Routing: OSPF enabled on 10.61.173.20/24 area 0", "ACL 167: deny traffic from 192.168.246.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.61.173.248/24 is up, and ACL 167 denys traffic from 192.168.246.75."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.199.97.9 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.199.970.0.0.255 area 0\naccess-list 120 permit ip 192.168.9.247 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.199.97.9/24 (down)", "Routing: OSPF enabled on 10.199.970/24 area 0", "ACL 120: permit traffic from 192.168.9.247"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.199.97.9/24 is down, and ACL 120 permits traffic from 192.168.9.247."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.38.72.191 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.38.72.10.0.0.255 area 0\naccess-list 142 deny ip 192.168.86.167 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.38.72.191/24 (down)", "Routing: OSPF enabled on 10.38.72.10/24 area 0", "ACL 142: deny traffic from 192.168.86.167"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.38.72.191/24 is down, and ACL 142 denys traffic from 192.168.86.167."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.231.139.82 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.231.139.0.0.0.255 area 0\naccess-list 122 deny ip 192.168.86.203 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.231.139.82/24 (up)", "Routing: OSPF enabled on 10.231.139.0/24 area 0", "ACL 122: deny traffic from 192.168.86.203"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.231.139.82/24 is up, and ACL 122 denys traffic from 192.168.86.203."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.156.125.212 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.156.125.20.0.0.255 area 0\naccess-list 133 deny ip 192.168.169.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.156.125.212/24 (up)", "Routing: OSPF enabled on 10.156.125.20/24 area 0", "ACL 133: deny traffic from 192.168.169.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.156.125.212/24 is up, and ACL 133 denys traffic from 192.168.169.220."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.43.137.232 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.43.137.20.0.0.255 area 0\naccess-list 102 permit ip 192.168.182.17 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.43.137.232/24 (down)", "Routing: OSPF enabled on 10.43.137.20/24 area 0", "ACL 102: permit traffic from 192.168.182.17"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.43.137.232/24 is down, and ACL 102 permits traffic from 192.168.182.17."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.223.7.52 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.223.7.0.0.0.255 area 0\naccess-list 183 permit ip 192.168.204.208 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.223.7.52/24 (down)", "Routing: OSPF enabled on 10.223.7.0/24 area 0", "ACL 183: permit traffic from 192.168.204.208"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.223.7.52/24 is down, and ACL 183 permits traffic from 192.168.204.208."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.139.137.58 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.139.137.0.0.0.255 area 0\naccess-list 131 permit ip 192.168.140.135 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.139.137.58/24 (up)", "Routing: OSPF enabled on 10.139.137.0/24 area 0", "ACL 131: permit traffic from 192.168.140.135"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.139.137.58/24 is up, and ACL 131 permits traffic from 192.168.140.135."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.27.98.142 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.27.98.10.0.0.255 area 0\naccess-list 133 permit ip 192.168.124.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.27.98.142/24 (up)", "Routing: OSPF enabled on 10.27.98.10/24 area 0", "ACL 133: permit traffic from 192.168.124.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.27.98.142/24 is up, and ACL 133 permits traffic from 192.168.124.48."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.2.60.219 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.2.60.20.0.0.255 area 0\naccess-list 130 permit ip 192.168.39.228 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.2.60.219/24 (down)", "Routing: OSPF enabled on 10.2.60.20/24 area 0", "ACL 130: permit traffic from 192.168.39.228"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.2.60.219/24 is down, and ACL 130 permits traffic from 192.168.39.228."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.171.52.196 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.171.52.10.0.0.255 area 0\naccess-list 120 permit ip 192.168.226.211 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.171.52.196/24 (up)", "Routing: OSPF enabled on 10.171.52.10/24 area 0", "ACL 120: permit traffic from 192.168.226.211"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.171.52.196/24 is up, and ACL 120 permits traffic from 192.168.226.211."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.0.101.223 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.0.101.20.0.0.255 area 0\naccess-list 151 deny ip 192.168.36.237 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.0.101.223/24 (down)", "Routing: OSPF enabled on 10.0.101.20/24 area 0", "ACL 151: deny traffic from 192.168.36.237"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.0.101.223/24 is down, and ACL 151 denys traffic from 192.168.36.237."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.111.150.129 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.111.150.10.0.0.255 area 0\naccess-list 194 deny ip 192.168.72.145 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.111.150.129/24 (up)", "Routing: OSPF enabled on 10.111.150.10/24 area 0", "ACL 194: deny traffic from 192.168.72.145"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.111.150.129/24 is up, and ACL 194 denys traffic from 192.168.72.145."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.29.91.164 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.29.91.10.0.0.255 area 0\naccess-list 159 deny ip 192.168.56.253 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.29.91.164/24 (up)", "Routing: OSPF enabled on 10.29.91.10/24 area 0", "ACL 159: deny traffic from 192.168.56.253"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.29.91.164/24 is up, and ACL 159 denys traffic from 192.168.56.253."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.117.63.91 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.117.63.0.0.0.255 area 0\naccess-list 182 permit ip 192.168.67.104 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.117.63.91/24 (down)", "Routing: OSPF enabled on 10.117.63.0/24 area 0", "ACL 182: permit traffic from 192.168.67.104"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.117.63.91/24 is down, and ACL 182 permits traffic from 192.168.67.104."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.173.31.10 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.173.31.0.0.0.255 area 0\naccess-list 155 deny ip 192.168.169.187 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.173.31.10/24 (up)", "Routing: OSPF enabled on 10.173.31.0/24 area 0", "ACL 155: deny traffic from 192.168.169.187"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.173.31.10/24 is up, and ACL 155 denys traffic from 192.168.169.187."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.208.219.253 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.208.219.20.0.0.255 area 0\naccess-list 175 deny ip 192.168.149.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.208.219.253/24 (down)", "Routing: OSPF enabled on 10.208.219.20/24 area 0", "ACL 175: deny traffic from 192.168.149.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.208.219.253/24 is down, and ACL 175 denys traffic from 192.168.149.191."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.181.17.189 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.181.17.10.0.0.255 area 0\naccess-list 108 deny ip 192.168.65.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.181.17.189/24 (down)", "Routing: OSPF enabled on 10.181.17.10/24 area 0", "ACL 108: deny traffic from 192.168.65.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.181.17.189/24 is down, and ACL 108 denys traffic from 192.168.65.85."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.215.197.228 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.215.197.20.0.0.255 area 0\naccess-list 125 deny ip 192.168.77.45 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.215.197.228/24 (up)", "Routing: OSPF enabled on 10.215.197.20/24 area 0", "ACL 125: deny traffic from 192.168.77.45"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.215.197.228/24 is up, and ACL 125 denys traffic from 192.168.77.45."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.211.207.90 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.211.207.0.0.0.255 area 0\naccess-list 137 permit ip 192.168.49.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.211.207.90/24 (down)", "Routing: OSPF enabled on 10.211.207.0/24 area 0", "ACL 137: permit traffic from 192.168.49.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.211.207.90/24 is down, and ACL 137 permits traffic from 192.168.49.78."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.64.225.245 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.64.225.20.0.0.255 area 0\naccess-list 191 permit ip 192.168.210.57 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.64.225.245/24 (down)", "Routing: OSPF enabled on 10.64.225.20/24 area 0", "ACL 191: permit traffic from 192.168.210.57"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.64.225.245/24 is down, and ACL 191 permits traffic from 192.168.210.57."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.19.20.4 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.19.200.0.0.255 area 0\naccess-list 158 deny ip 192.168.46.126 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.19.20.4/24 (down)", "Routing: OSPF enabled on 10.19.200/24 area 0", "ACL 158: deny traffic from 192.168.46.126"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.19.20.4/24 is down, and ACL 158 denys traffic from 192.168.46.126."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.178.76.205 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.178.76.20.0.0.255 area 0\naccess-list 165 permit ip 192.168.5.89 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.178.76.205/24 (down)", "Routing: OSPF enabled on 10.178.76.20/24 area 0", "ACL 165: permit traffic from 192.168.5.89"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.178.76.205/24 is down, and ACL 165 permits traffic from 192.168.5.89."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.146.246.247 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.146.246.20.0.0.255 area 0\naccess-list 158 permit ip 192.168.40.81 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.146.246.247/24 (down)", "Routing: OSPF enabled on 10.146.246.20/24 area 0", "ACL 158: permit traffic from 192.168.40.81"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.146.246.247/24 is down, and ACL 158 permits traffic from 192.168.40.81."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.58.139.13 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.58.139.0.0.0.255 area 0\naccess-list 162 deny ip 192.168.33.39 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.58.139.13/24 (down)", "Routing: OSPF enabled on 10.58.139.0/24 area 0", "ACL 162: deny traffic from 192.168.33.39"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.58.139.13/24 is down, and ACL 162 denys traffic from 192.168.33.39."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.146.77.115 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.146.77.10.0.0.255 area 0\naccess-list 144 deny ip 192.168.171.46 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.146.77.115/24 (down)", "Routing: OSPF enabled on 10.146.77.10/24 area 0", "ACL 144: deny traffic from 192.168.171.46"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.146.77.115/24 is down, and ACL 144 denys traffic from 192.168.171.46."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.150.114.61 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.150.114.0.0.0.255 area 0\naccess-list 134 deny ip 192.168.107.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.150.114.61/24 (up)", "Routing: OSPF enabled on 10.150.114.0/24 area 0", "ACL 134: deny traffic from 192.168.107.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.150.114.61/24 is up, and ACL 134 denys traffic from 192.168.107.120."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.102.212.92 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.102.212.0.0.0.255 area 0\naccess-list 168 deny ip 192.168.211.4 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.102.212.92/24 (up)", "Routing: OSPF enabled on 10.102.212.0/24 area 0", "ACL 168: deny traffic from 192.168.211.4"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.102.212.92/24 is up, and ACL 168 denys traffic from 192.168.211.4."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.232.227.250 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.232.227.20.0.0.255 area 0\naccess-list 147 deny ip 192.168.101.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.232.227.250/24 (down)", "Routing: OSPF enabled on 10.232.227.20/24 area 0", "ACL 147: deny traffic from 192.168.101.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.232.227.250/24 is down, and ACL 147 denys traffic from 192.168.101.230."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.16.217.180 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.16.217.10.0.0.255 area 0\naccess-list 162 deny ip 192.168.56.223 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.16.217.180/24 (down)", "Routing: OSPF enabled on 10.16.217.10/24 area 0", "ACL 162: deny traffic from 192.168.56.223"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.16.217.180/24 is down, and ACL 162 denys traffic from 192.168.56.223."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.65.107.48 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.65.107.0.0.0.255 area 0\naccess-list 185 deny ip 192.168.167.27 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.65.107.48/24 (down)", "Routing: OSPF enabled on 10.65.107.0/24 area 0", "ACL 185: deny traffic from 192.168.167.27"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.65.107.48/24 is down, and ACL 185 denys traffic from 192.168.167.27."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.122.132.99 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.122.132.0.0.0.255 area 0\naccess-list 104 deny ip 192.168.255.76 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.122.132.99/24 (up)", "Routing: OSPF enabled on 10.122.132.0/24 area 0", "ACL 104: deny traffic from 192.168.255.76"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.122.132.99/24 is up, and ACL 104 denys traffic from 192.168.255.76."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.89.17.219 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.89.17.20.0.0.255 area 0\naccess-list 133 permit ip 192.168.102.27 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.89.17.219/24 (down)", "Routing: OSPF enabled on 10.89.17.20/24 area 0", "ACL 133: permit traffic from 192.168.102.27"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.89.17.219/24 is down, and ACL 133 permits traffic from 192.168.102.27."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.94.40.10 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.94.40.0.0.0.255 area 0\naccess-list 157 permit ip 192.168.76.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.94.40.10/24 (down)", "Routing: OSPF enabled on 10.94.40.0/24 area 0", "ACL 157: permit traffic from 192.168.76.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.94.40.10/24 is down, and ACL 157 permits traffic from 192.168.76.117."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.44.152.91 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.44.152.0.0.0.255 area 0\naccess-list 115 deny ip 192.168.111.61 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.44.152.91/24 (up)", "Routing: OSPF enabled on 10.44.152.0/24 area 0", "ACL 115: deny traffic from 192.168.111.61"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.44.152.91/24 is up, and ACL 115 denys traffic from 192.168.111.61."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.17.244.39 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.17.244.0.0.0.255 area 0\naccess-list 166 deny ip 192.168.87.90 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.17.244.39/24 (down)", "Routing: OSPF enabled on 10.17.244.0/24 area 0", "ACL 166: deny traffic from 192.168.87.90"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.17.244.39/24 is down, and ACL 166 denys traffic from 192.168.87.90."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.49.8.214 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.49.8.20.0.0.255 area 0\naccess-list 199 deny ip 192.168.26.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.49.8.214/24 (up)", "Routing: OSPF enabled on 10.49.8.20/24 area 0", "ACL 199: deny traffic from 192.168.26.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.49.8.214/24 is up, and ACL 199 denys traffic from 192.168.26.134."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.11.215.14 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.11.215.0.0.0.255 area 0\naccess-list 140 deny ip 192.168.204.84 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.11.215.14/24 (down)", "Routing: OSPF enabled on 10.11.215.0/24 area 0", "ACL 140: deny traffic from 192.168.204.84"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.11.215.14/24 is down, and ACL 140 denys traffic from 192.168.204.84."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.187.214.181 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.187.214.10.0.0.255 area 0\naccess-list 103 permit ip 192.168.225.169 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.187.214.181/24 (up)", "Routing: OSPF enabled on 10.187.214.10/24 area 0", "ACL 103: permit traffic from 192.168.225.169"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.187.214.181/24 is up, and ACL 103 permits traffic from 192.168.225.169."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.77.99.221 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.77.99.20.0.0.255 area 0\naccess-list 136 deny ip 192.168.159.218 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.77.99.221/24 (up)", "Routing: OSPF enabled on 10.77.99.20/24 area 0", "ACL 136: deny traffic from 192.168.159.218"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.77.99.221/24 is up, and ACL 136 denys traffic from 192.168.159.218."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.28.158.9 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.28.1580.0.0.255 area 0\naccess-list 168 permit ip 192.168.19.191 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.28.158.9/24 (up)", "Routing: OSPF enabled on 10.28.1580/24 area 0", "ACL 168: permit traffic from 192.168.19.191"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.28.158.9/24 is up, and ACL 168 permits traffic from 192.168.19.191."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.226.81.85 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.226.81.0.0.0.255 area 0\naccess-list 116 deny ip 192.168.246.239 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.226.81.85/24 (down)", "Routing: OSPF enabled on 10.226.81.0/24 area 0", "ACL 116: deny traffic from 192.168.246.239"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.226.81.85/24 is down, and ACL 116 denys traffic from 192.168.246.239."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.107.96.36 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.107.96.0.0.0.255 area 0\naccess-list 161 permit ip 192.168.180.44 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.107.96.36/24 (up)", "Routing: OSPF enabled on 10.107.96.0/24 area 0", "ACL 161: permit traffic from 192.168.180.44"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.107.96.36/24 is up, and ACL 161 permits traffic from 192.168.180.44."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.198.184.103 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.198.184.10.0.0.255 area 0\naccess-list 168 deny ip 192.168.214.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.198.184.103/24 (down)", "Routing: OSPF enabled on 10.198.184.10/24 area 0", "ACL 168: deny traffic from 192.168.214.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.198.184.103/24 is down, and ACL 168 denys traffic from 192.168.214.172."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.214.254.201 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.214.254.20.0.0.255 area 0\naccess-list 130 deny ip 192.168.141.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.214.254.201/24 (up)", "Routing: OSPF enabled on 10.214.254.20/24 area 0", "ACL 130: deny traffic from 192.168.141.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.214.254.201/24 is up, and ACL 130 denys traffic from 192.168.141.20."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.130.175.165 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.130.175.10.0.0.255 area 0\naccess-list 121 permit ip 192.168.190.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.130.175.165/24 (up)", "Routing: OSPF enabled on 10.130.175.10/24 area 0", "ACL 121: permit traffic from 192.168.190.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.130.175.165/24 is up, and ACL 121 permits traffic from 192.168.190.238."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.122.169.60 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.122.169.0.0.0.255 area 0\naccess-list 148 permit ip 192.168.46.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.122.169.60/24 (down)", "Routing: OSPF enabled on 10.122.169.0/24 area 0", "ACL 148: permit traffic from 192.168.46.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.122.169.60/24 is down, and ACL 148 permits traffic from 192.168.46.40."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.243.111.83 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.243.111.0.0.0.255 area 0\naccess-list 152 deny ip 192.168.83.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.243.111.83/24 (up)", "Routing: OSPF enabled on 10.243.111.0/24 area 0", "ACL 152: deny traffic from 192.168.83.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.243.111.83/24 is up, and ACL 152 denys traffic from 192.168.83.48."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.240.174.190 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.240.174.10.0.0.255 area 0\naccess-list 195 deny ip 192.168.185.181 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.240.174.190/24 (up)", "Routing: OSPF enabled on 10.240.174.10/24 area 0", "ACL 195: deny traffic from 192.168.185.181"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.240.174.190/24 is up, and ACL 195 denys traffic from 192.168.185.181."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.196.149.59 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.196.149.0.0.0.255 area 0\naccess-list 103 deny ip 192.168.222.17 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.196.149.59/24 (down)", "Routing: OSPF enabled on 10.196.149.0/24 area 0", "ACL 103: deny traffic from 192.168.222.17"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.196.149.59/24 is down, and ACL 103 denys traffic from 192.168.222.17."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.21.143.19 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.21.143.0.0.0.255 area 0\naccess-list 159 permit ip 192.168.109.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.21.143.19/24 (up)", "Routing: OSPF enabled on 10.21.143.0/24 area 0", "ACL 159: permit traffic from 192.168.109.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.21.143.19/24 is up, and ACL 159 permits traffic from 192.168.109.69."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.73.131.58 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.73.131.0.0.0.255 area 0\naccess-list 105 permit ip 192.168.76.153 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.73.131.58/24 (up)", "Routing: OSPF enabled on 10.73.131.0/24 area 0", "ACL 105: permit traffic from 192.168.76.153"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.73.131.58/24 is up, and ACL 105 permits traffic from 192.168.76.153."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.229.153.3 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.229.1530.0.0.255 area 0\naccess-list 119 permit ip 192.168.87.32 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.229.153.3/24 (down)", "Routing: OSPF enabled on 10.229.1530/24 area 0", "ACL 119: permit traffic from 192.168.87.32"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.229.153.3/24 is down, and ACL 119 permits traffic from 192.168.87.32."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.246.180.87 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.246.180.0.0.0.255 area 0\naccess-list 145 deny ip 192.168.126.186 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.246.180.87/24 (up)", "Routing: OSPF enabled on 10.246.180.0/24 area 0", "ACL 145: deny traffic from 192.168.126.186"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.246.180.87/24 is up, and ACL 145 denys traffic from 192.168.126.186."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.74.58.84 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.74.58.0.0.0.255 area 0\naccess-list 109 permit ip 192.168.115.149 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.74.58.84/24 (up)", "Routing: OSPF enabled on 10.74.58.0/24 area 0", "ACL 109: permit traffic from 192.168.115.149"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.74.58.84/24 is up, and ACL 109 permits traffic from 192.168.115.149."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.151.92.208 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.151.92.20.0.0.255 area 0\naccess-list 199 deny ip 192.168.27.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.151.92.208/24 (up)", "Routing: OSPF enabled on 10.151.92.20/24 area 0", "ACL 199: deny traffic from 192.168.27.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.151.92.208/24 is up, and ACL 199 denys traffic from 192.168.27.85."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.135.219.225 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.135.219.20.0.0.255 area 0\naccess-list 182 deny ip 192.168.129.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.135.219.225/24 (down)", "Routing: OSPF enabled on 10.135.219.20/24 area 0", "ACL 182: deny traffic from 192.168.129.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.135.219.225/24 is down, and ACL 182 denys traffic from 192.168.129.113."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.50.170.164 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.50.170.10.0.0.255 area 0\naccess-list 195 permit ip 192.168.194.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.50.170.164/24 (up)", "Routing: OSPF enabled on 10.50.170.10/24 area 0", "ACL 195: permit traffic from 192.168.194.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.50.170.164/24 is up, and ACL 195 permits traffic from 192.168.194.59."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.17.80.48 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.17.80.0.0.0.255 area 0\naccess-list 168 permit ip 192.168.31.8 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.17.80.48/24 (up)", "Routing: OSPF enabled on 10.17.80.0/24 area 0", "ACL 168: permit traffic from 192.168.31.8"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.17.80.48/24 is up, and ACL 168 permits traffic from 192.168.31.8."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.245.81.66 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.245.81.0.0.0.255 area 0\naccess-list 114 permit ip 192.168.105.91 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.245.81.66/24 (down)", "Routing: OSPF enabled on 10.245.81.0/24 area 0", "ACL 114: permit traffic from 192.168.105.91"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.245.81.66/24 is down, and ACL 114 permits traffic from 192.168.105.91."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.23.178.154 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.23.178.10.0.0.255 area 0\naccess-list 123 permit ip 192.168.176.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.23.178.154/24 (down)", "Routing: OSPF enabled on 10.23.178.10/24 area 0", "ACL 123: permit traffic from 192.168.176.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.23.178.154/24 is down, and ACL 123 permits traffic from 192.168.176.67."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.191.69.10 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.191.69.0.0.0.255 area 0\naccess-list 117 permit ip 192.168.202.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.191.69.10/24 (down)", "Routing: OSPF enabled on 10.191.69.0/24 area 0", "ACL 117: permit traffic from 192.168.202.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.191.69.10/24 is down, and ACL 117 permits traffic from 192.168.202.40."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.241.20.138 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.241.20.10.0.0.255 area 0\naccess-list 179 permit ip 192.168.65.7 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.241.20.138/24 (up)", "Routing: OSPF enabled on 10.241.20.10/24 area 0", "ACL 179: permit traffic from 192.168.65.7"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.241.20.138/24 is up, and ACL 179 permits traffic from 192.168.65.7."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.87.70.155 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.87.70.10.0.0.255 area 0\naccess-list 174 permit ip 192.168.204.151 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.87.70.155/24 (up)", "Routing: OSPF enabled on 10.87.70.10/24 area 0", "ACL 174: permit traffic from 192.168.204.151"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.87.70.155/24 is up, and ACL 174 permits traffic from 192.168.204.151."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.233.16.117 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.233.16.10.0.0.255 area 0\naccess-list 111 permit ip 192.168.85.170 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.233.16.117/24 (down)", "Routing: OSPF enabled on 10.233.16.10/24 area 0", "ACL 111: permit traffic from 192.168.85.170"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.233.16.117/24 is down, and ACL 111 permits traffic from 192.168.85.170."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.67.46.19 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.67.46.0.0.0.255 area 0\naccess-list 184 permit ip 192.168.35.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.67.46.19/24 (down)", "Routing: OSPF enabled on 10.67.46.0/24 area 0", "ACL 184: permit traffic from 192.168.35.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.67.46.19/24 is down, and ACL 184 permits traffic from 192.168.35.13."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.55.127.47 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.55.127.0.0.0.255 area 0\naccess-list 127 deny ip 192.168.92.226 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.55.127.47/24 (down)", "Routing: OSPF enabled on 10.55.127.0/24 area 0", "ACL 127: deny traffic from 192.168.92.226"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.55.127.47/24 is down, and ACL 127 denys traffic from 192.168.92.226."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.99.182.252 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.99.182.20.0.0.255 area 0\naccess-list 186 deny ip 192.168.84.161 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.99.182.252/24 (down)", "Routing: OSPF enabled on 10.99.182.20/24 area 0", "ACL 186: deny traffic from 192.168.84.161"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.99.182.252/24 is down, and ACL 186 denys traffic from 192.168.84.161."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.44.193.166 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.44.193.10.0.0.255 area 0\naccess-list 189 deny ip 192.168.206.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.44.193.166/24 (up)", "Routing: OSPF enabled on 10.44.193.10/24 area 0", "ACL 189: deny traffic from 192.168.206.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.44.193.166/24 is up, and ACL 189 denys traffic from 192.168.206.129."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.226.23.118 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.226.23.10.0.0.255 area 0\naccess-list 135 permit ip 192.168.139.46 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.226.23.118/24 (down)", "Routing: OSPF enabled on 10.226.23.10/24 area 0", "ACL 135: permit traffic from 192.168.139.46"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.226.23.118/24 is down, and ACL 135 permits traffic from 192.168.139.46."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.242.246.106 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.242.246.10.0.0.255 area 0\naccess-list 171 deny ip 192.168.239.209 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.242.246.106/24 (up)", "Routing: OSPF enabled on 10.242.246.10/24 area 0", "ACL 171: deny traffic from 192.168.239.209"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.242.246.106/24 is up, and ACL 171 denys traffic from 192.168.239.209."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.154.177.76 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.154.177.0.0.0.255 area 0\naccess-list 188 permit ip 192.168.163.108 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.154.177.76/24 (up)", "Routing: OSPF enabled on 10.154.177.0/24 area 0", "ACL 188: permit traffic from 192.168.163.108"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.154.177.76/24 is up, and ACL 188 permits traffic from 192.168.163.108."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.27.55.198 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.27.55.10.0.0.255 area 0\naccess-list 139 deny ip 192.168.7.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.27.55.198/24 (up)", "Routing: OSPF enabled on 10.27.55.10/24 area 0", "ACL 139: deny traffic from 192.168.7.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.27.55.198/24 is up, and ACL 139 denys traffic from 192.168.7.230."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.237.136.50 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.237.136.0.0.0.255 area 0\naccess-list 199 deny ip 192.168.191.228 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.237.136.50/24 (up)", "Routing: OSPF enabled on 10.237.136.0/24 area 0", "ACL 199: deny traffic from 192.168.191.228"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.237.136.50/24 is up, and ACL 199 denys traffic from 192.168.191.228."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.163.203.186 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.163.203.10.0.0.255 area 0\naccess-list 118 deny ip 192.168.120.211 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.163.203.186/24 (down)", "Routing: OSPF enabled on 10.163.203.10/24 area 0", "ACL 118: deny traffic from 192.168.120.211"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.163.203.186/24 is down, and ACL 118 denys traffic from 192.168.120.211."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.0.169.30 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.0.169.0.0.0.255 area 0\naccess-list 119 deny ip 192.168.157.125 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.0.169.30/24 (up)", "Routing: OSPF enabled on 10.0.169.0/24 area 0", "ACL 119: deny traffic from 192.168.157.125"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.0.169.30/24 is up, and ACL 119 denys traffic from 192.168.157.125."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.105.166.53 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.105.166.0.0.0.255 area 0\naccess-list 136 deny ip 192.168.227.125 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.105.166.53/24 (up)", "Routing: OSPF enabled on 10.105.166.0/24 area 0", "ACL 136: deny traffic from 192.168.227.125"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.105.166.53/24 is up, and ACL 136 denys traffic from 192.168.227.125."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.49.149.83 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.49.149.0.0.0.255 area 0\naccess-list 112 deny ip 192.168.171.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.49.149.83/24 (down)", "Routing: OSPF enabled on 10.49.149.0/24 area 0", "ACL 112: deny traffic from 192.168.171.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.49.149.83/24 is down, and ACL 112 denys traffic from 192.168.171.38."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.113.183.242 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.113.183.20.0.0.255 area 0\naccess-list 138 permit ip 192.168.238.142 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.113.183.242/24 (down)", "Routing: OSPF enabled on 10.113.183.20/24 area 0", "ACL 138: permit traffic from 192.168.238.142"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.113.183.242/24 is down, and ACL 138 permits traffic from 192.168.238.142."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.65.236.51 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.65.236.0.0.0.255 area 0\naccess-list 113 deny ip 192.168.158.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.65.236.51/24 (up)", "Routing: OSPF enabled on 10.65.236.0/24 area 0", "ACL 113: deny traffic from 192.168.158.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.65.236.51/24 is up, and ACL 113 denys traffic from 192.168.158.117."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.229.136.238 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.229.136.20.0.0.255 area 0\naccess-list 100 permit ip 192.168.152.127 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.229.136.238/24 (down)", "Routing: OSPF enabled on 10.229.136.20/24 area 0", "ACL 100: permit traffic from 192.168.152.127"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.229.136.238/24 is down, and ACL 100 permits traffic from 192.168.152.127."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.20.10.242 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.20.10.20.0.0.255 area 0\naccess-list 164 permit ip 192.168.59.34 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.20.10.242/24 (up)", "Routing: OSPF enabled on 10.20.10.20/24 area 0", "ACL 164: permit traffic from 192.168.59.34"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.20.10.242/24 is up, and ACL 164 permits traffic from 192.168.59.34."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.91.160.187 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.91.160.10.0.0.255 area 0\naccess-list 152 deny ip 192.168.238.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.91.160.187/24 (up)", "Routing: OSPF enabled on 10.91.160.10/24 area 0", "ACL 152: deny traffic from 192.168.238.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.91.160.187/24 is up, and ACL 152 denys traffic from 192.168.238.206."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.222.59.111 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.222.59.10.0.0.255 area 0\naccess-list 185 permit ip 192.168.201.115 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.222.59.111/24 (up)", "Routing: OSPF enabled on 10.222.59.10/24 area 0", "ACL 185: permit traffic from 192.168.201.115"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.222.59.111/24 is up, and ACL 185 permits traffic from 192.168.201.115."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.215.147.221 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.215.147.20.0.0.255 area 0\naccess-list 170 permit ip 192.168.180.101 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.215.147.221/24 (up)", "Routing: OSPF enabled on 10.215.147.20/24 area 0", "ACL 170: permit traffic from 192.168.180.101"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.215.147.221/24 is up, and ACL 170 permits traffic from 192.168.180.101."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.67.200.239 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.67.200.20.0.0.255 area 0\naccess-list 155 deny ip 192.168.118.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.67.200.239/24 (down)", "Routing: OSPF enabled on 10.67.200.20/24 area 0", "ACL 155: deny traffic from 192.168.118.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.67.200.239/24 is down, and ACL 155 denys traffic from 192.168.118.185."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.92.160.207 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.92.160.20.0.0.255 area 0\naccess-list 110 permit ip 192.168.225.13 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.92.160.207/24 (down)", "Routing: OSPF enabled on 10.92.160.20/24 area 0", "ACL 110: permit traffic from 192.168.225.13"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.92.160.207/24 is down, and ACL 110 permits traffic from 192.168.225.13."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.122.104.191 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.122.104.10.0.0.255 area 0\naccess-list 193 permit ip 192.168.23.163 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.122.104.191/24 (down)", "Routing: OSPF enabled on 10.122.104.10/24 area 0", "ACL 193: permit traffic from 192.168.23.163"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.122.104.191/24 is down, and ACL 193 permits traffic from 192.168.23.163."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.61.174.248 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.61.174.20.0.0.255 area 0\naccess-list 103 permit ip 192.168.244.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.61.174.248/24 (down)", "Routing: OSPF enabled on 10.61.174.20/24 area 0", "ACL 103: permit traffic from 192.168.244.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.61.174.248/24 is down, and ACL 103 permits traffic from 192.168.244.206."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.190.199.3 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.190.1990.0.0.255 area 0\naccess-list 158 permit ip 192.168.213.72 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.190.199.3/24 (up)", "Routing: OSPF enabled on 10.190.1990/24 area 0", "ACL 158: permit traffic from 192.168.213.72"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.190.199.3/24 is up, and ACL 158 permits traffic from 192.168.213.72."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.139.60.21 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.139.60.0.0.0.255 area 0\naccess-list 142 deny ip 192.168.11.173 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.139.60.21/24 (down)", "Routing: OSPF enabled on 10.139.60.0/24 area 0", "ACL 142: deny traffic from 192.168.11.173"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.139.60.21/24 is down, and ACL 142 denys traffic from 192.168.11.173."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.188.205.143 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.188.205.10.0.0.255 area 0\naccess-list 106 deny ip 192.168.17.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.188.205.143/24 (up)", "Routing: OSPF enabled on 10.188.205.10/24 area 0", "ACL 106: deny traffic from 192.168.17.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.188.205.143/24 is up, and ACL 106 denys traffic from 192.168.17.160."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.55.37.191 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.55.37.10.0.0.255 area 0\naccess-list 109 deny ip 192.168.69.181 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.55.37.191/24 (down)", "Routing: OSPF enabled on 10.55.37.10/24 area 0", "ACL 109: deny traffic from 192.168.69.181"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.55.37.191/24 is down, and ACL 109 denys traffic from 192.168.69.181."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.84.109.43 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.84.109.0.0.0.255 area 0\naccess-list 119 deny ip 192.168.1.201 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.84.109.43/24 (down)", "Routing: OSPF enabled on 10.84.109.0/24 area 0", "ACL 119: deny traffic from 192.168.1.201"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.84.109.43/24 is down, and ACL 119 denys traffic from 192.168.1.201."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.136.254.245 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.136.254.20.0.0.255 area 0\naccess-list 193 deny ip 192.168.234.178 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.136.254.245/24 (up)", "Routing: OSPF enabled on 10.136.254.20/24 area 0", "ACL 193: deny traffic from 192.168.234.178"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.136.254.245/24 is up, and ACL 193 denys traffic from 192.168.234.178."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.193.197.132 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.193.197.10.0.0.255 area 0\naccess-list 142 permit ip 192.168.155.119 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.193.197.132/24 (down)", "Routing: OSPF enabled on 10.193.197.10/24 area 0", "ACL 142: permit traffic from 192.168.155.119"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.193.197.132/24 is down, and ACL 142 permits traffic from 192.168.155.119."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.185.189.26 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.185.189.0.0.0.255 area 0\naccess-list 126 deny ip 192.168.30.23 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.185.189.26/24 (down)", "Routing: OSPF enabled on 10.185.189.0/24 area 0", "ACL 126: deny traffic from 192.168.30.23"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.185.189.26/24 is down, and ACL 126 denys traffic from 192.168.30.23."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.175.48.34 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.175.48.0.0.0.255 area 0\naccess-list 199 deny ip 192.168.185.65 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.175.48.34/24 (up)", "Routing: OSPF enabled on 10.175.48.0/24 area 0", "ACL 199: deny traffic from 192.168.185.65"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.175.48.34/24 is up, and ACL 199 denys traffic from 192.168.185.65."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.6.49.155 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.6.49.10.0.0.255 area 0\naccess-list 100 permit ip 192.168.122.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.6.49.155/24 (down)", "Routing: OSPF enabled on 10.6.49.10/24 area 0", "ACL 100: permit traffic from 192.168.122.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.6.49.155/24 is down, and ACL 100 permits traffic from 192.168.122.206."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.221.227.230 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.221.227.20.0.0.255 area 0\naccess-list 176 permit ip 192.168.141.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.221.227.230/24 (down)", "Routing: OSPF enabled on 10.221.227.20/24 area 0", "ACL 176: permit traffic from 192.168.141.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.221.227.230/24 is down, and ACL 176 permits traffic from 192.168.141.221."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.151.173.182 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.151.173.10.0.0.255 area 0\naccess-list 139 permit ip 192.168.249.44 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.151.173.182/24 (up)", "Routing: OSPF enabled on 10.151.173.10/24 area 0", "ACL 139: permit traffic from 192.168.249.44"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.151.173.182/24 is up, and ACL 139 permits traffic from 192.168.249.44."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.93.100.14 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.93.100.0.0.0.255 area 0\naccess-list 175 deny ip 192.168.131.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.93.100.14/24 (down)", "Routing: OSPF enabled on 10.93.100.0/24 area 0", "ACL 175: deny traffic from 192.168.131.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.93.100.14/24 is down, and ACL 175 denys traffic from 192.168.131.154."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.31.126.14 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.31.126.0.0.0.255 area 0\naccess-list 126 permit ip 192.168.43.60 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.31.126.14/24 (down)", "Routing: OSPF enabled on 10.31.126.0/24 area 0", "ACL 126: permit traffic from 192.168.43.60"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.31.126.14/24 is down, and ACL 126 permits traffic from 192.168.43.60."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.121.78.111 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.121.78.10.0.0.255 area 0\naccess-list 198 permit ip 192.168.221.239 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.121.78.111/24 (up)", "Routing: OSPF enabled on 10.121.78.10/24 area 0", "ACL 198: permit traffic from 192.168.221.239"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.121.78.111/24 is up, and ACL 198 permits traffic from 192.168.221.239."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.173.1.107 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.173.1.10.0.0.255 area 0\naccess-list 131 deny ip 192.168.142.176 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.173.1.107/24 (up)", "Routing: OSPF enabled on 10.173.1.10/24 area 0", "ACL 131: deny traffic from 192.168.142.176"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.173.1.107/24 is up, and ACL 131 denys traffic from 192.168.142.176."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.188.119.95 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.188.119.0.0.0.255 area 0\naccess-list 115 permit ip 192.168.18.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.188.119.95/24 (down)", "Routing: OSPF enabled on 10.188.119.0/24 area 0", "ACL 115: permit traffic from 192.168.18.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.188.119.95/24 is down, and ACL 115 permits traffic from 192.168.18.59."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.105.182.57 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.105.182.0.0.0.255 area 0\naccess-list 180 permit ip 192.168.53.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.105.182.57/24 (up)", "Routing: OSPF enabled on 10.105.182.0/24 area 0", "ACL 180: permit traffic from 192.168.53.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.105.182.57/24 is up, and ACL 180 permits traffic from 192.168.53.94."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.216.231.188 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.216.231.10.0.0.255 area 0\naccess-list 131 permit ip 192.168.56.66 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.216.231.188/24 (up)", "Routing: OSPF enabled on 10.216.231.10/24 area 0", "ACL 131: permit traffic from 192.168.56.66"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.216.231.188/24 is up, and ACL 131 permits traffic from 192.168.56.66."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.98.92.245 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.98.92.20.0.0.255 area 0\naccess-list 192 permit ip 192.168.43.115 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.98.92.245/24 (up)", "Routing: OSPF enabled on 10.98.92.20/24 area 0", "ACL 192: permit traffic from 192.168.43.115"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.98.92.245/24 is up, and ACL 192 permits traffic from 192.168.43.115."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.33.113.160 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.33.113.10.0.0.255 area 0\naccess-list 188 deny ip 192.168.127.41 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.33.113.160/24 (down)", "Routing: OSPF enabled on 10.33.113.10/24 area 0", "ACL 188: deny traffic from 192.168.127.41"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.33.113.160/24 is down, and ACL 188 denys traffic from 192.168.127.41."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.184.84.137 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.184.84.10.0.0.255 area 0\naccess-list 105 deny ip 192.168.27.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.184.84.137/24 (down)", "Routing: OSPF enabled on 10.184.84.10/24 area 0", "ACL 105: deny traffic from 192.168.27.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.184.84.137/24 is down, and ACL 105 denys traffic from 192.168.27.121."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.38.99.34 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.38.99.0.0.0.255 area 0\naccess-list 158 deny ip 192.168.116.244 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.38.99.34/24 (down)", "Routing: OSPF enabled on 10.38.99.0/24 area 0", "ACL 158: deny traffic from 192.168.116.244"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.38.99.34/24 is down, and ACL 158 denys traffic from 192.168.116.244."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.11.173.77 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.11.173.0.0.0.255 area 0\naccess-list 102 deny ip 192.168.129.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.11.173.77/24 (down)", "Routing: OSPF enabled on 10.11.173.0/24 area 0", "ACL 102: deny traffic from 192.168.129.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.11.173.77/24 is down, and ACL 102 denys traffic from 192.168.129.199."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.21.23.116 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.21.23.10.0.0.255 area 0\naccess-list 146 permit ip 192.168.13.201 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.21.23.116/24 (down)", "Routing: OSPF enabled on 10.21.23.10/24 area 0", "ACL 146: permit traffic from 192.168.13.201"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.21.23.116/24 is down, and ACL 146 permits traffic from 192.168.13.201."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.117.37.112 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.117.37.10.0.0.255 area 0\naccess-list 125 permit ip 192.168.99.119 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.117.37.112/24 (up)", "Routing: OSPF enabled on 10.117.37.10/24 area 0", "ACL 125: permit traffic from 192.168.99.119"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.117.37.112/24 is up, and ACL 125 permits traffic from 192.168.99.119."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.55.126.230 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.55.126.20.0.0.255 area 0\naccess-list 100 permit ip 192.168.43.30 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.55.126.230/24 (up)", "Routing: OSPF enabled on 10.55.126.20/24 area 0", "ACL 100: permit traffic from 192.168.43.30"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.55.126.230/24 is up, and ACL 100 permits traffic from 192.168.43.30."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.188.201.156 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.188.201.10.0.0.255 area 0\naccess-list 135 deny ip 192.168.171.58 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.188.201.156/24 (up)", "Routing: OSPF enabled on 10.188.201.10/24 area 0", "ACL 135: deny traffic from 192.168.171.58"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.188.201.156/24 is up, and ACL 135 denys traffic from 192.168.171.58."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.70.41.166 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.70.41.10.0.0.255 area 0\naccess-list 192 permit ip 192.168.131.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.70.41.166/24 (down)", "Routing: OSPF enabled on 10.70.41.10/24 area 0", "ACL 192: permit traffic from 192.168.131.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.70.41.166/24 is down, and ACL 192 permits traffic from 192.168.131.222."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.52.245.36 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.52.245.0.0.0.255 area 0\naccess-list 163 deny ip 192.168.202.64 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.52.245.36/24 (up)", "Routing: OSPF enabled on 10.52.245.0/24 area 0", "ACL 163: deny traffic from 192.168.202.64"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.52.245.36/24 is up, and ACL 163 denys traffic from 192.168.202.64."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.68.253.33 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.68.253.0.0.0.255 area 0\naccess-list 174 permit ip 192.168.177.235 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.68.253.33/24 (up)", "Routing: OSPF enabled on 10.68.253.0/24 area 0", "ACL 174: permit traffic from 192.168.177.235"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.68.253.33/24 is up, and ACL 174 permits traffic from 192.168.177.235."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.46.32.120 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.46.32.10.0.0.255 area 0\naccess-list 134 permit ip 192.168.52.252 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.46.32.120/24 (up)", "Routing: OSPF enabled on 10.46.32.10/24 area 0", "ACL 134: permit traffic from 192.168.52.252"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.46.32.120/24 is up, and ACL 134 permits traffic from 192.168.52.252."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.50.64.16 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.50.64.0.0.0.255 area 0\naccess-list 145 deny ip 192.168.1.63 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.50.64.16/24 (down)", "Routing: OSPF enabled on 10.50.64.0/24 area 0", "ACL 145: deny traffic from 192.168.1.63"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.50.64.16/24 is down, and ACL 145 denys traffic from 192.168.1.63."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.12.211.100 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.12.211.10.0.0.255 area 0\naccess-list 160 permit ip 192.168.7.229 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.12.211.100/24 (up)", "Routing: OSPF enabled on 10.12.211.10/24 area 0", "ACL 160: permit traffic from 192.168.7.229"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.12.211.100/24 is up, and ACL 160 permits traffic from 192.168.7.229."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.79.208.251 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.79.208.20.0.0.255 area 0\naccess-list 172 permit ip 192.168.117.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.79.208.251/24 (up)", "Routing: OSPF enabled on 10.79.208.20/24 area 0", "ACL 172: permit traffic from 192.168.117.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.79.208.251/24 is up, and ACL 172 permits traffic from 192.168.117.67."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.233.175.73 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.233.175.0.0.0.255 area 0\naccess-list 141 deny ip 192.168.152.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.233.175.73/24 (up)", "Routing: OSPF enabled on 10.233.175.0/24 area 0", "ACL 141: deny traffic from 192.168.152.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.233.175.73/24 is up, and ACL 141 denys traffic from 192.168.152.148."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.66.213.152 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.66.213.10.0.0.255 area 0\naccess-list 154 permit ip 192.168.73.203 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.66.213.152/24 (up)", "Routing: OSPF enabled on 10.66.213.10/24 area 0", "ACL 154: permit traffic from 192.168.73.203"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.66.213.152/24 is up, and ACL 154 permits traffic from 192.168.73.203."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.225.88.110 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.225.88.10.0.0.255 area 0\naccess-list 158 deny ip 192.168.230.1 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.225.88.110/24 (down)", "Routing: OSPF enabled on 10.225.88.10/24 area 0", "ACL 158: deny traffic from 192.168.230.1"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.225.88.110/24 is down, and ACL 158 denys traffic from 192.168.230.1."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.130.36.183 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.130.36.10.0.0.255 area 0\naccess-list 182 permit ip 192.168.93.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.130.36.183/24 (up)", "Routing: OSPF enabled on 10.130.36.10/24 area 0", "ACL 182: permit traffic from 192.168.93.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.130.36.183/24 is up, and ACL 182 permits traffic from 192.168.93.238."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.130.131.195 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.130.131.10.0.0.255 area 0\naccess-list 188 permit ip 192.168.73.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.130.131.195/24 (up)", "Routing: OSPF enabled on 10.130.131.10/24 area 0", "ACL 188: permit traffic from 192.168.73.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.130.131.195/24 is up, and ACL 188 permits traffic from 192.168.73.11."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.250.120.101 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.250.120.10.0.0.255 area 0\naccess-list 187 permit ip 192.168.241.51 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.250.120.101/24 (down)", "Routing: OSPF enabled on 10.250.120.10/24 area 0", "ACL 187: permit traffic from 192.168.241.51"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.250.120.101/24 is down, and ACL 187 permits traffic from 192.168.241.51."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.21.68.86 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.21.68.0.0.0.255 area 0\naccess-list 117 permit ip 192.168.185.132 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.21.68.86/24 (up)", "Routing: OSPF enabled on 10.21.68.0/24 area 0", "ACL 117: permit traffic from 192.168.185.132"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.21.68.86/24 is up, and ACL 117 permits traffic from 192.168.185.132."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.64.15.100 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.64.15.10.0.0.255 area 0\naccess-list 179 deny ip 192.168.156.74 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.64.15.100/24 (down)", "Routing: OSPF enabled on 10.64.15.10/24 area 0", "ACL 179: deny traffic from 192.168.156.74"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.64.15.100/24 is down, and ACL 179 denys traffic from 192.168.156.74."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.26.147.124 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.26.147.10.0.0.255 area 0\naccess-list 146 permit ip 192.168.178.132 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.26.147.124/24 (up)", "Routing: OSPF enabled on 10.26.147.10/24 area 0", "ACL 146: permit traffic from 192.168.178.132"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.26.147.124/24 is up, and ACL 146 permits traffic from 192.168.178.132."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.184.164.250 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.184.164.20.0.0.255 area 0\naccess-list 196 deny ip 192.168.57.132 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.184.164.250/24 (down)", "Routing: OSPF enabled on 10.184.164.20/24 area 0", "ACL 196: deny traffic from 192.168.57.132"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.184.164.250/24 is down, and ACL 196 denys traffic from 192.168.57.132."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.145.101.109 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.145.101.10.0.0.255 area 0\naccess-list 105 permit ip 192.168.187.98 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.145.101.109/24 (up)", "Routing: OSPF enabled on 10.145.101.10/24 area 0", "ACL 105: permit traffic from 192.168.187.98"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.145.101.109/24 is up, and ACL 105 permits traffic from 192.168.187.98."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.42.49.40 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.42.49.0.0.0.255 area 0\naccess-list 161 permit ip 192.168.92.71 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.42.49.40/24 (up)", "Routing: OSPF enabled on 10.42.49.0/24 area 0", "ACL 161: permit traffic from 192.168.92.71"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.42.49.40/24 is up, and ACL 161 permits traffic from 192.168.92.71."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.226.250.167 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.226.250.10.0.0.255 area 0\naccess-list 156 deny ip 192.168.211.200 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.226.250.167/24 (up)", "Routing: OSPF enabled on 10.226.250.10/24 area 0", "ACL 156: deny traffic from 192.168.211.200"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.226.250.167/24 is up, and ACL 156 denys traffic from 192.168.211.200."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.48.49.78 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.48.49.0.0.0.255 area 0\naccess-list 190 deny ip 192.168.12.153 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.48.49.78/24 (down)", "Routing: OSPF enabled on 10.48.49.0/24 area 0", "ACL 190: deny traffic from 192.168.12.153"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.48.49.78/24 is down, and ACL 190 denys traffic from 192.168.12.153."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.59.204.101 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.59.204.10.0.0.255 area 0\naccess-list 125 deny ip 192.168.224.36 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.59.204.101/24 (down)", "Routing: OSPF enabled on 10.59.204.10/24 area 0", "ACL 125: deny traffic from 192.168.224.36"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.59.204.101/24 is down, and ACL 125 denys traffic from 192.168.224.36."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.86.214.230 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.86.214.20.0.0.255 area 0\naccess-list 186 deny ip 192.168.129.2 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.86.214.230/24 (down)", "Routing: OSPF enabled on 10.86.214.20/24 area 0", "ACL 186: deny traffic from 192.168.129.2"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.86.214.230/24 is down, and ACL 186 denys traffic from 192.168.129.2."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.252.135.129 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.252.135.10.0.0.255 area 0\naccess-list 133 permit ip 192.168.57.103 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.252.135.129/24 (up)", "Routing: OSPF enabled on 10.252.135.10/24 area 0", "ACL 133: permit traffic from 192.168.57.103"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.252.135.129/24 is up, and ACL 133 permits traffic from 192.168.57.103."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.56.66.21 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.56.66.0.0.0.255 area 0\naccess-list 187 permit ip 192.168.164.5 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.56.66.21/24 (up)", "Routing: OSPF enabled on 10.56.66.0/24 area 0", "ACL 187: permit traffic from 192.168.164.5"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.56.66.21/24 is up, and ACL 187 permits traffic from 192.168.164.5."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.165.191.252 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.165.191.20.0.0.255 area 0\naccess-list 199 deny ip 192.168.154.118 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.165.191.252/24 (down)", "Routing: OSPF enabled on 10.165.191.20/24 area 0", "ACL 199: deny traffic from 192.168.154.118"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.165.191.252/24 is down, and ACL 199 denys traffic from 192.168.154.118."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.236.100.77 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.236.100.0.0.0.255 area 0\naccess-list 115 deny ip 192.168.137.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.236.100.77/24 (down)", "Routing: OSPF enabled on 10.236.100.0/24 area 0", "ACL 115: deny traffic from 192.168.137.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.236.100.77/24 is down, and ACL 115 denys traffic from 192.168.137.242."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.208.240.102 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.208.240.10.0.0.255 area 0\naccess-list 171 permit ip 192.168.88.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.208.240.102/24 (up)", "Routing: OSPF enabled on 10.208.240.10/24 area 0", "ACL 171: permit traffic from 192.168.88.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.208.240.102/24 is up, and ACL 171 permits traffic from 192.168.88.53."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.245.152.33 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.245.152.0.0.0.255 area 0\naccess-list 162 permit ip 192.168.102.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.245.152.33/24 (down)", "Routing: OSPF enabled on 10.245.152.0/24 area 0", "ACL 162: permit traffic from 192.168.102.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.245.152.33/24 is down, and ACL 162 permits traffic from 192.168.102.157."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.247.239.14 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.247.239.0.0.0.255 area 0\naccess-list 198 deny ip 192.168.228.138 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.247.239.14/24 (down)", "Routing: OSPF enabled on 10.247.239.0/24 area 0", "ACL 198: deny traffic from 192.168.228.138"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.247.239.14/24 is down, and ACL 198 denys traffic from 192.168.228.138."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.63.193.27 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.63.193.0.0.0.255 area 0\naccess-list 190 deny ip 192.168.239.27 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.63.193.27/24 (down)", "Routing: OSPF enabled on 10.63.193.0/24 area 0", "ACL 190: deny traffic from 192.168.239.27"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.63.193.27/24 is down, and ACL 190 denys traffic from 192.168.239.27."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.27.169.183 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.27.169.10.0.0.255 area 0\naccess-list 105 deny ip 192.168.190.248 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.27.169.183/24 (down)", "Routing: OSPF enabled on 10.27.169.10/24 area 0", "ACL 105: deny traffic from 192.168.190.248"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.27.169.183/24 is down, and ACL 105 denys traffic from 192.168.190.248."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.54.224.158 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.54.224.10.0.0.255 area 0\naccess-list 139 deny ip 192.168.255.229 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.54.224.158/24 (up)", "Routing: OSPF enabled on 10.54.224.10/24 area 0", "ACL 139: deny traffic from 192.168.255.229"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.54.224.158/24 is up, and ACL 139 denys traffic from 192.168.255.229."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.208.31.49 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.208.31.0.0.0.255 area 0\naccess-list 108 deny ip 192.168.142.165 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.208.31.49/24 (up)", "Routing: OSPF enabled on 10.208.31.0/24 area 0", "ACL 108: deny traffic from 192.168.142.165"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.208.31.49/24 is up, and ACL 108 denys traffic from 192.168.142.165."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.90.135.117 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.90.135.10.0.0.255 area 0\naccess-list 173 deny ip 192.168.121.224 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.90.135.117/24 (up)", "Routing: OSPF enabled on 10.90.135.10/24 area 0", "ACL 173: deny traffic from 192.168.121.224"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.90.135.117/24 is up, and ACL 173 denys traffic from 192.168.121.224."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.151.222.193 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.151.222.10.0.0.255 area 0\naccess-list 178 deny ip 192.168.212.91 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.151.222.193/24 (up)", "Routing: OSPF enabled on 10.151.222.10/24 area 0", "ACL 178: deny traffic from 192.168.212.91"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.151.222.193/24 is up, and ACL 178 denys traffic from 192.168.212.91."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.149.27.106 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.149.27.10.0.0.255 area 0\naccess-list 156 deny ip 192.168.89.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.149.27.106/24 (down)", "Routing: OSPF enabled on 10.149.27.10/24 area 0", "ACL 156: deny traffic from 192.168.89.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.149.27.106/24 is down, and ACL 156 denys traffic from 192.168.89.136."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.32.244.153 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.32.244.10.0.0.255 area 0\naccess-list 193 deny ip 192.168.249.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.32.244.153/24 (up)", "Routing: OSPF enabled on 10.32.244.10/24 area 0", "ACL 193: deny traffic from 192.168.249.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.32.244.153/24 is up, and ACL 193 denys traffic from 192.168.249.48."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.121.150.93 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.121.150.0.0.0.255 area 0\naccess-list 168 permit ip 192.168.161.214 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.121.150.93/24 (up)", "Routing: OSPF enabled on 10.121.150.0/24 area 0", "ACL 168: permit traffic from 192.168.161.214"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.121.150.93/24 is up, and ACL 168 permits traffic from 192.168.161.214."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.205.241.18 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.205.241.0.0.0.255 area 0\naccess-list 194 deny ip 192.168.115.182 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.205.241.18/24 (up)", "Routing: OSPF enabled on 10.205.241.0/24 area 0", "ACL 194: deny traffic from 192.168.115.182"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.205.241.18/24 is up, and ACL 194 denys traffic from 192.168.115.182."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.37.17.227 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.37.17.20.0.0.255 area 0\naccess-list 138 deny ip 192.168.221.198 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.37.17.227/24 (down)", "Routing: OSPF enabled on 10.37.17.20/24 area 0", "ACL 138: deny traffic from 192.168.221.198"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.37.17.227/24 is down, and ACL 138 denys traffic from 192.168.221.198."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.181.58.38 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.181.58.0.0.0.255 area 0\naccess-list 130 permit ip 192.168.198.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.181.58.38/24 (up)", "Routing: OSPF enabled on 10.181.58.0/24 area 0", "ACL 130: permit traffic from 192.168.198.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.181.58.38/24 is up, and ACL 130 permits traffic from 192.168.198.53."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.183.89.217 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.183.89.20.0.0.255 area 0\naccess-list 189 permit ip 192.168.60.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.183.89.217/24 (up)", "Routing: OSPF enabled on 10.183.89.20/24 area 0", "ACL 189: permit traffic from 192.168.60.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.183.89.217/24 is up, and ACL 189 permits traffic from 192.168.60.37."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.12.235.170 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.12.235.10.0.0.255 area 0\naccess-list 173 permit ip 192.168.49.130 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.12.235.170/24 (down)", "Routing: OSPF enabled on 10.12.235.10/24 area 0", "ACL 173: permit traffic from 192.168.49.130"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.12.235.170/24 is down, and ACL 173 permits traffic from 192.168.49.130."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.177.178.51 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.177.178.0.0.0.255 area 0\naccess-list 125 deny ip 192.168.45.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.177.178.51/24 (down)", "Routing: OSPF enabled on 10.177.178.0/24 area 0", "ACL 125: deny traffic from 192.168.45.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.177.178.51/24 is down, and ACL 125 denys traffic from 192.168.45.9."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.20.8.192 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.20.8.10.0.0.255 area 0\naccess-list 193 deny ip 192.168.229.83 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.20.8.192/24 (up)", "Routing: OSPF enabled on 10.20.8.10/24 area 0", "ACL 193: deny traffic from 192.168.229.83"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.20.8.192/24 is up, and ACL 193 denys traffic from 192.168.229.83."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.40.173.240 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.40.173.20.0.0.255 area 0\naccess-list 117 deny ip 192.168.126.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.40.173.240/24 (up)", "Routing: OSPF enabled on 10.40.173.20/24 area 0", "ACL 117: deny traffic from 192.168.126.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.40.173.240/24 is up, and ACL 117 denys traffic from 192.168.126.78."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.245.3.234 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.245.3.20.0.0.255 area 0\naccess-list 102 permit ip 192.168.59.235 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.245.3.234/24 (up)", "Routing: OSPF enabled on 10.245.3.20/24 area 0", "ACL 102: permit traffic from 192.168.59.235"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.245.3.234/24 is up, and ACL 102 permits traffic from 192.168.59.235."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.45.210.126 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.45.210.10.0.0.255 area 0\naccess-list 175 deny ip 192.168.185.83 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.45.210.126/24 (down)", "Routing: OSPF enabled on 10.45.210.10/24 area 0", "ACL 175: deny traffic from 192.168.185.83"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.45.210.126/24 is down, and ACL 175 denys traffic from 192.168.185.83."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.28.90.26 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.28.90.0.0.0.255 area 0\naccess-list 178 deny ip 192.168.124.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.28.90.26/24 (down)", "Routing: OSPF enabled on 10.28.90.0/24 area 0", "ACL 178: deny traffic from 192.168.124.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.28.90.26/24 is down, and ACL 178 denys traffic from 192.168.124.152."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.136.148.231 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.136.148.20.0.0.255 area 0\naccess-list 155 deny ip 192.168.85.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.136.148.231/24 (down)", "Routing: OSPF enabled on 10.136.148.20/24 area 0", "ACL 155: deny traffic from 192.168.85.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.136.148.231/24 is down, and ACL 155 denys traffic from 192.168.85.136."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.43.97.84 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.43.97.0.0.0.255 area 0\naccess-list 108 permit ip 192.168.175.225 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.43.97.84/24 (down)", "Routing: OSPF enabled on 10.43.97.0/24 area 0", "ACL 108: permit traffic from 192.168.175.225"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.43.97.84/24 is down, and ACL 108 permits traffic from 192.168.175.225."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.24.26.57 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.24.26.0.0.0.255 area 0\naccess-list 125 permit ip 192.168.46.131 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.24.26.57/24 (down)", "Routing: OSPF enabled on 10.24.26.0/24 area 0", "ACL 125: permit traffic from 192.168.46.131"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.24.26.57/24 is down, and ACL 125 permits traffic from 192.168.46.131."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.42.55.193 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.42.55.10.0.0.255 area 0\naccess-list 186 permit ip 192.168.2.0 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.42.55.193/24 (up)", "Routing: OSPF enabled on 10.42.55.10/24 area 0", "ACL 186: permit traffic from 192.168.2.0"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.42.55.193/24 is up, and ACL 186 permits traffic from 192.168.2.0."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.132.55.34 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.132.55.0.0.0.255 area 0\naccess-list 172 deny ip 192.168.213.45 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.132.55.34/24 (down)", "Routing: OSPF enabled on 10.132.55.0/24 area 0", "ACL 172: deny traffic from 192.168.213.45"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.132.55.34/24 is down, and ACL 172 denys traffic from 192.168.213.45."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.181.79.82 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.181.79.0.0.0.255 area 0\naccess-list 199 deny ip 192.168.124.177 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.181.79.82/24 (down)", "Routing: OSPF enabled on 10.181.79.0/24 area 0", "ACL 199: deny traffic from 192.168.124.177"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.181.79.82/24 is down, and ACL 199 denys traffic from 192.168.124.177."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.157.40.226 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.157.40.20.0.0.255 area 0\naccess-list 126 deny ip 192.168.130.175 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.157.40.226/24 (down)", "Routing: OSPF enabled on 10.157.40.20/24 area 0", "ACL 126: deny traffic from 192.168.130.175"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.157.40.226/24 is down, and ACL 126 denys traffic from 192.168.130.175."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.130.91.242 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.130.91.20.0.0.255 area 0\naccess-list 192 permit ip 192.168.31.36 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.130.91.242/24 (down)", "Routing: OSPF enabled on 10.130.91.20/24 area 0", "ACL 192: permit traffic from 192.168.31.36"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.130.91.242/24 is down, and ACL 192 permits traffic from 192.168.31.36."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.115.6.108 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.115.6.10.0.0.255 area 0\naccess-list 191 permit ip 192.168.189.29 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.115.6.108/24 (up)", "Routing: OSPF enabled on 10.115.6.10/24 area 0", "ACL 191: permit traffic from 192.168.189.29"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.115.6.108/24 is up, and ACL 191 permits traffic from 192.168.189.29."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.250.70.41 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.250.70.0.0.0.255 area 0\naccess-list 156 deny ip 192.168.244.175 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.250.70.41/24 (down)", "Routing: OSPF enabled on 10.250.70.0/24 area 0", "ACL 156: deny traffic from 192.168.244.175"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.250.70.41/24 is down, and ACL 156 denys traffic from 192.168.244.175."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.244.130.129 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.244.130.10.0.0.255 area 0\naccess-list 147 permit ip 192.168.92.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.244.130.129/24 (up)", "Routing: OSPF enabled on 10.244.130.10/24 area 0", "ACL 147: permit traffic from 192.168.92.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.244.130.129/24 is up, and ACL 147 permits traffic from 192.168.92.9."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.97.221.3 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.97.2210.0.0.255 area 0\naccess-list 141 permit ip 192.168.208.22 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.97.221.3/24 (down)", "Routing: OSPF enabled on 10.97.2210/24 area 0", "ACL 141: permit traffic from 192.168.208.22"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.97.221.3/24 is down, and ACL 141 permits traffic from 192.168.208.22."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.218.133.220 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.218.133.20.0.0.255 area 0\naccess-list 108 deny ip 192.168.28.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.218.133.220/24 (up)", "Routing: OSPF enabled on 10.218.133.20/24 area 0", "ACL 108: deny traffic from 192.168.28.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.218.133.220/24 is up, and ACL 108 denys traffic from 192.168.28.106."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.19.169.68 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.19.169.0.0.0.255 area 0\naccess-list 195 deny ip 192.168.192.149 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.19.169.68/24 (down)", "Routing: OSPF enabled on 10.19.169.0/24 area 0", "ACL 195: deny traffic from 192.168.192.149"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.19.169.68/24 is down, and ACL 195 denys traffic from 192.168.192.149."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.33.20.118 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.33.20.10.0.0.255 area 0\naccess-list 184 deny ip 192.168.244.153 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.33.20.118/24 (down)", "Routing: OSPF enabled on 10.33.20.10/24 area 0", "ACL 184: deny traffic from 192.168.244.153"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.33.20.118/24 is down, and ACL 184 denys traffic from 192.168.244.153."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.8.237.22 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.8.237.0.0.0.255 area 0\naccess-list 176 permit ip 192.168.144.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.8.237.22/24 (down)", "Routing: OSPF enabled on 10.8.237.0/24 area 0", "ACL 176: permit traffic from 192.168.144.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.8.237.22/24 is down, and ACL 176 permits traffic from 192.168.144.113."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.157.201.8 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.157.2010.0.0.255 area 0\naccess-list 132 permit ip 192.168.204.197 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.157.201.8/24 (down)", "Routing: OSPF enabled on 10.157.2010/24 area 0", "ACL 132: permit traffic from 192.168.204.197"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.157.201.8/24 is down, and ACL 132 permits traffic from 192.168.204.197."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.22.185.254 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.22.185.20.0.0.255 area 0\naccess-list 125 deny ip 192.168.223.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.22.185.254/24 (up)", "Routing: OSPF enabled on 10.22.185.20/24 area 0", "ACL 125: deny traffic from 192.168.223.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.22.185.254/24 is up, and ACL 125 denys traffic from 192.168.223.40."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.134.78.133 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.134.78.10.0.0.255 area 0\naccess-list 100 permit ip 192.168.110.128 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.134.78.133/24 (up)", "Routing: OSPF enabled on 10.134.78.10/24 area 0", "ACL 100: permit traffic from 192.168.110.128"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.134.78.133/24 is up, and ACL 100 permits traffic from 192.168.110.128."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.58.109.3 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.58.1090.0.0.255 area 0\naccess-list 187 permit ip 192.168.179.86 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.58.109.3/24 (down)", "Routing: OSPF enabled on 10.58.1090/24 area 0", "ACL 187: permit traffic from 192.168.179.86"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.58.109.3/24 is down, and ACL 187 permits traffic from 192.168.179.86."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.236.7.141 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.236.7.10.0.0.255 area 0\naccess-list 127 permit ip 192.168.74.61 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.236.7.141/24 (down)", "Routing: OSPF enabled on 10.236.7.10/24 area 0", "ACL 127: permit traffic from 192.168.74.61"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.236.7.141/24 is down, and ACL 127 permits traffic from 192.168.74.61."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.239.37.246 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.239.37.20.0.0.255 area 0\naccess-list 137 permit ip 192.168.109.134 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.239.37.246/24 (down)", "Routing: OSPF enabled on 10.239.37.20/24 area 0", "ACL 137: permit traffic from 192.168.109.134"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.239.37.246/24 is down, and ACL 137 permits traffic from 192.168.109.134."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.107.1.145 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.107.1.10.0.0.255 area 0\naccess-list 187 permit ip 192.168.30.168 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.107.1.145/24 (down)", "Routing: OSPF enabled on 10.107.1.10/24 area 0", "ACL 187: permit traffic from 192.168.30.168"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.107.1.145/24 is down, and ACL 187 permits traffic from 192.168.30.168."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.46.164.25 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.46.164.0.0.0.255 area 0\naccess-list 166 deny ip 192.168.234.198 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.46.164.25/24 (up)", "Routing: OSPF enabled on 10.46.164.0/24 area 0", "ACL 166: deny traffic from 192.168.234.198"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.46.164.25/24 is up, and ACL 166 denys traffic from 192.168.234.198."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.39.168.224 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.39.168.20.0.0.255 area 0\naccess-list 114 permit ip 192.168.40.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.39.168.224/24 (up)", "Routing: OSPF enabled on 10.39.168.20/24 area 0", "ACL 114: permit traffic from 192.168.40.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.39.168.224/24 is up, and ACL 114 permits traffic from 192.168.40.254."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.96.117.106 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.96.117.10.0.0.255 area 0\naccess-list 173 permit ip 192.168.131.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.96.117.106/24 (up)", "Routing: OSPF enabled on 10.96.117.10/24 area 0", "ACL 173: permit traffic from 192.168.131.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.96.117.106/24 is up, and ACL 173 permits traffic from 192.168.131.106."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.11.92.72 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.11.92.0.0.0.255 area 0\naccess-list 158 deny ip 192.168.203.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.11.92.72/24 (up)", "Routing: OSPF enabled on 10.11.92.0/24 area 0", "ACL 158: deny traffic from 192.168.203.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.11.92.72/24 is up, and ACL 158 denys traffic from 192.168.203.9."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.0.26.250 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.0.26.20.0.0.255 area 0\naccess-list 157 permit ip 192.168.120.71 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.0.26.250/24 (down)", "Routing: OSPF enabled on 10.0.26.20/24 area 0", "ACL 157: permit traffic from 192.168.120.71"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.0.26.250/24 is down, and ACL 157 permits traffic from 192.168.120.71."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.175.213.34 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.175.213.0.0.0.255 area 0\naccess-list 178 permit ip 192.168.118.24 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.175.213.34/24 (up)", "Routing: OSPF enabled on 10.175.213.0/24 area 0", "ACL 178: permit traffic from 192.168.118.24"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.175.213.34/24 is up, and ACL 178 permits traffic from 192.168.118.24."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.179.140.115 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.179.140.10.0.0.255 area 0\naccess-list 126 deny ip 192.168.192.46 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.179.140.115/24 (up)", "Routing: OSPF enabled on 10.179.140.10/24 area 0", "ACL 126: deny traffic from 192.168.192.46"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.179.140.115/24 is up, and ACL 126 denys traffic from 192.168.192.46."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.127.45.170 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.127.45.10.0.0.255 area 0\naccess-list 196 permit ip 192.168.17.48 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.127.45.170/24 (up)", "Routing: OSPF enabled on 10.127.45.10/24 area 0", "ACL 196: permit traffic from 192.168.17.48"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.127.45.170/24 is up, and ACL 196 permits traffic from 192.168.17.48."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.227.38.115 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.227.38.10.0.0.255 area 0\naccess-list 123 permit ip 192.168.88.6 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.227.38.115/24 (up)", "Routing: OSPF enabled on 10.227.38.10/24 area 0", "ACL 123: permit traffic from 192.168.88.6"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.227.38.115/24 is up, and ACL 123 permits traffic from 192.168.88.6."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.141.37.71 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.141.37.0.0.0.255 area 0\naccess-list 178 deny ip 192.168.89.118 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.141.37.71/24 (up)", "Routing: OSPF enabled on 10.141.37.0/24 area 0", "ACL 178: deny traffic from 192.168.89.118"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.141.37.71/24 is up, and ACL 178 denys traffic from 192.168.89.118."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.78.203.25 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.78.203.0.0.0.255 area 0\naccess-list 168 deny ip 192.168.195.195 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.78.203.25/24 (up)", "Routing: OSPF enabled on 10.78.203.0/24 area 0", "ACL 168: deny traffic from 192.168.195.195"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.78.203.25/24 is up, and ACL 168 denys traffic from 192.168.195.195."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.67.193.96 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.67.193.0.0.0.255 area 0\naccess-list 156 deny ip 192.168.44.160 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.67.193.96/24 (up)", "Routing: OSPF enabled on 10.67.193.0/24 area 0", "ACL 156: deny traffic from 192.168.44.160"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.67.193.96/24 is up, and ACL 156 denys traffic from 192.168.44.160."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.117.159.175 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.117.159.10.0.0.255 area 0\naccess-list 182 deny ip 192.168.152.214 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.117.159.175/24 (down)", "Routing: OSPF enabled on 10.117.159.10/24 area 0", "ACL 182: deny traffic from 192.168.152.214"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.117.159.175/24 is down, and ACL 182 denys traffic from 192.168.152.214."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.248.79.30 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.248.79.0.0.0.255 area 0\naccess-list 108 permit ip 192.168.21.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.248.79.30/24 (down)", "Routing: OSPF enabled on 10.248.79.0/24 area 0", "ACL 108: permit traffic from 192.168.21.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.248.79.30/24 is down, and ACL 108 permits traffic from 192.168.21.204."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.30.223.7 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.30.2230.0.0.255 area 0\naccess-list 170 permit ip 192.168.196.102 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.30.223.7/24 (up)", "Routing: OSPF enabled on 10.30.2230/24 area 0", "ACL 170: permit traffic from 192.168.196.102"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.30.223.7/24 is up, and ACL 170 permits traffic from 192.168.196.102."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.52.241.32 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.52.241.0.0.0.255 area 0\naccess-list 125 permit ip 192.168.131.236 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.52.241.32/24 (up)", "Routing: OSPF enabled on 10.52.241.0/24 area 0", "ACL 125: permit traffic from 192.168.131.236"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.52.241.32/24 is up, and ACL 125 permits traffic from 192.168.131.236."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.79.183.139 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.79.183.10.0.0.255 area 0\naccess-list 182 permit ip 192.168.210.41 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.79.183.139/24 (up)", "Routing: OSPF enabled on 10.79.183.10/24 area 0", "ACL 182: permit traffic from 192.168.210.41"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.79.183.139/24 is up, and ACL 182 permits traffic from 192.168.210.41."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.158.95.70 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.158.95.0.0.0.255 area 0\naccess-list 153 deny ip 192.168.126.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.158.95.70/24 (down)", "Routing: OSPF enabled on 10.158.95.0/24 area 0", "ACL 153: deny traffic from 192.168.126.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.158.95.70/24 is down, and ACL 153 denys traffic from 192.168.126.120."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.90.40.239 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.90.40.20.0.0.255 area 0\naccess-list 182 permit ip 192.168.48.133 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.90.40.239/24 (up)", "Routing: OSPF enabled on 10.90.40.20/24 area 0", "ACL 182: permit traffic from 192.168.48.133"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.90.40.239/24 is up, and ACL 182 permits traffic from 192.168.48.133."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.202.117.223 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.202.117.20.0.0.255 area 0\naccess-list 156 deny ip 192.168.58.207 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.202.117.223/24 (up)", "Routing: OSPF enabled on 10.202.117.20/24 area 0", "ACL 156: deny traffic from 192.168.58.207"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.202.117.223/24 is up, and ACL 156 denys traffic from 192.168.58.207."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.33.6.29 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.33.6.0.0.0.255 area 0\naccess-list 118 deny ip 192.168.91.123 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.33.6.29/24 (down)", "Routing: OSPF enabled on 10.33.6.0/24 area 0", "ACL 118: deny traffic from 192.168.91.123"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.33.6.29/24 is down, and ACL 118 denys traffic from 192.168.91.123."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.152.73.17 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.152.73.0.0.0.255 area 0\naccess-list 172 deny ip 192.168.168.210 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.152.73.17/24 (down)", "Routing: OSPF enabled on 10.152.73.0/24 area 0", "ACL 172: deny traffic from 192.168.168.210"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.152.73.17/24 is down, and ACL 172 denys traffic from 192.168.168.210."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.228.22.82 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.228.22.0.0.0.255 area 0\naccess-list 194 permit ip 192.168.210.231 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.228.22.82/24 (up)", "Routing: OSPF enabled on 10.228.22.0/24 area 0", "ACL 194: permit traffic from 192.168.210.231"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.228.22.82/24 is up, and ACL 194 permits traffic from 192.168.210.231."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.151.248.96 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.151.248.0.0.0.255 area 0\naccess-list 103 deny ip 192.168.184.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.151.248.96/24 (down)", "Routing: OSPF enabled on 10.151.248.0/24 area 0", "ACL 103: deny traffic from 192.168.184.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.151.248.96/24 is down, and ACL 103 denys traffic from 192.168.184.220."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.249.126.200 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.249.126.20.0.0.255 area 0\naccess-list 134 deny ip 192.168.107.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.249.126.200/24 (up)", "Routing: OSPF enabled on 10.249.126.20/24 area 0", "ACL 134: deny traffic from 192.168.107.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.249.126.200/24 is up, and ACL 134 denys traffic from 192.168.107.155."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.176.62.95 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.176.62.0.0.0.255 area 0\naccess-list 129 permit ip 192.168.158.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.176.62.95/24 (up)", "Routing: OSPF enabled on 10.176.62.0/24 area 0", "ACL 129: permit traffic from 192.168.158.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.176.62.95/24 is up, and ACL 129 permits traffic from 192.168.158.185."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.26.46.89 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.26.46.0.0.0.255 area 0\naccess-list 144 permit ip 192.168.185.60 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.26.46.89/24 (up)", "Routing: OSPF enabled on 10.26.46.0/24 area 0", "ACL 144: permit traffic from 192.168.185.60"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.26.46.89/24 is up, and ACL 144 permits traffic from 192.168.185.60."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.162.0.12 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.162.0.0.0.0.255 area 0\naccess-list 148 deny ip 192.168.0.130 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.162.0.12/24 (up)", "Routing: OSPF enabled on 10.162.0.0/24 area 0", "ACL 148: deny traffic from 192.168.0.130"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.162.0.12/24 is up, and ACL 148 denys traffic from 192.168.0.130."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.42.138.204 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.42.138.20.0.0.255 area 0\naccess-list 109 deny ip 192.168.242.26 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.42.138.204/24 (down)", "Routing: OSPF enabled on 10.42.138.20/24 area 0", "ACL 109: deny traffic from 192.168.242.26"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.42.138.204/24 is down, and ACL 109 denys traffic from 192.168.242.26."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.28.83.171 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.28.83.10.0.0.255 area 0\naccess-list 155 permit ip 192.168.43.175 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.28.83.171/24 (up)", "Routing: OSPF enabled on 10.28.83.10/24 area 0", "ACL 155: permit traffic from 192.168.43.175"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.28.83.171/24 is up, and ACL 155 permits traffic from 192.168.43.175."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.246.102.194 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.246.102.10.0.0.255 area 0\naccess-list 161 permit ip 192.168.194.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.246.102.194/24 (up)", "Routing: OSPF enabled on 10.246.102.10/24 area 0", "ACL 161: permit traffic from 192.168.194.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.246.102.194/24 is up, and ACL 161 permits traffic from 192.168.194.92."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.114.129.106 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.114.129.10.0.0.255 area 0\naccess-list 100 deny ip 192.168.155.188 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.114.129.106/24 (down)", "Routing: OSPF enabled on 10.114.129.10/24 area 0", "ACL 100: deny traffic from 192.168.155.188"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.114.129.106/24 is down, and ACL 100 denys traffic from 192.168.155.188."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.199.165.36 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.199.165.0.0.0.255 area 0\naccess-list 115 deny ip 192.168.244.31 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.199.165.36/24 (up)", "Routing: OSPF enabled on 10.199.165.0/24 area 0", "ACL 115: deny traffic from 192.168.244.31"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.199.165.36/24 is up, and ACL 115 denys traffic from 192.168.244.31."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.200.110.66 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.200.110.0.0.0.255 area 0\naccess-list 132 permit ip 192.168.79.54 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.200.110.66/24 (down)", "Routing: OSPF enabled on 10.200.110.0/24 area 0", "ACL 132: permit traffic from 192.168.79.54"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.200.110.66/24 is down, and ACL 132 permits traffic from 192.168.79.54."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.196.107.181 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.196.107.10.0.0.255 area 0\naccess-list 104 deny ip 192.168.35.190 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.196.107.181/24 (up)", "Routing: OSPF enabled on 10.196.107.10/24 area 0", "ACL 104: deny traffic from 192.168.35.190"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.196.107.181/24 is up, and ACL 104 denys traffic from 192.168.35.190."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.82.163.146 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.82.163.10.0.0.255 area 0\naccess-list 120 deny ip 192.168.106.181 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.82.163.146/24 (up)", "Routing: OSPF enabled on 10.82.163.10/24 area 0", "ACL 120: deny traffic from 192.168.106.181"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.82.163.146/24 is up, and ACL 120 denys traffic from 192.168.106.181."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.215.255.249 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.215.255.20.0.0.255 area 0\naccess-list 132 permit ip 192.168.207.190 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.215.255.249/24 (up)", "Routing: OSPF enabled on 10.215.255.20/24 area 0", "ACL 132: permit traffic from 192.168.207.190"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.215.255.249/24 is up, and ACL 132 permits traffic from 192.168.207.190."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.133.92.34 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.133.92.0.0.0.255 area 0\naccess-list 195 permit ip 192.168.108.150 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.133.92.34/24 (down)", "Routing: OSPF enabled on 10.133.92.0/24 area 0", "ACL 195: permit traffic from 192.168.108.150"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.133.92.34/24 is down, and ACL 195 permits traffic from 192.168.108.150."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.64.114.204 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.64.114.20.0.0.255 area 0\naccess-list 166 permit ip 192.168.105.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.64.114.204/24 (up)", "Routing: OSPF enabled on 10.64.114.20/24 area 0", "ACL 166: permit traffic from 192.168.105.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.64.114.204/24 is up, and ACL 166 permits traffic from 192.168.105.67."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.63.8.74 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.63.8.0.0.0.255 area 0\naccess-list 136 deny ip 192.168.111.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.63.8.74/24 (up)", "Routing: OSPF enabled on 10.63.8.0/24 area 0", "ACL 136: deny traffic from 192.168.111.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.63.8.74/24 is up, and ACL 136 denys traffic from 192.168.111.234."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.185.230.128 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.185.230.10.0.0.255 area 0\naccess-list 127 permit ip 192.168.58.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.185.230.128/24 (up)", "Routing: OSPF enabled on 10.185.230.10/24 area 0", "ACL 127: permit traffic from 192.168.58.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.185.230.128/24 is up, and ACL 127 permits traffic from 192.168.58.11."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.13.237.119 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.13.237.10.0.0.255 area 0\naccess-list 196 permit ip 192.168.124.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.13.237.119/24 (up)", "Routing: OSPF enabled on 10.13.237.10/24 area 0", "ACL 196: permit traffic from 192.168.124.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.13.237.119/24 is up, and ACL 196 permits traffic from 192.168.124.117."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.14.131.200 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.14.131.20.0.0.255 area 0\naccess-list 149 deny ip 192.168.117.156 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.14.131.200/24 (up)", "Routing: OSPF enabled on 10.14.131.20/24 area 0", "ACL 149: deny traffic from 192.168.117.156"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.14.131.200/24 is up, and ACL 149 denys traffic from 192.168.117.156."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.205.41.73 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.205.41.0.0.0.255 area 0\naccess-list 174 permit ip 192.168.28.163 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.205.41.73/24 (down)", "Routing: OSPF enabled on 10.205.41.0/24 area 0", "ACL 174: permit traffic from 192.168.28.163"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.205.41.73/24 is down, and ACL 174 permits traffic from 192.168.28.163."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.205.52.154 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.205.52.10.0.0.255 area 0\naccess-list 121 permit ip 192.168.204.21 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.205.52.154/24 (up)", "Routing: OSPF enabled on 10.205.52.10/24 area 0", "ACL 121: permit traffic from 192.168.204.21"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.205.52.154/24 is up, and ACL 121 permits traffic from 192.168.204.21."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.245.208.222 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.245.208.20.0.0.255 area 0\naccess-list 131 deny ip 192.168.165.237 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.245.208.222/24 (up)", "Routing: OSPF enabled on 10.245.208.20/24 area 0", "ACL 131: deny traffic from 192.168.165.237"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.245.208.222/24 is up, and ACL 131 denys traffic from 192.168.165.237."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.109.41.201 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.109.41.20.0.0.255 area 0\naccess-list 147 permit ip 192.168.14.173 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.109.41.201/24 (up)", "Routing: OSPF enabled on 10.109.41.20/24 area 0", "ACL 147: permit traffic from 192.168.14.173"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.109.41.201/24 is up, and ACL 147 permits traffic from 192.168.14.173."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.180.20.89 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.180.20.0.0.0.255 area 0\naccess-list 191 permit ip 192.168.159.131 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.180.20.89/24 (down)", "Routing: OSPF enabled on 10.180.20.0/24 area 0", "ACL 191: permit traffic from 192.168.159.131"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.180.20.89/24 is down, and ACL 191 permits traffic from 192.168.159.131."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.238.53.34 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.238.53.0.0.0.255 area 0\naccess-list 131 deny ip 192.168.131.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.238.53.34/24 (up)", "Routing: OSPF enabled on 10.238.53.0/24 area 0", "ACL 131: deny traffic from 192.168.131.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.238.53.34/24 is up, and ACL 131 denys traffic from 192.168.131.192."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.189.1.149 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.189.1.10.0.0.255 area 0\naccess-list 144 deny ip 192.168.125.44 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.189.1.149/24 (down)", "Routing: OSPF enabled on 10.189.1.10/24 area 0", "ACL 144: deny traffic from 192.168.125.44"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.189.1.149/24 is down, and ACL 144 denys traffic from 192.168.125.44."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.65.201.124 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.65.201.10.0.0.255 area 0\naccess-list 152 permit ip 192.168.243.106 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.65.201.124/24 (up)", "Routing: OSPF enabled on 10.65.201.10/24 area 0", "ACL 152: permit traffic from 192.168.243.106"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.65.201.124/24 is up, and ACL 152 permits traffic from 192.168.243.106."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.148.73.215 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.148.73.20.0.0.255 area 0\naccess-list 173 permit ip 192.168.53.152 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.148.73.215/24 (down)", "Routing: OSPF enabled on 10.148.73.20/24 area 0", "ACL 173: permit traffic from 192.168.53.152"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.148.73.215/24 is down, and ACL 173 permits traffic from 192.168.53.152."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.186.88.207 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.186.88.20.0.0.255 area 0\naccess-list 182 permit ip 192.168.159.190 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.186.88.207/24 (up)", "Routing: OSPF enabled on 10.186.88.20/24 area 0", "ACL 182: permit traffic from 192.168.159.190"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.186.88.207/24 is up, and ACL 182 permits traffic from 192.168.159.190."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.102.81.110 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.102.81.10.0.0.255 area 0\naccess-list 164 deny ip 192.168.253.180 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.102.81.110/24 (up)", "Routing: OSPF enabled on 10.102.81.10/24 area 0", "ACL 164: deny traffic from 192.168.253.180"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.102.81.110/24 is up, and ACL 164 denys traffic from 192.168.253.180."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.129.199.96 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.129.199.0.0.0.255 area 0\naccess-list 187 permit ip 192.168.211.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.129.199.96/24 (down)", "Routing: OSPF enabled on 10.129.199.0/24 area 0", "ACL 187: permit traffic from 192.168.211.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.129.199.96/24 is down, and ACL 187 permits traffic from 192.168.211.37."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.27.97.145 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.27.97.10.0.0.255 area 0\naccess-list 175 deny ip 192.168.102.42 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.27.97.145/24 (up)", "Routing: OSPF enabled on 10.27.97.10/24 area 0", "ACL 175: deny traffic from 192.168.102.42"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.27.97.145/24 is up, and ACL 175 denys traffic from 192.168.102.42."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.57.12.36 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.57.12.0.0.0.255 area 0\naccess-list 117 deny ip 192.168.172.202 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.57.12.36/24 (up)", "Routing: OSPF enabled on 10.57.12.0/24 area 0", "ACL 117: deny traffic from 192.168.172.202"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.57.12.36/24 is up, and ACL 117 denys traffic from 192.168.172.202."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.148.41.230 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.148.41.20.0.0.255 area 0\naccess-list 196 deny ip 192.168.209.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.148.41.230/24 (down)", "Routing: OSPF enabled on 10.148.41.20/24 area 0", "ACL 196: deny traffic from 192.168.209.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.148.41.230/24 is down, and ACL 196 denys traffic from 192.168.209.114."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.214.191.252 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.214.191.20.0.0.255 area 0\naccess-list 152 permit ip 192.168.219.27 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.214.191.252/24 (down)", "Routing: OSPF enabled on 10.214.191.20/24 area 0", "ACL 152: permit traffic from 192.168.219.27"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.214.191.252/24 is down, and ACL 152 permits traffic from 192.168.219.27."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.84.4.210 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.84.4.20.0.0.255 area 0\naccess-list 125 permit ip 192.168.224.243 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.84.4.210/24 (down)", "Routing: OSPF enabled on 10.84.4.20/24 area 0", "ACL 125: permit traffic from 192.168.224.243"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.84.4.210/24 is down, and ACL 125 permits traffic from 192.168.224.243."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.174.4.227 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.174.4.20.0.0.255 area 0\naccess-list 162 permit ip 192.168.16.192 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.174.4.227/24 (up)", "Routing: OSPF enabled on 10.174.4.20/24 area 0", "ACL 162: permit traffic from 192.168.16.192"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.174.4.227/24 is up, and ACL 162 permits traffic from 192.168.16.192."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.73.4.43 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.73.4.0.0.0.255 area 0\naccess-list 180 permit ip 192.168.177.182 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.73.4.43/24 (down)", "Routing: OSPF enabled on 10.73.4.0/24 area 0", "ACL 180: permit traffic from 192.168.177.182"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.73.4.43/24 is down, and ACL 180 permits traffic from 192.168.177.182."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.193.13.161 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.193.13.10.0.0.255 area 0\naccess-list 132 permit ip 192.168.105.84 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.193.13.161/24 (up)", "Routing: OSPF enabled on 10.193.13.10/24 area 0", "ACL 132: permit traffic from 192.168.105.84"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.193.13.161/24 is up, and ACL 132 permits traffic from 192.168.105.84."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.4.220.37 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.4.220.0.0.0.255 area 0\naccess-list 188 deny ip 192.168.158.198 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.4.220.37/24 (down)", "Routing: OSPF enabled on 10.4.220.0/24 area 0", "ACL 188: deny traffic from 192.168.158.198"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.4.220.37/24 is down, and ACL 188 denys traffic from 192.168.158.198."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.221.108.218 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.221.108.20.0.0.255 area 0\naccess-list 110 permit ip 192.168.92.101 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.221.108.218/24 (up)", "Routing: OSPF enabled on 10.221.108.20/24 area 0", "ACL 110: permit traffic from 192.168.92.101"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.221.108.218/24 is up, and ACL 110 permits traffic from 192.168.92.101."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.75.78.219 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.75.78.20.0.0.255 area 0\naccess-list 105 deny ip 192.168.187.230 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.75.78.219/24 (down)", "Routing: OSPF enabled on 10.75.78.20/24 area 0", "ACL 105: deny traffic from 192.168.187.230"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.75.78.219/24 is down, and ACL 105 denys traffic from 192.168.187.230."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.5.255.54 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.5.255.0.0.0.255 area 0\naccess-list 198 deny ip 192.168.11.80 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.5.255.54/24 (up)", "Routing: OSPF enabled on 10.5.255.0/24 area 0", "ACL 198: deny traffic from 192.168.11.80"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.5.255.54/24 is up, and ACL 198 denys traffic from 192.168.11.80."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.196.95.140 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.196.95.10.0.0.255 area 0\naccess-list 173 deny ip 192.168.148.135 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.196.95.140/24 (down)", "Routing: OSPF enabled on 10.196.95.10/24 area 0", "ACL 173: deny traffic from 192.168.148.135"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.196.95.140/24 is down, and ACL 173 denys traffic from 192.168.148.135."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.234.90.9 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.234.900.0.0.255 area 0\naccess-list 147 permit ip 192.168.181.88 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.234.90.9/24 (up)", "Routing: OSPF enabled on 10.234.900/24 area 0", "ACL 147: permit traffic from 192.168.181.88"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.234.90.9/24 is up, and ACL 147 permits traffic from 192.168.181.88."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.132.179.97 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.132.179.0.0.0.255 area 0\naccess-list 128 deny ip 192.168.177.149 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.132.179.97/24 (down)", "Routing: OSPF enabled on 10.132.179.0/24 area 0", "ACL 128: deny traffic from 192.168.177.149"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.132.179.97/24 is down, and ACL 128 denys traffic from 192.168.177.149."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.27.199.233 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.27.199.20.0.0.255 area 0\naccess-list 162 deny ip 192.168.56.50 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.27.199.233/24 (up)", "Routing: OSPF enabled on 10.27.199.20/24 area 0", "ACL 162: deny traffic from 192.168.56.50"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.27.199.233/24 is up, and ACL 162 denys traffic from 192.168.56.50."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.234.2.90 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.234.2.0.0.0.255 area 0\naccess-list 184 permit ip 192.168.213.180 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.234.2.90/24 (up)", "Routing: OSPF enabled on 10.234.2.0/24 area 0", "ACL 184: permit traffic from 192.168.213.180"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.234.2.90/24 is up, and ACL 184 permits traffic from 192.168.213.180."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.65.248.40 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.65.248.0.0.0.255 area 0\naccess-list 168 permit ip 192.168.109.206 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.65.248.40/24 (down)", "Routing: OSPF enabled on 10.65.248.0/24 area 0", "ACL 168: permit traffic from 192.168.109.206"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.65.248.40/24 is down, and ACL 168 permits traffic from 192.168.109.206."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.108.171.221 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.108.171.20.0.0.255 area 0\naccess-list 190 permit ip 192.168.134.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.108.171.221/24 (down)", "Routing: OSPF enabled on 10.108.171.20/24 area 0", "ACL 190: permit traffic from 192.168.134.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.108.171.221/24 is down, and ACL 190 permits traffic from 192.168.134.245."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.219.30.41 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.219.30.0.0.0.255 area 0\naccess-list 190 permit ip 192.168.145.169 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.219.30.41/24 (up)", "Routing: OSPF enabled on 10.219.30.0/24 area 0", "ACL 190: permit traffic from 192.168.145.169"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.219.30.41/24 is up, and ACL 190 permits traffic from 192.168.145.169."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.145.162.93 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.145.162.0.0.0.255 area 0\naccess-list 120 deny ip 192.168.194.188 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.145.162.93/24 (up)", "Routing: OSPF enabled on 10.145.162.0/24 area 0", "ACL 120: deny traffic from 192.168.194.188"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.145.162.93/24 is up, and ACL 120 denys traffic from 192.168.194.188."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.216.96.104 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.216.96.10.0.0.255 area 0\naccess-list 117 deny ip 192.168.79.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.216.96.104/24 (up)", "Routing: OSPF enabled on 10.216.96.10/24 area 0", "ACL 117: deny traffic from 192.168.79.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.216.96.104/24 is up, and ACL 117 denys traffic from 192.168.79.196."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.237.217.55 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.237.217.0.0.0.255 area 0\naccess-list 140 deny ip 192.168.123.148 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.237.217.55/24 (up)", "Routing: OSPF enabled on 10.237.217.0/24 area 0", "ACL 140: deny traffic from 192.168.123.148"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.237.217.55/24 is up, and ACL 140 denys traffic from 192.168.123.148."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.174.100.177 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.174.100.10.0.0.255 area 0\naccess-list 110 deny ip 192.168.165.243 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.174.100.177/24 (up)", "Routing: OSPF enabled on 10.174.100.10/24 area 0", "ACL 110: deny traffic from 192.168.165.243"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.174.100.177/24 is up, and ACL 110 denys traffic from 192.168.165.243."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.187.158.45 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.187.158.0.0.0.255 area 0\naccess-list 160 permit ip 192.168.15.172 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.187.158.45/24 (down)", "Routing: OSPF enabled on 10.187.158.0/24 area 0", "ACL 160: permit traffic from 192.168.15.172"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.187.158.45/24 is down, and ACL 160 permits traffic from 192.168.15.172."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.190.166.91 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.190.166.0.0.0.255 area 0\naccess-list 147 permit ip 192.168.115.15 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.190.166.91/24 (up)", "Routing: OSPF enabled on 10.190.166.0/24 area 0", "ACL 147: permit traffic from 192.168.115.15"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.190.166.91/24 is up, and ACL 147 permits traffic from 192.168.115.15."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.168.7.225 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.168.7.20.0.0.255 area 0\naccess-list 145 deny ip 192.168.4.61 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.168.7.225/24 (down)", "Routing: OSPF enabled on 10.168.7.20/24 area 0", "ACL 145: deny traffic from 192.168.4.61"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.168.7.225/24 is down, and ACL 145 denys traffic from 192.168.4.61."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.146.219.6 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.146.2190.0.0.255 area 0\naccess-list 183 deny ip 192.168.3.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.146.219.6/24 (up)", "Routing: OSPF enabled on 10.146.2190/24 area 0", "ACL 183: deny traffic from 192.168.3.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.146.219.6/24 is up, and ACL 183 denys traffic from 192.168.3.121."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.94.93.219 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.94.93.20.0.0.255 area 0\naccess-list 187 deny ip 192.168.254.222 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.94.93.219/24 (up)", "Routing: OSPF enabled on 10.94.93.20/24 area 0", "ACL 187: deny traffic from 192.168.254.222"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.94.93.219/24 is up, and ACL 187 denys traffic from 192.168.254.222."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.191.251.87 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.191.251.0.0.0.255 area 0\naccess-list 161 permit ip 192.168.4.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.191.251.87/24 (down)", "Routing: OSPF enabled on 10.191.251.0/24 area 0", "ACL 161: permit traffic from 192.168.4.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.191.251.87/24 is down, and ACL 161 permits traffic from 192.168.4.85."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.145.175.57 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.145.175.0.0.0.255 area 0\naccess-list 126 deny ip 192.168.116.94 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.145.175.57/24 (up)", "Routing: OSPF enabled on 10.145.175.0/24 area 0", "ACL 126: deny traffic from 192.168.116.94"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.145.175.57/24 is up, and ACL 126 denys traffic from 192.168.116.94."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.114.68.54 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.114.68.0.0.0.255 area 0\naccess-list 152 permit ip 192.168.188.35 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.114.68.54/24 (up)", "Routing: OSPF enabled on 10.114.68.0/24 area 0", "ACL 152: permit traffic from 192.168.188.35"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.114.68.54/24 is up, and ACL 152 permits traffic from 192.168.188.35."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.42.179.86 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.42.179.0.0.0.255 area 0\naccess-list 143 permit ip 192.168.61.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.42.179.86/24 (up)", "Routing: OSPF enabled on 10.42.179.0/24 area 0", "ACL 143: permit traffic from 192.168.61.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.42.179.86/24 is up, and ACL 143 permits traffic from 192.168.61.92."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.163.166.39 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.163.166.0.0.0.255 area 0\naccess-list 105 deny ip 192.168.252.115 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.163.166.39/24 (up)", "Routing: OSPF enabled on 10.163.166.0/24 area 0", "ACL 105: deny traffic from 192.168.252.115"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.163.166.39/24 is up, and ACL 105 denys traffic from 192.168.252.115."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.11.53.236 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.11.53.20.0.0.255 area 0\naccess-list 158 deny ip 192.168.78.146 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.11.53.236/24 (down)", "Routing: OSPF enabled on 10.11.53.20/24 area 0", "ACL 158: deny traffic from 192.168.78.146"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.11.53.236/24 is down, and ACL 158 denys traffic from 192.168.78.146."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.14.34.18 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.14.34.0.0.0.255 area 0\naccess-list 118 deny ip 192.168.197.153 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.14.34.18/24 (down)", "Routing: OSPF enabled on 10.14.34.0/24 area 0", "ACL 118: deny traffic from 192.168.197.153"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.14.34.18/24 is down, and ACL 118 denys traffic from 192.168.197.153."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.164.107.132 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.164.107.10.0.0.255 area 0\naccess-list 101 permit ip 192.168.139.147 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.164.107.132/24 (down)", "Routing: OSPF enabled on 10.164.107.10/24 area 0", "ACL 101: permit traffic from 192.168.139.147"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.164.107.132/24 is down, and ACL 101 permits traffic from 192.168.139.147."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.159.2.99 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.159.2.0.0.0.255 area 0\naccess-list 155 deny ip 192.168.12.33 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.159.2.99/24 (down)", "Routing: OSPF enabled on 10.159.2.0/24 area 0", "ACL 155: deny traffic from 192.168.12.33"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.159.2.99/24 is down, and ACL 155 denys traffic from 192.168.12.33."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.22.150.202 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.22.150.20.0.0.255 area 0\naccess-list 143 permit ip 192.168.125.245 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.22.150.202/24 (up)", "Routing: OSPF enabled on 10.22.150.20/24 area 0", "ACL 143: permit traffic from 192.168.125.245"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.22.150.202/24 is up, and ACL 143 permits traffic from 192.168.125.245."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.215.93.224 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.215.93.20.0.0.255 area 0\naccess-list 199 deny ip 192.168.227.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.215.93.224/24 (down)", "Routing: OSPF enabled on 10.215.93.20/24 area 0", "ACL 199: deny traffic from 192.168.227.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.215.93.224/24 is down, and ACL 199 denys traffic from 192.168.227.117."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.72.249.3 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.72.2490.0.0.255 area 0\naccess-list 167 permit ip 192.168.132.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.72.249.3/24 (up)", "Routing: OSPF enabled on 10.72.2490/24 area 0", "ACL 167: permit traffic from 192.168.132.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.72.249.3/24 is up, and ACL 167 permits traffic from 192.168.132.136."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.198.72.25 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.198.72.0.0.0.255 area 0\naccess-list 198 permit ip 192.168.21.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.198.72.25/24 (down)", "Routing: OSPF enabled on 10.198.72.0/24 area 0", "ACL 198: permit traffic from 192.168.21.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.198.72.25/24 is down, and ACL 198 permits traffic from 192.168.21.75."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.182.182.43 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.182.182.0.0.0.255 area 0\naccess-list 198 deny ip 192.168.160.28 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.182.182.43/24 (up)", "Routing: OSPF enabled on 10.182.182.0/24 area 0", "ACL 198: deny traffic from 192.168.160.28"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.182.182.43/24 is up, and ACL 198 denys traffic from 192.168.160.28."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.150.17.110 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.150.17.10.0.0.255 area 0\naccess-list 112 permit ip 192.168.202.196 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.150.17.110/24 (up)", "Routing: OSPF enabled on 10.150.17.10/24 area 0", "ACL 112: permit traffic from 192.168.202.196"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.150.17.110/24 is up, and ACL 112 permits traffic from 192.168.202.196."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.160.9.114 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.160.9.10.0.0.255 area 0\naccess-list 167 deny ip 192.168.154.176 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.160.9.114/24 (up)", "Routing: OSPF enabled on 10.160.9.10/24 area 0", "ACL 167: deny traffic from 192.168.154.176"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.160.9.114/24 is up, and ACL 167 denys traffic from 192.168.154.176."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.123.198.235 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.123.198.20.0.0.255 area 0\naccess-list 190 deny ip 192.168.137.99 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.123.198.235/24 (up)", "Routing: OSPF enabled on 10.123.198.20/24 area 0", "ACL 190: deny traffic from 192.168.137.99"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.123.198.235/24 is up, and ACL 190 denys traffic from 192.168.137.99."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.224.61.173 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.224.61.10.0.0.255 area 0\naccess-list 193 deny ip 192.168.230.18 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.224.61.173/24 (down)", "Routing: OSPF enabled on 10.224.61.10/24 area 0", "ACL 193: deny traffic from 192.168.230.18"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.224.61.173/24 is down, and ACL 193 denys traffic from 192.168.230.18."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.103.220.83 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.103.220.0.0.0.255 area 0\naccess-list 111 permit ip 192.168.109.181 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.103.220.83/24 (down)", "Routing: OSPF enabled on 10.103.220.0/24 area 0", "ACL 111: permit traffic from 192.168.109.181"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.103.220.83/24 is down, and ACL 111 permits traffic from 192.168.109.181."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.175.109.61 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.175.109.0.0.0.255 area 0\naccess-list 118 deny ip 192.168.1.142 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.175.109.61/24 (up)", "Routing: OSPF enabled on 10.175.109.0/24 area 0", "ACL 118: deny traffic from 192.168.1.142"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.175.109.61/24 is up, and ACL 118 denys traffic from 192.168.1.142."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.223.102.138 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.223.102.10.0.0.255 area 0\naccess-list 161 deny ip 192.168.233.159 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.223.102.138/24 (up)", "Routing: OSPF enabled on 10.223.102.10/24 area 0", "ACL 161: deny traffic from 192.168.233.159"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.223.102.138/24 is up, and ACL 161 denys traffic from 192.168.233.159."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.103.20.225 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.103.20.20.0.0.255 area 0\naccess-list 189 permit ip 192.168.26.31 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.103.20.225/24 (up)", "Routing: OSPF enabled on 10.103.20.20/24 area 0", "ACL 189: permit traffic from 192.168.26.31"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.103.20.225/24 is up, and ACL 189 permits traffic from 192.168.26.31."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.227.151.212 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.227.151.20.0.0.255 area 0\naccess-list 195 permit ip 192.168.42.28 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.227.151.212/24 (down)", "Routing: OSPF enabled on 10.227.151.20/24 area 0", "ACL 195: permit traffic from 192.168.42.28"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.227.151.212/24 is down, and ACL 195 permits traffic from 192.168.42.28."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.229.13.53 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.229.13.0.0.0.255 area 0\naccess-list 107 deny ip 192.168.18.74 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.229.13.53/24 (up)", "Routing: OSPF enabled on 10.229.13.0/24 area 0", "ACL 107: deny traffic from 192.168.18.74"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.229.13.53/24 is up, and ACL 107 denys traffic from 192.168.18.74."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.50.81.159 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.50.81.10.0.0.255 area 0\naccess-list 140 deny ip 192.168.216.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.50.81.159/24 (up)", "Routing: OSPF enabled on 10.50.81.10/24 area 0", "ACL 140: deny traffic from 192.168.216.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.50.81.159/24 is up, and ACL 140 denys traffic from 192.168.216.154."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.232.55.196 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.232.55.10.0.0.255 area 0\naccess-list 137 deny ip 192.168.85.201 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.232.55.196/24 (down)", "Routing: OSPF enabled on 10.232.55.10/24 area 0", "ACL 137: deny traffic from 192.168.85.201"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.232.55.196/24 is down, and ACL 137 denys traffic from 192.168.85.201."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.118.90.94 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.118.90.0.0.0.255 area 0\naccess-list 191 permit ip 192.168.222.214 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.118.90.94/24 (up)", "Routing: OSPF enabled on 10.118.90.0/24 area 0", "ACL 191: permit traffic from 192.168.222.214"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.118.90.94/24 is up, and ACL 191 permits traffic from 192.168.222.214."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.200.91.41 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.200.91.0.0.0.255 area 0\naccess-list 108 deny ip 192.168.75.27 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.200.91.41/24 (up)", "Routing: OSPF enabled on 10.200.91.0/24 area 0", "ACL 108: deny traffic from 192.168.75.27"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.200.91.41/24 is up, and ACL 108 denys traffic from 192.168.75.27."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.237.175.228 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.237.175.20.0.0.255 area 0\naccess-list 145 permit ip 192.168.88.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.237.175.228/24 (up)", "Routing: OSPF enabled on 10.237.175.20/24 area 0", "ACL 145: permit traffic from 192.168.88.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.237.175.228/24 is up, and ACL 145 permits traffic from 192.168.88.92."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.102.238.36 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.102.238.0.0.0.255 area 0\naccess-list 193 deny ip 192.168.186.9 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.102.238.36/24 (down)", "Routing: OSPF enabled on 10.102.238.0/24 area 0", "ACL 193: deny traffic from 192.168.186.9"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.102.238.36/24 is down, and ACL 193 denys traffic from 192.168.186.9."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.14.59.52 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.14.59.0.0.0.255 area 0\naccess-list 165 deny ip 192.168.74.156 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.14.59.52/24 (up)", "Routing: OSPF enabled on 10.14.59.0/24 area 0", "ACL 165: deny traffic from 192.168.74.156"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.14.59.52/24 is up, and ACL 165 denys traffic from 192.168.74.156."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.160.185.33 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.160.185.0.0.0.255 area 0\naccess-list 172 permit ip 192.168.206.99 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.160.185.33/24 (down)", "Routing: OSPF enabled on 10.160.185.0/24 area 0", "ACL 172: permit traffic from 192.168.206.99"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.160.185.33/24 is down, and ACL 172 permits traffic from 192.168.206.99."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.246.195.114 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.246.195.10.0.0.255 area 0\naccess-list 146 permit ip 192.168.223.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.246.195.114/24 (down)", "Routing: OSPF enabled on 10.246.195.10/24 area 0", "ACL 146: permit traffic from 192.168.223.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.246.195.114/24 is down, and ACL 146 permits traffic from 192.168.223.69."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.150.215.186 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.150.215.10.0.0.255 area 0\naccess-list 157 deny ip 192.168.185.53 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.150.215.186/24 (down)", "Routing: OSPF enabled on 10.150.215.10/24 area 0", "ACL 157: deny traffic from 192.168.185.53"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.150.215.186/24 is down, and ACL 157 denys traffic from 192.168.185.53."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.116.50.127 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.116.50.10.0.0.255 area 0\naccess-list 108 permit ip 192.168.206.253 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.116.50.127/24 (down)", "Routing: OSPF enabled on 10.116.50.10/24 area 0", "ACL 108: permit traffic from 192.168.206.253"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.116.50.127/24 is down, and ACL 108 permits traffic from 192.168.206.253."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.232.59.229 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.232.59.20.0.0.255 area 0\naccess-list 165 permit ip 192.168.231.12 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.232.59.229/24 (up)", "Routing: OSPF enabled on 10.232.59.20/24 area 0", "ACL 165: permit traffic from 192.168.231.12"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.232.59.229/24 is up, and ACL 165 permits traffic from 192.168.231.12."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.94.213.13 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.94.213.0.0.0.255 area 0\naccess-list 119 deny ip 192.168.229.72 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.94.213.13/24 (down)", "Routing: OSPF enabled on 10.94.213.0/24 area 0", "ACL 119: deny traffic from 192.168.229.72"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.94.213.13/24 is down, and ACL 119 denys traffic from 192.168.229.72."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.73.40.125 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.73.40.10.0.0.255 area 0\naccess-list 117 permit ip 192.168.24.88 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.73.40.125/24 (down)", "Routing: OSPF enabled on 10.73.40.10/24 area 0", "ACL 117: permit traffic from 192.168.24.88"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.73.40.125/24 is down, and ACL 117 permits traffic from 192.168.24.88."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.170.98.134 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.170.98.10.0.0.255 area 0\naccess-list 146 permit ip 192.168.133.135 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.170.98.134/24 (down)", "Routing: OSPF enabled on 10.170.98.10/24 area 0", "ACL 146: permit traffic from 192.168.133.135"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.170.98.134/24 is down, and ACL 146 permits traffic from 192.168.133.135."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.72.248.104 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.72.248.10.0.0.255 area 0\naccess-list 191 permit ip 192.168.247.37 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.72.248.104/24 (up)", "Routing: OSPF enabled on 10.72.248.10/24 area 0", "ACL 191: permit traffic from 192.168.247.37"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.72.248.104/24 is up, and ACL 191 permits traffic from 192.168.247.37."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.17.122.80 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.17.122.0.0.0.255 area 0\naccess-list 175 permit ip 192.168.192.50 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.17.122.80/24 (down)", "Routing: OSPF enabled on 10.17.122.0/24 area 0", "ACL 175: permit traffic from 192.168.192.50"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.17.122.80/24 is down, and ACL 175 permits traffic from 192.168.192.50."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.150.151.242 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.150.151.20.0.0.255 area 0\naccess-list 145 deny ip 192.168.48.111 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.150.151.242/24 (up)", "Routing: OSPF enabled on 10.150.151.20/24 area 0", "ACL 145: deny traffic from 192.168.48.111"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.150.151.242/24 is up, and ACL 145 denys traffic from 192.168.48.111."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.135.26.167 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.135.26.10.0.0.255 area 0\naccess-list 165 deny ip 192.168.163.115 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.135.26.167/24 (down)", "Routing: OSPF enabled on 10.135.26.10/24 area 0", "ACL 165: deny traffic from 192.168.163.115"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.135.26.167/24 is down, and ACL 165 denys traffic from 192.168.163.115."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.227.82.170 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.227.82.10.0.0.255 area 0\naccess-list 109 deny ip 192.168.166.92 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.227.82.170/24 (down)", "Routing: OSPF enabled on 10.227.82.10/24 area 0", "ACL 109: deny traffic from 192.168.166.92"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.227.82.170/24 is down, and ACL 109 denys traffic from 192.168.166.92."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.126.23.248 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.126.23.20.0.0.255 area 0\naccess-list 183 permit ip 192.168.158.200 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.126.23.248/24 (down)", "Routing: OSPF enabled on 10.126.23.20/24 area 0", "ACL 183: permit traffic from 192.168.158.200"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.126.23.248/24 is down, and ACL 183 permits traffic from 192.168.158.200."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.73.215.83 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.73.215.0.0.0.255 area 0\naccess-list 171 deny ip 192.168.69.78 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.73.215.83/24 (up)", "Routing: OSPF enabled on 10.73.215.0/24 area 0", "ACL 171: deny traffic from 192.168.69.78"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.73.215.83/24 is up, and ACL 171 denys traffic from 192.168.69.78."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.114.191.235 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.114.191.20.0.0.255 area 0\naccess-list 123 deny ip 192.168.0.103 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.114.191.235/24 (up)", "Routing: OSPF enabled on 10.114.191.20/24 area 0", "ACL 123: deny traffic from 192.168.0.103"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.114.191.235/24 is up, and ACL 123 denys traffic from 192.168.0.103."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.191.188.180 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.191.188.10.0.0.255 area 0\naccess-list 114 deny ip 192.168.36.178 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.191.188.180/24 (down)", "Routing: OSPF enabled on 10.191.188.10/24 area 0", "ACL 114: deny traffic from 192.168.36.178"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.191.188.180/24 is down, and ACL 114 denys traffic from 192.168.36.178."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.96.90.158 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.96.90.10.0.0.255 area 0\naccess-list 124 deny ip 192.168.82.77 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.96.90.158/24 (down)", "Routing: OSPF enabled on 10.96.90.10/24 area 0", "ACL 124: deny traffic from 192.168.82.77"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.96.90.158/24 is down, and ACL 124 denys traffic from 192.168.82.77."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.160.67.190 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.160.67.10.0.0.255 area 0\naccess-list 144 permit ip 192.168.139.170 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.160.67.190/24 (down)", "Routing: OSPF enabled on 10.160.67.10/24 area 0", "ACL 144: permit traffic from 192.168.139.170"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.160.67.190/24 is down, and ACL 144 permits traffic from 192.168.139.170."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.75.117.143 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.75.117.10.0.0.255 area 0\naccess-list 159 permit ip 192.168.108.99 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.75.117.143/24 (down)", "Routing: OSPF enabled on 10.75.117.10/24 area 0", "ACL 159: permit traffic from 192.168.108.99"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.75.117.143/24 is down, and ACL 159 permits traffic from 192.168.108.99."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.59.117.7 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.59.1170.0.0.255 area 0\naccess-list 171 permit ip 192.168.150.195 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.59.117.7/24 (up)", "Routing: OSPF enabled on 10.59.1170/24 area 0", "ACL 171: permit traffic from 192.168.150.195"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.59.117.7/24 is up, and ACL 171 permits traffic from 192.168.150.195."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.105.73.27 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.105.73.0.0.0.255 area 0\naccess-list 126 deny ip 192.168.175.155 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.105.73.27/24 (down)", "Routing: OSPF enabled on 10.105.73.0/24 area 0", "ACL 126: deny traffic from 192.168.175.155"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.105.73.27/24 is down, and ACL 126 denys traffic from 192.168.175.155."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.56.164.171 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.56.164.10.0.0.255 area 0\naccess-list 133 permit ip 192.168.171.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.56.164.171/24 (up)", "Routing: OSPF enabled on 10.56.164.10/24 area 0", "ACL 133: permit traffic from 192.168.171.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.56.164.171/24 is up, and ACL 133 permits traffic from 192.168.171.56."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.95.112.121 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.95.112.10.0.0.255 area 0\naccess-list 157 permit ip 192.168.222.220 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.95.112.121/24 (down)", "Routing: OSPF enabled on 10.95.112.10/24 area 0", "ACL 157: permit traffic from 192.168.222.220"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.95.112.121/24 is down, and ACL 157 permits traffic from 192.168.222.220."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.3.239.190 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.3.239.10.0.0.255 area 0\naccess-list 180 deny ip 192.168.235.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.3.239.190/24 (up)", "Routing: OSPF enabled on 10.3.239.10/24 area 0", "ACL 180: deny traffic from 192.168.235.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.3.239.190/24 is up, and ACL 180 denys traffic from 192.168.235.234."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.249.113.121 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.249.113.10.0.0.255 area 0\naccess-list 158 permit ip 192.168.70.34 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.249.113.121/24 (up)", "Routing: OSPF enabled on 10.249.113.10/24 area 0", "ACL 158: permit traffic from 192.168.70.34"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.249.113.121/24 is up, and ACL 158 permits traffic from 192.168.70.34."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.5.246.4 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.5.2460.0.0.255 area 0\naccess-list 142 permit ip 192.168.123.252 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.5.246.4/24 (down)", "Routing: OSPF enabled on 10.5.2460/24 area 0", "ACL 142: permit traffic from 192.168.123.252"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.5.246.4/24 is down, and ACL 142 permits traffic from 192.168.123.252."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.152.126.6 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.152.1260.0.0.255 area 0\naccess-list 190 deny ip 192.168.74.28 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.152.126.6/24 (up)", "Routing: OSPF enabled on 10.152.1260/24 area 0", "ACL 190: deny traffic from 192.168.74.28"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.152.126.6/24 is up, and ACL 190 denys traffic from 192.168.74.28."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.219.203.246 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.219.203.20.0.0.255 area 0\naccess-list 199 deny ip 192.168.242.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.219.203.246/24 (down)", "Routing: OSPF enabled on 10.219.203.20/24 area 0", "ACL 199: deny traffic from 192.168.242.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.219.203.246/24 is down, and ACL 199 denys traffic from 192.168.242.10."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.215.249.52 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.215.249.0.0.0.255 area 0\naccess-list 194 permit ip 192.168.231.153 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.215.249.52/24 (down)", "Routing: OSPF enabled on 10.215.249.0/24 area 0", "ACL 194: permit traffic from 192.168.231.153"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.215.249.52/24 is down, and ACL 194 permits traffic from 192.168.231.153."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.103.43.127 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.103.43.10.0.0.255 area 0\naccess-list 155 permit ip 192.168.146.198 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.103.43.127/24 (down)", "Routing: OSPF enabled on 10.103.43.10/24 area 0", "ACL 155: permit traffic from 192.168.146.198"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.103.43.127/24 is down, and ACL 155 permits traffic from 192.168.146.198."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.87.157.209 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.87.157.20.0.0.255 area 0\naccess-list 181 permit ip 192.168.104.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.87.157.209/24 (up)", "Routing: OSPF enabled on 10.87.157.20/24 area 0", "ACL 181: permit traffic from 192.168.104.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.87.157.209/24 is up, and ACL 181 permits traffic from 192.168.104.59."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.4.140.130 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.4.140.10.0.0.255 area 0\naccess-list 176 deny ip 192.168.15.205 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.4.140.130/24 (up)", "Routing: OSPF enabled on 10.4.140.10/24 area 0", "ACL 176: deny traffic from 192.168.15.205"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.4.140.130/24 is up, and ACL 176 denys traffic from 192.168.15.205."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.193.240.30 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.193.240.0.0.0.255 area 0\naccess-list 177 deny ip 192.168.246.161 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.193.240.30/24 (down)", "Routing: OSPF enabled on 10.193.240.0/24 area 0", "ACL 177: deny traffic from 192.168.246.161"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.193.240.30/24 is down, and ACL 177 denys traffic from 192.168.246.161."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.8.227.101 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.8.227.10.0.0.255 area 0\naccess-list 100 permit ip 192.168.218.103 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.8.227.101/24 (up)", "Routing: OSPF enabled on 10.8.227.10/24 area 0", "ACL 100: permit traffic from 192.168.218.103"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.8.227.101/24 is up, and ACL 100 permits traffic from 192.168.218.103."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.254.17.135 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.254.17.10.0.0.255 area 0\naccess-list 162 permit ip 192.168.217.142 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.254.17.135/24 (up)", "Routing: OSPF enabled on 10.254.17.10/24 area 0", "ACL 162: permit traffic from 192.168.217.142"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.254.17.135/24 is up, and ACL 162 permits traffic from 192.168.217.142."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.92.80.165 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.92.80.10.0.0.255 area 0\naccess-list 166 permit ip 192.168.175.151 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.92.80.165/24 (up)", "Routing: OSPF enabled on 10.92.80.10/24 area 0", "ACL 166: permit traffic from 192.168.175.151"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.92.80.165/24 is up, and ACL 166 permits traffic from 192.168.175.151."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.112.116.44 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.112.116.0.0.0.255 area 0\naccess-list 116 deny ip 192.168.157.35 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.112.116.44/24 (down)", "Routing: OSPF enabled on 10.112.116.0/24 area 0", "ACL 116: deny traffic from 192.168.157.35"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.112.116.44/24 is down, and ACL 116 denys traffic from 192.168.157.35."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.188.40.8 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.188.400.0.0.255 area 0\naccess-list 181 permit ip 192.168.189.62 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.188.40.8/24 (up)", "Routing: OSPF enabled on 10.188.400/24 area 0", "ACL 181: permit traffic from 192.168.189.62"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.188.40.8/24 is up, and ACL 181 permits traffic from 192.168.189.62."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.74.104.254 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.74.104.20.0.0.255 area 0\naccess-list 177 deny ip 192.168.123.117 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.74.104.254/24 (up)", "Routing: OSPF enabled on 10.74.104.20/24 area 0", "ACL 177: deny traffic from 192.168.123.117"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.74.104.254/24 is up, and ACL 177 denys traffic from 192.168.123.117."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.66.145.246 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.66.145.20.0.0.255 area 0\naccess-list 114 deny ip 192.168.67.241 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.66.145.246/24 (up)", "Routing: OSPF enabled on 10.66.145.20/24 area 0", "ACL 114: deny traffic from 192.168.67.241"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.66.145.246/24 is up, and ACL 114 denys traffic from 192.168.67.241."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.72.196.5 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.72.1960.0.0.255 area 0\naccess-list 181 permit ip 192.168.158.157 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.72.196.5/24 (up)", "Routing: OSPF enabled on 10.72.1960/24 area 0", "ACL 181: permit traffic from 192.168.158.157"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.72.196.5/24 is up, and ACL 181 permits traffic from 192.168.158.157."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.200.65.76 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.200.65.0.0.0.255 area 0\naccess-list 183 deny ip 192.168.173.51 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.200.65.76/24 (down)", "Routing: OSPF enabled on 10.200.65.0/24 area 0", "ACL 183: deny traffic from 192.168.173.51"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.200.65.76/24 is down, and ACL 183 denys traffic from 192.168.173.51."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.210.161.146 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.210.161.10.0.0.255 area 0\naccess-list 122 deny ip 192.168.29.199 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.210.161.146/24 (up)", "Routing: OSPF enabled on 10.210.161.10/24 area 0", "ACL 122: deny traffic from 192.168.29.199"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.210.161.146/24 is up, and ACL 122 denys traffic from 192.168.29.199."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.237.107.2 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.237.1070.0.0.255 area 0\naccess-list 173 permit ip 192.168.84.183 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.237.107.2/24 (down)", "Routing: OSPF enabled on 10.237.1070/24 area 0", "ACL 173: permit traffic from 192.168.84.183"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.237.107.2/24 is down, and ACL 173 permits traffic from 192.168.84.183."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.134.105.86 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.134.105.0.0.0.255 area 0\naccess-list 109 deny ip 192.168.206.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.134.105.86/24 (down)", "Routing: OSPF enabled on 10.134.105.0/24 area 0", "ACL 109: deny traffic from 192.168.206.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.134.105.86/24 is down, and ACL 109 denys traffic from 192.168.206.75."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.106.186.22 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.106.186.0.0.0.255 area 0\naccess-list 194 permit ip 192.168.19.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.106.186.22/24 (down)", "Routing: OSPF enabled on 10.106.186.0/24 area 0", "ACL 194: permit traffic from 192.168.19.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.106.186.22/24 is down, and ACL 194 permits traffic from 192.168.19.20."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.213.175.221 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.213.175.20.0.0.255 area 0\naccess-list 118 permit ip 192.168.91.185 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.213.175.221/24 (up)", "Routing: OSPF enabled on 10.213.175.20/24 area 0", "ACL 118: permit traffic from 192.168.91.185"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.213.175.221/24 is up, and ACL 118 permits traffic from 192.168.91.185."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.51.159.45 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.51.159.0.0.0.255 area 0\naccess-list 188 deny ip 192.168.225.39 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.51.159.45/24 (down)", "Routing: OSPF enabled on 10.51.159.0/24 area 0", "ACL 188: deny traffic from 192.168.225.39"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.51.159.45/24 is down, and ACL 188 denys traffic from 192.168.225.39."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.149.175.68 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.149.175.0.0.0.255 area 0\naccess-list 113 permit ip 192.168.132.144 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.149.175.68/24 (down)", "Routing: OSPF enabled on 10.149.175.0/24 area 0", "ACL 113: permit traffic from 192.168.132.144"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.149.175.68/24 is down, and ACL 113 permits traffic from 192.168.132.144."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.113.108.181 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.113.108.10.0.0.255 area 0\naccess-list 124 deny ip 192.168.102.232 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.113.108.181/24 (up)", "Routing: OSPF enabled on 10.113.108.10/24 area 0", "ACL 124: deny traffic from 192.168.102.232"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.113.108.181/24 is up, and ACL 124 denys traffic from 192.168.102.232."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.207.103.38 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.207.103.0.0.0.255 area 0\naccess-list 185 permit ip 192.168.152.143 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.207.103.38/24 (down)", "Routing: OSPF enabled on 10.207.103.0/24 area 0", "ACL 185: permit traffic from 192.168.152.143"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.207.103.38/24 is down, and ACL 185 permits traffic from 192.168.152.143."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.96.149.69 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.96.149.0.0.0.255 area 0\naccess-list 128 deny ip 192.168.209.67 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.96.149.69/24 (down)", "Routing: OSPF enabled on 10.96.149.0/24 area 0", "ACL 128: deny traffic from 192.168.209.67"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.96.149.69/24 is down, and ACL 128 denys traffic from 192.168.209.67."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.131.47.54 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.131.47.0.0.0.255 area 0\naccess-list 100 permit ip 192.168.82.127 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.131.47.54/24 (up)", "Routing: OSPF enabled on 10.131.47.0/24 area 0", "ACL 100: permit traffic from 192.168.82.127"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.131.47.54/24 is up, and ACL 100 permits traffic from 192.168.82.127."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.151.91.223 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.151.91.20.0.0.255 area 0\naccess-list 165 permit ip 192.168.134.219 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.151.91.223/24 (down)", "Routing: OSPF enabled on 10.151.91.20/24 area 0", "ACL 165: permit traffic from 192.168.134.219"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.151.91.223/24 is down, and ACL 165 permits traffic from 192.168.134.219."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.213.146.98 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.213.146.0.0.0.255 area 0\naccess-list 103 permit ip 192.168.215.65 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.213.146.98/24 (down)", "Routing: OSPF enabled on 10.213.146.0/24 area 0", "ACL 103: permit traffic from 192.168.215.65"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.213.146.98/24 is down, and ACL 103 permits traffic from 192.168.215.65."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.170.180.247 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.170.180.20.0.0.255 area 0\naccess-list 119 permit ip 192.168.194.124 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.170.180.247/24 (down)", "Routing: OSPF enabled on 10.170.180.20/24 area 0", "ACL 119: permit traffic from 192.168.194.124"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.170.180.247/24 is down, and ACL 119 permits traffic from 192.168.194.124."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.229.159.68 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.229.159.0.0.0.255 area 0\naccess-list 185 deny ip 192.168.198.26 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.229.159.68/24 (down)", "Routing: OSPF enabled on 10.229.159.0/24 area 0", "ACL 185: deny traffic from 192.168.198.26"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.229.159.68/24 is down, and ACL 185 denys traffic from 192.168.198.26."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.198.251.238 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.198.251.20.0.0.255 area 0\naccess-list 172 deny ip 192.168.101.107 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.198.251.238/24 (down)", "Routing: OSPF enabled on 10.198.251.20/24 area 0", "ACL 172: deny traffic from 192.168.101.107"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.198.251.238/24 is down, and ACL 172 denys traffic from 192.168.101.107."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.74.208.32 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.74.208.0.0.0.255 area 0\naccess-list 105 permit ip 192.168.246.213 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.74.208.32/24 (up)", "Routing: OSPF enabled on 10.74.208.0/24 area 0", "ACL 105: permit traffic from 192.168.246.213"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.74.208.32/24 is up, and ACL 105 permits traffic from 192.168.246.213."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.2.98.215 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.2.98.20.0.0.255 area 0\naccess-list 164 permit ip 192.168.239.27 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.2.98.215/24 (down)", "Routing: OSPF enabled on 10.2.98.20/24 area 0", "ACL 164: permit traffic from 192.168.239.27"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.2.98.215/24 is down, and ACL 164 permits traffic from 192.168.239.27."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.181.50.199 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.181.50.10.0.0.255 area 0\naccess-list 135 permit ip 192.168.146.68 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.181.50.199/24 (up)", "Routing: OSPF enabled on 10.181.50.10/24 area 0", "ACL 135: permit traffic from 192.168.146.68"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.181.50.199/24 is up, and ACL 135 permits traffic from 192.168.146.68."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.74.60.228 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.74.60.20.0.0.255 area 0\naccess-list 105 deny ip 192.168.187.136 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.74.60.228/24 (up)", "Routing: OSPF enabled on 10.74.60.20/24 area 0", "ACL 105: deny traffic from 192.168.187.136"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.74.60.228/24 is up, and ACL 105 denys traffic from 192.168.187.136."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.172.255.8 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.172.2550.0.0.255 area 0\naccess-list 162 permit ip 192.168.233.162 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.172.255.8/24 (up)", "Routing: OSPF enabled on 10.172.2550/24 area 0", "ACL 162: permit traffic from 192.168.233.162"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.172.255.8/24 is up, and ACL 162 permits traffic from 192.168.233.162."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.133.206.218 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.133.206.20.0.0.255 area 0\naccess-list 195 deny ip 192.168.119.90 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.133.206.218/24 (up)", "Routing: OSPF enabled on 10.133.206.20/24 area 0", "ACL 195: deny traffic from 192.168.119.90"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.133.206.218/24 is up, and ACL 195 denys traffic from 192.168.119.90."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.58.92.189 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.58.92.10.0.0.255 area 0\naccess-list 171 deny ip 192.168.63.74 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.58.92.189/24 (up)", "Routing: OSPF enabled on 10.58.92.10/24 area 0", "ACL 171: deny traffic from 192.168.63.74"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.58.92.189/24 is up, and ACL 171 denys traffic from 192.168.63.74."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.202.221.173 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.202.221.10.0.0.255 area 0\naccess-list 136 deny ip 192.168.213.72 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.202.221.173/24 (up)", "Routing: OSPF enabled on 10.202.221.10/24 area 0", "ACL 136: deny traffic from 192.168.213.72"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.202.221.173/24 is up, and ACL 136 denys traffic from 192.168.213.72."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.24.108.210 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.24.108.20.0.0.255 area 0\naccess-list 129 deny ip 192.168.98.10 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.24.108.210/24 (up)", "Routing: OSPF enabled on 10.24.108.20/24 area 0", "ACL 129: deny traffic from 192.168.98.10"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.24.108.210/24 is up, and ACL 129 denys traffic from 192.168.98.10."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/2\n ip address 10.95.204.254 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.95.204.20.0.0.255 area 0\naccess-list 120 deny ip 192.168.240.8 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/2 - 10.95.204.254/24 (down)", "Routing: OSPF enabled on 10.95.204.20/24 area 0", "ACL 120: deny traffic from 192.168.240.8"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.95.204.254/24 is down, and ACL 120 denys traffic from 192.168.240.8."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.18.208.103 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.18.208.10.0.0.255 area 0\naccess-list 139 deny ip 192.168.79.86 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.18.208.103/24 (down)", "Routing: OSPF enabled on 10.18.208.10/24 area 0", "ACL 139: deny traffic from 192.168.79.86"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.18.208.103/24 is down, and ACL 139 denys traffic from 192.168.79.86."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.231.192.187 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.231.192.10.0.0.255 area 0\naccess-list 135 permit ip 192.168.173.62 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.231.192.187/24 (down)", "Routing: OSPF enabled on 10.231.192.10/24 area 0", "ACL 135: permit traffic from 192.168.173.62"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.231.192.187/24 is down, and ACL 135 permits traffic from 192.168.173.62."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.185.28.12 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.185.28.0.0.0.255 area 0\naccess-list 125 permit ip 192.168.201.111 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.185.28.12/24 (up)", "Routing: OSPF enabled on 10.185.28.0/24 area 0", "ACL 125: permit traffic from 192.168.201.111"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.185.28.12/24 is up, and ACL 125 permits traffic from 192.168.201.111."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.61.197.70 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.61.197.0.0.0.255 area 0\naccess-list 138 deny ip 192.168.179.151 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.61.197.70/24 (down)", "Routing: OSPF enabled on 10.61.197.0/24 area 0", "ACL 138: deny traffic from 192.168.179.151"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.61.197.70/24 is down, and ACL 138 denys traffic from 192.168.179.151."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.235.67.202 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.235.67.20.0.0.255 area 0\naccess-list 100 permit ip 192.168.27.217 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.235.67.202/24 (up)", "Routing: OSPF enabled on 10.235.67.20/24 area 0", "ACL 100: permit traffic from 192.168.27.217"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.235.67.202/24 is up, and ACL 100 permits traffic from 192.168.27.217."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.49.26.189 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.49.26.10.0.0.255 area 0\naccess-list 182 permit ip 192.168.40.170 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.49.26.189/24 (up)", "Routing: OSPF enabled on 10.49.26.10/24 area 0", "ACL 182: permit traffic from 192.168.40.170"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.49.26.189/24 is up, and ACL 182 permits traffic from 192.168.40.170."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.232.29.77 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.232.29.0.0.0.255 area 0\naccess-list 168 deny ip 192.168.177.221 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.232.29.77/24 (up)", "Routing: OSPF enabled on 10.232.29.0/24 area 0", "ACL 168: deny traffic from 192.168.177.221"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.232.29.77/24 is up, and ACL 168 denys traffic from 192.168.177.221."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.115.39.13 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.115.39.0.0.0.255 area 0\naccess-list 115 deny ip 192.168.78.50 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.115.39.13/24 (up)", "Routing: OSPF enabled on 10.115.39.0/24 area 0", "ACL 115: deny traffic from 192.168.78.50"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.115.39.13/24 is up, and ACL 115 denys traffic from 192.168.78.50."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.244.60.171 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.244.60.10.0.0.255 area 0\naccess-list 101 deny ip 192.168.249.112 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.244.60.171/24 (down)", "Routing: OSPF enabled on 10.244.60.10/24 area 0", "ACL 101: deny traffic from 192.168.249.112"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.244.60.171/24 is down, and ACL 101 denys traffic from 192.168.249.112."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.122.230.95 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.122.230.0.0.0.255 area 0\naccess-list 111 permit ip 192.168.78.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.122.230.95/24 (down)", "Routing: OSPF enabled on 10.122.230.0/24 area 0", "ACL 111: permit traffic from 192.168.78.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.122.230.95/24 is down, and ACL 111 permits traffic from 192.168.78.238."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.249.118.36 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.249.118.0.0.0.255 area 0\naccess-list 113 deny ip 192.168.38.254 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.249.118.36/24 (up)", "Routing: OSPF enabled on 10.249.118.0/24 area 0", "ACL 113: deny traffic from 192.168.38.254"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.249.118.36/24 is up, and ACL 113 denys traffic from 192.168.38.254."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.141.59.100 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.141.59.10.0.0.255 area 0\naccess-list 180 permit ip 192.168.3.150 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.141.59.100/24 (down)", "Routing: OSPF enabled on 10.141.59.10/24 area 0", "ACL 180: permit traffic from 192.168.3.150"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.141.59.100/24 is down, and ACL 180 permits traffic from 192.168.3.150."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.176.228.201 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.176.228.20.0.0.255 area 0\naccess-list 197 deny ip 192.168.243.93 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.176.228.201/24 (down)", "Routing: OSPF enabled on 10.176.228.20/24 area 0", "ACL 197: deny traffic from 192.168.243.93"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.176.228.201/24 is down, and ACL 197 denys traffic from 192.168.243.93."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.39.251.68 255.255.255.0\n no shutdown\nrouter ospf 5\n network 10.39.251.0.0.0.255 area 0\naccess-list 114 permit ip 192.168.141.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.39.251.68/24 (up)", "Routing: OSPF enabled on 10.39.251.0/24 area 0", "ACL 114: permit traffic from 192.168.141.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.39.251.68/24 is up, and ACL 114 permits traffic from 192.168.141.154."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.170.236.3 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.170.2360.0.0.255 area 0\naccess-list 140 permit ip 192.168.91.110 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.170.236.3/24 (down)", "Routing: OSPF enabled on 10.170.2360/24 area 0", "ACL 140: permit traffic from 192.168.91.110"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.170.236.3/24 is down, and ACL 140 permits traffic from 192.168.91.110."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.205.61.106 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.205.61.10.0.0.255 area 0\naccess-list 170 deny ip 192.168.134.0 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.205.61.106/24 (down)", "Routing: OSPF enabled on 10.205.61.10/24 area 0", "ACL 170: deny traffic from 192.168.134.0"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.205.61.106/24 is down, and ACL 170 denys traffic from 192.168.134.0."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.108.52.150 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.108.52.10.0.0.255 area 0\naccess-list 132 deny ip 192.168.159.41 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.108.52.150/24 (up)", "Routing: OSPF enabled on 10.108.52.10/24 area 0", "ACL 132: deny traffic from 192.168.159.41"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.108.52.150/24 is up, and ACL 132 denys traffic from 192.168.159.41."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.83.53.237 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.83.53.20.0.0.255 area 0\naccess-list 109 deny ip 192.168.186.62 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.83.53.237/24 (down)", "Routing: OSPF enabled on 10.83.53.20/24 area 0", "ACL 109: deny traffic from 192.168.186.62"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.83.53.237/24 is down, and ACL 109 denys traffic from 192.168.186.62."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.53.18.89 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.53.18.0.0.0.255 area 0\naccess-list 134 permit ip 192.168.82.238 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.53.18.89/24 (down)", "Routing: OSPF enabled on 10.53.18.0/24 area 0", "ACL 134: permit traffic from 192.168.82.238"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.53.18.89/24 is down, and ACL 134 permits traffic from 192.168.82.238."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.20.18.121 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.20.18.10.0.0.255 area 0\naccess-list 120 deny ip 192.168.198.79 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.20.18.121/24 (down)", "Routing: OSPF enabled on 10.20.18.10/24 area 0", "ACL 120: deny traffic from 192.168.198.79"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.20.18.121/24 is down, and ACL 120 denys traffic from 192.168.198.79."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.39.210.43 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.39.210.0.0.0.255 area 0\naccess-list 138 permit ip 192.168.46.217 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.39.210.43/24 (up)", "Routing: OSPF enabled on 10.39.210.0/24 area 0", "ACL 138: permit traffic from 192.168.46.217"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.39.210.43/24 is up, and ACL 138 permits traffic from 192.168.46.217."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.1.215.229 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.1.215.20.0.0.255 area 0\naccess-list 199 deny ip 192.168.173.63 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.1.215.229/24 (down)", "Routing: OSPF enabled on 10.1.215.20/24 area 0", "ACL 199: deny traffic from 192.168.173.63"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.1.215.229/24 is down, and ACL 199 denys traffic from 192.168.173.63."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.213.211.10 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.213.211.0.0.0.255 area 0\naccess-list 143 deny ip 192.168.233.202 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.213.211.10/24 (up)", "Routing: OSPF enabled on 10.213.211.0/24 area 0", "ACL 143: deny traffic from 192.168.233.202"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.213.211.10/24 is up, and ACL 143 denys traffic from 192.168.233.202."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.219.3.139 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.219.3.10.0.0.255 area 0\naccess-list 161 permit ip 192.168.242.171 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.219.3.139/24 (up)", "Routing: OSPF enabled on 10.219.3.10/24 area 0", "ACL 161: permit traffic from 192.168.242.171"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.219.3.139/24 is up, and ACL 161 permits traffic from 192.168.242.171."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.176.43.21 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.176.43.0.0.0.255 area 0\naccess-list 187 permit ip 192.168.149.11 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.176.43.21/24 (down)", "Routing: OSPF enabled on 10.176.43.0/24 area 0", "ACL 187: permit traffic from 192.168.149.11"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.176.43.21/24 is down, and ACL 187 permits traffic from 192.168.149.11."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.180.214.224 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.180.214.20.0.0.255 area 0\naccess-list 118 deny ip 192.168.15.118 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.180.214.224/24 (down)", "Routing: OSPF enabled on 10.180.214.20/24 area 0", "ACL 118: deny traffic from 192.168.15.118"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.180.214.224/24 is down, and ACL 118 denys traffic from 192.168.15.118."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.15.26.212 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.15.26.20.0.0.255 area 0\naccess-list 118 permit ip 192.168.137.70 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.15.26.212/24 (down)", "Routing: OSPF enabled on 10.15.26.20/24 area 0", "ACL 118: permit traffic from 192.168.137.70"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.15.26.212/24 is down, and ACL 118 permits traffic from 192.168.137.70."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.41.65.100 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.41.65.10.0.0.255 area 0\naccess-list 196 deny ip 192.168.19.42 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.41.65.100/24 (down)", "Routing: OSPF enabled on 10.41.65.10/24 area 0", "ACL 196: deny traffic from 192.168.19.42"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.41.65.100/24 is down, and ACL 196 denys traffic from 192.168.19.42."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.39.28.236 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.39.28.20.0.0.255 area 0\naccess-list 120 deny ip 192.168.236.111 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.39.28.236/24 (up)", "Routing: OSPF enabled on 10.39.28.20/24 area 0", "ACL 120: deny traffic from 192.168.236.111"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.39.28.236/24 is up, and ACL 120 denys traffic from 192.168.236.111."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.219.75.84 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.219.75.0.0.0.255 area 0\naccess-list 177 deny ip 192.168.90.102 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.219.75.84/24 (up)", "Routing: OSPF enabled on 10.219.75.0/24 area 0", "ACL 177: deny traffic from 192.168.90.102"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.219.75.84/24 is up, and ACL 177 denys traffic from 192.168.90.102."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.87.161.252 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.87.161.20.0.0.255 area 0\naccess-list 152 deny ip 192.168.221.239 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.87.161.252/24 (up)", "Routing: OSPF enabled on 10.87.161.20/24 area 0", "ACL 152: deny traffic from 192.168.221.239"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.87.161.252/24 is up, and ACL 152 denys traffic from 192.168.221.239."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.233.184.173 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.233.184.10.0.0.255 area 0\naccess-list 138 permit ip 192.168.237.181 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.233.184.173/24 (down)", "Routing: OSPF enabled on 10.233.184.10/24 area 0", "ACL 138: permit traffic from 192.168.237.181"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.233.184.173/24 is down, and ACL 138 permits traffic from 192.168.237.181."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.170.204.63 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.170.204.0.0.0.255 area 0\naccess-list 140 permit ip 192.168.226.190 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.170.204.63/24 (down)", "Routing: OSPF enabled on 10.170.204.0/24 area 0", "ACL 140: permit traffic from 192.168.226.190"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.170.204.63/24 is down, and ACL 140 permits traffic from 192.168.226.190."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.255.97.70 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.255.97.0.0.0.255 area 0\naccess-list 183 deny ip 192.168.238.7 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.255.97.70/24 (down)", "Routing: OSPF enabled on 10.255.97.0/24 area 0", "ACL 183: deny traffic from 192.168.238.7"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.255.97.70/24 is down, and ACL 183 denys traffic from 192.168.238.7."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.249.111.210 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.249.111.20.0.0.255 area 0\naccess-list 163 deny ip 192.168.87.41 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.249.111.210/24 (up)", "Routing: OSPF enabled on 10.249.111.20/24 area 0", "ACL 163: deny traffic from 192.168.87.41"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.249.111.210/24 is up, and ACL 163 denys traffic from 192.168.87.41."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.1.176.250 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.1.176.20.0.0.255 area 0\naccess-list 138 permit ip 192.168.231.75 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.1.176.250/24 (up)", "Routing: OSPF enabled on 10.1.176.20/24 area 0", "ACL 138: permit traffic from 192.168.231.75"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.1.176.250/24 is up, and ACL 138 permits traffic from 192.168.231.75."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.23.225.236 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.23.225.20.0.0.255 area 0\naccess-list 135 permit ip 192.168.105.40 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.23.225.236/24 (down)", "Routing: OSPF enabled on 10.23.225.20/24 area 0", "ACL 135: permit traffic from 192.168.105.40"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.23.225.236/24 is down, and ACL 135 permits traffic from 192.168.105.40."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.18.197.156 255.255.255.0\n shutdown\nrouter ospf 7\n network 10.18.197.10.0.0.255 area 0\naccess-list 130 deny ip 192.168.174.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.18.197.156/24 (down)", "Routing: OSPF enabled on 10.18.197.10/24 area 0", "ACL 130: deny traffic from 192.168.174.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.18.197.156/24 is down, and ACL 130 denys traffic from 192.168.174.129."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.238.126.195 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.238.126.10.0.0.255 area 0\naccess-list 115 deny ip 192.168.236.242 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.238.126.195/24 (up)", "Routing: OSPF enabled on 10.238.126.10/24 area 0", "ACL 115: deny traffic from 192.168.236.242"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.238.126.195/24 is up, and ACL 115 denys traffic from 192.168.236.242."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.72.79.97 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.72.79.0.0.0.255 area 0\naccess-list 189 deny ip 192.168.45.135 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.72.79.97/24 (down)", "Routing: OSPF enabled on 10.72.79.0/24 area 0", "ACL 189: deny traffic from 192.168.45.135"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.72.79.97/24 is down, and ACL 189 denys traffic from 192.168.45.135."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.185.196.135 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.185.196.10.0.0.255 area 0\naccess-list 160 deny ip 192.168.244.58 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.185.196.135/24 (down)", "Routing: OSPF enabled on 10.185.196.10/24 area 0", "ACL 160: deny traffic from 192.168.244.58"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.185.196.135/24 is down, and ACL 160 denys traffic from 192.168.244.58."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.207.53.33 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.207.53.0.0.0.255 area 0\naccess-list 150 permit ip 192.168.180.7 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.207.53.33/24 (down)", "Routing: OSPF enabled on 10.207.53.0/24 area 0", "ACL 150: permit traffic from 192.168.180.7"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.207.53.33/24 is down, and ACL 150 permits traffic from 192.168.180.7."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.143.44.41 255.255.255.0\n shutdown\nrouter ospf 8\n network 10.143.44.0.0.0.255 area 0\naccess-list 192 permit ip 192.168.33.227 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.143.44.41/24 (down)", "Routing: OSPF enabled on 10.143.44.0/24 area 0", "ACL 192: permit traffic from 192.168.33.227"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.143.44.41/24 is down, and ACL 192 permits traffic from 192.168.33.227."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.49.241.146 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.49.241.10.0.0.255 area 0\naccess-list 109 permit ip 192.168.247.123 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.49.241.146/24 (down)", "Routing: OSPF enabled on 10.49.241.10/24 area 0", "ACL 109: permit traffic from 192.168.247.123"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.49.241.146/24 is down, and ACL 109 permits traffic from 192.168.247.123."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.195.21.223 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.195.21.20.0.0.255 area 0\naccess-list 148 permit ip 192.168.161.129 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.195.21.223/24 (down)", "Routing: OSPF enabled on 10.195.21.20/24 area 0", "ACL 148: permit traffic from 192.168.161.129"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.195.21.223/24 is down, and ACL 148 permits traffic from 192.168.161.129."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.43.194.226 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.43.194.20.0.0.255 area 0\naccess-list 138 permit ip 192.168.248.121 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.43.194.226/24 (up)", "Routing: OSPF enabled on 10.43.194.20/24 area 0", "ACL 138: permit traffic from 192.168.248.121"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.43.194.226/24 is up, and ACL 138 permits traffic from 192.168.248.121."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.199.95.80 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.199.95.0.0.0.255 area 0\naccess-list 140 deny ip 192.168.134.113 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.199.95.80/24 (down)", "Routing: OSPF enabled on 10.199.95.0/24 area 0", "ACL 140: deny traffic from 192.168.134.113"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.199.95.80/24 is down, and ACL 140 denys traffic from 192.168.134.113."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.113.85.34 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.113.85.0.0.0.255 area 0\naccess-list 155 permit ip 192.168.11.93 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.113.85.34/24 (up)", "Routing: OSPF enabled on 10.113.85.0/24 area 0", "ACL 155: permit traffic from 192.168.11.93"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.113.85.34/24 is up, and ACL 155 permits traffic from 192.168.11.93."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.193.230.15 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.193.230.0.0.0.255 area 0\naccess-list 135 permit ip 192.168.44.156 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.193.230.15/24 (up)", "Routing: OSPF enabled on 10.193.230.0/24 area 0", "ACL 135: permit traffic from 192.168.44.156"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.193.230.15/24 is up, and ACL 135 permits traffic from 192.168.44.156."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.128.166.54 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.128.166.0.0.0.255 area 0\naccess-list 114 permit ip 192.168.151.8 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.128.166.54/24 (up)", "Routing: OSPF enabled on 10.128.166.0/24 area 0", "ACL 114: permit traffic from 192.168.151.8"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.128.166.54/24 is up, and ACL 114 permits traffic from 192.168.151.8."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.5.24.239 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.5.24.20.0.0.255 area 0\naccess-list 181 deny ip 192.168.203.163 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.5.24.239/24 (down)", "Routing: OSPF enabled on 10.5.24.20/24 area 0", "ACL 181: deny traffic from 192.168.203.163"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.5.24.239/24 is down, and ACL 181 denys traffic from 192.168.203.163."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.242.69.164 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.242.69.10.0.0.255 area 0\naccess-list 182 deny ip 192.168.10.43 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.242.69.164/24 (up)", "Routing: OSPF enabled on 10.242.69.10/24 area 0", "ACL 182: deny traffic from 192.168.10.43"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.242.69.164/24 is up, and ACL 182 denys traffic from 192.168.10.43."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.166.173.29 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.166.173.0.0.0.255 area 0\naccess-list 181 deny ip 192.168.144.93 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.166.173.29/24 (down)", "Routing: OSPF enabled on 10.166.173.0/24 area 0", "ACL 181: deny traffic from 192.168.144.93"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.166.173.29/24 is down, and ACL 181 denys traffic from 192.168.144.93."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.157.23.139 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.157.23.10.0.0.255 area 0\naccess-list 169 deny ip 192.168.182.56 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.157.23.139/24 (down)", "Routing: OSPF enabled on 10.157.23.10/24 area 0", "ACL 169: deny traffic from 192.168.182.56"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.157.23.139/24 is down, and ACL 169 denys traffic from 192.168.182.56."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/1\n ip address 10.97.89.70 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.97.89.0.0.0.255 area 0\naccess-list 147 deny ip 192.168.39.171 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/1 - 10.97.89.70/24 (up)", "Routing: OSPF enabled on 10.97.89.0/24 area 0", "ACL 147: deny traffic from 192.168.39.171"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/1 with IP 10.97.89.70/24 is up, and ACL 147 denys traffic from 192.168.39.171."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.141.68.126 255.255.255.0\n no shutdown\nrouter ospf 9\n network 10.141.68.10.0.0.255 area 0\naccess-list 144 deny ip 192.168.15.69 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.141.68.126/24 (up)", "Routing: OSPF enabled on 10.141.68.10/24 area 0", "ACL 144: deny traffic from 192.168.15.69"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.141.68.126/24 is up, and ACL 144 denys traffic from 192.168.15.69."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.244.199.96 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.244.199.0.0.0.255 area 0\naccess-list 148 permit ip 192.168.200.234 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.244.199.96/24 (up)", "Routing: OSPF enabled on 10.244.199.0/24 area 0", "ACL 148: permit traffic from 192.168.200.234"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.244.199.96/24 is up, and ACL 148 permits traffic from 192.168.200.234."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.22.70.240 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.22.70.20.0.0.255 area 0\naccess-list 149 deny ip 192.168.146.164 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.22.70.240/24 (up)", "Routing: OSPF enabled on 10.22.70.20/24 area 0", "ACL 149: deny traffic from 192.168.146.164"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.22.70.240/24 is up, and ACL 149 denys traffic from 192.168.146.164."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.78.108.129 255.255.255.0\n no shutdown\nrouter ospf 3\n network 10.78.108.10.0.0.255 area 0\naccess-list 117 permit ip 192.168.107.66 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.78.108.129/24 (up)", "Routing: OSPF enabled on 10.78.108.10/24 area 0", "ACL 117: permit traffic from 192.168.107.66"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.78.108.129/24 is up, and ACL 117 permits traffic from 192.168.107.66."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/2\n ip address 10.218.185.101 255.255.255.0\n no shutdown\nrouter ospf 10\n network 10.218.185.10.0.0.255 area 0\naccess-list 170 permit ip 192.168.35.165 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/2 - 10.218.185.101/24 (up)", "Routing: OSPF enabled on 10.218.185.10/24 area 0", "ACL 170: permit traffic from 192.168.35.165"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/2 with IP 10.218.185.101/24 is up, and ACL 170 permits traffic from 192.168.35.165."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.173.228.40 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.173.228.0.0.0.255 area 0\naccess-list 152 deny ip 192.168.72.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.173.228.40/24 (down)", "Routing: OSPF enabled on 10.173.228.0/24 area 0", "ACL 152: deny traffic from 192.168.72.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.173.228.40/24 is down, and ACL 152 denys traffic from 192.168.72.49."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.186.230.117 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.186.230.10.0.0.255 area 0\naccess-list 157 permit ip 192.168.107.23 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.186.230.117/24 (down)", "Routing: OSPF enabled on 10.186.230.10/24 area 0", "ACL 157: permit traffic from 192.168.107.23"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.186.230.117/24 is down, and ACL 157 permits traffic from 192.168.107.23."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.27.182.60 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.27.182.0.0.0.255 area 0\naccess-list 181 permit ip 192.168.92.120 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.27.182.60/24 (up)", "Routing: OSPF enabled on 10.27.182.0/24 area 0", "ACL 181: permit traffic from 192.168.92.120"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.27.182.60/24 is up, and ACL 181 permits traffic from 192.168.92.120."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.181.189.2 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.181.1890.0.0.255 area 0\naccess-list 154 deny ip 192.168.12.154 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.181.189.2/24 (down)", "Routing: OSPF enabled on 10.181.1890/24 area 0", "ACL 154: deny traffic from 192.168.12.154"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.181.189.2/24 is down, and ACL 154 denys traffic from 192.168.12.154."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.227.224.165 255.255.255.0\n no shutdown\nrouter ospf 8\n network 10.227.224.10.0.0.255 area 0\naccess-list 153 deny ip 192.168.62.49 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.227.224.165/24 (up)", "Routing: OSPF enabled on 10.227.224.10/24 area 0", "ACL 153: deny traffic from 192.168.62.49"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.227.224.165/24 is up, and ACL 153 denys traffic from 192.168.62.49."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/3\n ip address 10.189.162.79 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.189.162.0.0.0.255 area 0\naccess-list 155 permit ip 192.168.49.32 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/3 - 10.189.162.79/24 (down)", "Routing: OSPF enabled on 10.189.162.0/24 area 0", "ACL 155: permit traffic from 192.168.49.32"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.189.162.79/24 is down, and ACL 155 permits traffic from 192.168.49.32."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.82.184.239 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.82.184.20.0.0.255 area 0\naccess-list 109 deny ip 192.168.233.97 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.82.184.239/24 (down)", "Routing: OSPF enabled on 10.82.184.20/24 area 0", "ACL 109: deny traffic from 192.168.233.97"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.82.184.239/24 is down, and ACL 109 denys traffic from 192.168.233.97."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/3\n ip address 10.224.221.88 255.255.255.0\n shutdown\nrouter ospf 1\n network 10.224.221.0.0.0.255 area 0\naccess-list 170 permit ip 192.168.139.114 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/3 - 10.224.221.88/24 (down)", "Routing: OSPF enabled on 10.224.221.0/24 area 0", "ACL 170: permit traffic from 192.168.139.114"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/3 with IP 10.224.221.88/24 is down, and ACL 170 permits traffic from 192.168.139.114."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.86.22.115 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.86.22.10.0.0.255 area 0\naccess-list 102 permit ip 192.168.226.153 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.86.22.115/24 (down)", "Routing: OSPF enabled on 10.86.22.10/24 area 0", "ACL 102: permit traffic from 192.168.226.153"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.86.22.115/24 is down, and ACL 102 permits traffic from 192.168.226.153."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/1\n ip address 10.141.41.2 255.255.255.0\n no shutdown\nrouter ospf 4\n network 10.141.410.0.0.255 area 0\naccess-list 150 deny ip 192.168.222.213 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/1 - 10.141.41.2/24 (up)", "Routing: OSPF enabled on 10.141.410/24 area 0", "ACL 150: deny traffic from 192.168.222.213"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.141.41.2/24 is up, and ACL 150 denys traffic from 192.168.222.213."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/3\n ip address 10.227.94.251 255.255.255.0\n no shutdown\nrouter ospf 2\n network 10.227.94.20.0.0.255 area 0\naccess-list 154 permit ip 192.168.227.26 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/3 - 10.227.94.251/24 (up)", "Routing: OSPF enabled on 10.227.94.20/24 area 0", "ACL 154: permit traffic from 192.168.227.26"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/3 with IP 10.227.94.251/24 is up, and ACL 154 permits traffic from 192.168.227.26."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/3\n ip address 10.113.89.158 255.255.255.0\n shutdown\nrouter ospf 9\n network 10.113.89.10.0.0.255 area 0\naccess-list 110 permit ip 192.168.32.197 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/3 - 10.113.89.158/24 (down)", "Routing: OSPF enabled on 10.113.89.10/24 area 0", "ACL 110: permit traffic from 192.168.32.197"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/3 with IP 10.113.89.158/24 is down, and ACL 110 permits traffic from 192.168.32.197."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname EDGE-FW1\ninterface GigabitEthernet0/0\n ip address 10.128.160.84 255.255.255.0\n shutdown\nrouter ospf 6\n network 10.128.160.0.0.0.255 area 0\naccess-list 152 permit ip 192.168.133.251 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: EDGE-FW1", "Interface: GigabitEthernet0/0 - 10.128.160.84/24 (down)", "Routing: OSPF enabled on 10.128.160.0/24 area 0", "ACL 152: permit traffic from 192.168.133.251"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device EDGE-FW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.128.160.84/24 is down, and ACL 152 permits traffic from 192.168.133.251."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.150.9.187 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.150.9.10.0.0.255 area 0\naccess-list 199 deny ip 192.168.106.112 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.150.9.187/24 (down)", "Routing: OSPF enabled on 10.150.9.10/24 area 0", "ACL 199: deny traffic from 192.168.106.112"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.150.9.187/24 is down, and ACL 199 denys traffic from 192.168.106.112."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/0\n ip address 10.68.92.30 255.255.255.0\n no shutdown\nrouter ospf 6\n network 10.68.92.0.0.0.255 area 0\naccess-list 194 permit ip 192.168.176.133 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/0 - 10.68.92.30/24 (up)", "Routing: OSPF enabled on 10.68.92.0/24 area 0", "ACL 194: permit traffic from 192.168.176.133"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/0 with IP 10.68.92.30/24 is up, and ACL 194 permits traffic from 192.168.176.133."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.58.17.162 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.58.17.10.0.0.255 area 0\naccess-list 101 permit ip 192.168.212.59 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.58.17.162/24 (down)", "Routing: OSPF enabled on 10.58.17.10/24 area 0", "ACL 101: permit traffic from 192.168.212.59"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.58.17.162/24 is down, and ACL 101 permits traffic from 192.168.212.59."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/2\n ip address 10.147.236.191 255.255.255.0\n no shutdown\nrouter ospf 7\n network 10.147.236.10.0.0.255 area 0\naccess-list 151 permit ip 192.168.233.182 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/2 - 10.147.236.191/24 (up)", "Routing: OSPF enabled on 10.147.236.10/24 area 0", "ACL 151: permit traffic from 192.168.233.182"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/2 with IP 10.147.236.191/24 is up, and ACL 151 permits traffic from 192.168.233.182."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/1\n ip address 10.231.17.53 255.255.255.0\n shutdown\nrouter ospf 3\n network 10.231.17.0.0.0.255 area 0\naccess-list 109 permit ip 192.168.43.201 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/1 - 10.231.17.53/24 (down)", "Routing: OSPF enabled on 10.231.17.0/24 area 0", "ACL 109: permit traffic from 192.168.43.201"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/1 with IP 10.231.17.53/24 is down, and ACL 109 permits traffic from 192.168.43.201."}]}
+{"instruction": "Extract hostname and all active interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/0\n ip address 10.101.176.131 255.255.255.0\n no shutdown\nrouter ospf 1\n network 10.101.176.10.0.0.255 area 0\naccess-list 164 deny ip 192.168.31.128 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/0 - 10.101.176.131/24 (up)", "Routing: OSPF enabled on 10.101.176.10/24 area 0", "ACL 164: deny traffic from 192.168.31.128"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/0 with IP 10.101.176.131/24 is up, and ACL 164 denys traffic from 192.168.31.128."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/1\n ip address 10.10.245.48 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.10.245.0.0.0.255 area 0\naccess-list 123 deny ip 192.168.164.38 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/1 - 10.10.245.48/24 (down)", "Routing: OSPF enabled on 10.10.245.0/24 area 0", "ACL 123: deny traffic from 192.168.164.38"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/1 with IP 10.10.245.48/24 is down, and ACL 123 denys traffic from 192.168.164.38."}]}
+{"instruction": "List ACLs and their rules.", "config_raw": "hostname BRANCH-RTR1\ninterface GigabitEthernet0/0\n ip address 10.236.121.141 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.236.121.10.0.0.255 area 0\naccess-list 160 permit ip 192.168.174.20 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: BRANCH-RTR1", "Interface: GigabitEthernet0/0 - 10.236.121.141/24 (down)", "Routing: OSPF enabled on 10.236.121.10/24 area 0", "ACL 160: permit traffic from 192.168.174.20"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device BRANCH-RTR1 runs OSPF, interface GigabitEthernet0/0 with IP 10.236.121.141/24 is down, and ACL 160 permits traffic from 192.168.174.20."}]}
+{"instruction": "Summarize OSPF configuration.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/0\n ip address 10.89.131.144 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.89.131.10.0.0.255 area 0\naccess-list 106 deny ip 192.168.204.143 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/0 - 10.89.131.144/24 (down)", "Routing: OSPF enabled on 10.89.131.10/24 area 0", "ACL 106: deny traffic from 192.168.204.143"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/0 with IP 10.89.131.144/24 is down, and ACL 106 denys traffic from 192.168.204.143."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname CORE-R1\ninterface GigabitEthernet0/3\n ip address 10.156.9.107 255.255.255.0\n shutdown\nrouter ospf 2\n network 10.156.9.10.0.0.255 area 0\naccess-list 142 deny ip 192.168.19.85 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: CORE-R1", "Interface: GigabitEthernet0/3 - 10.156.9.107/24 (down)", "Routing: OSPF enabled on 10.156.9.10/24 area 0", "ACL 142: deny traffic from 192.168.19.85"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device CORE-R1 runs OSPF, interface GigabitEthernet0/3 with IP 10.156.9.107/24 is down, and ACL 142 denys traffic from 192.168.19.85."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname ACCESS-SW2\ninterface GigabitEthernet0/2\n ip address 10.231.175.74 255.255.255.0\n shutdown\nrouter ospf 5\n network 10.231.175.0.0.0.255 area 0\naccess-list 149 deny ip 192.168.51.212 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: ACCESS-SW2", "Interface: GigabitEthernet0/2 - 10.231.175.74/24 (down)", "Routing: OSPF enabled on 10.231.175.0/24 area 0", "ACL 149: deny traffic from 192.168.51.212"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device ACCESS-SW2 runs OSPF, interface GigabitEthernet0/2 with IP 10.231.175.74/24 is down, and ACL 149 denys traffic from 192.168.51.212."}]}
+{"instruction": "Detect misconfigurations or disabled interfaces.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/2\n ip address 10.214.68.173 255.255.255.0\n shutdown\nrouter ospf 10\n network 10.214.68.10.0.0.255 area 0\naccess-list 117 permit ip 192.168.245.204 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/2 - 10.214.68.173/24 (down)", "Routing: OSPF enabled on 10.214.68.10/24 area 0", "ACL 117: permit traffic from 192.168.245.204"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/2 with IP 10.214.68.173/24 is down, and ACL 117 permits traffic from 192.168.245.204."}]}
+{"instruction": "Generate network summary in structured form.", "config_raw": "hostname DIST-SW1\ninterface GigabitEthernet0/1\n ip address 10.227.202.140 255.255.255.0\n shutdown\nrouter ospf 4\n network 10.227.202.10.0.0.255 area 0\naccess-list 125 permit ip 192.168.39.62 0.0.0.255 any\n", "wazuh_alert": {}, "gold_actions": [{"commands": ["Extracted hostname: DIST-SW1", "Interface: GigabitEthernet0/1 - 10.227.202.140/24 (down)", "Routing: OSPF enabled on 10.227.202.10/24 area 0", "ACL 125: permit traffic from 192.168.39.62"], "verify": ["show ip interface brief", "show ip ospf neighbor", "show access-lists"], "rollback": [], "explain": "The device DIST-SW1 runs OSPF, interface GigabitEthernet0/1 with IP 10.227.202.140/24 is down, and ACL 125 permits traffic from 192.168.39.62."}]}