diff --git "a/datasets/switch2_dataset_900.jsonl" "b/datasets/switch2_dataset_900.jsonl"
new file mode 100644--- /dev/null
+++ "b/datasets/switch2_dataset_900.jsonl"
@@ -0,0 +1,900 @@
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 99, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 20, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 20, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 20, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 50, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 20, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 99, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 20, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 20, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 50, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 20, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 50, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/7", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "local_native_vlan": 20, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/5", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 20, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "local_native_vlan": 10, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 99, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 20, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/12", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/20", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/6", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_native_vlan": 30, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 20, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_native_vlan": 10, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/3", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 50, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_native_vlan": 30, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "local_vlan": 10, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 10"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 40, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "local_native_vlan": 99, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/15", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "local_native_vlan": 20, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 30, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/23", "switchport trunk native vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 30, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/18", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "local_vlan": 10, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/18", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 99, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/9", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/21", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_native_vlan": 99, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/17", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 40, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 99, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 10, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "local_vlan": 40, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_vlan": 30, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 30"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "local_vlan": 20, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/5", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/16", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/3", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/24", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 99, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 99"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 50, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 50, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/4", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/19", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/16", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/4", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/22", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/4", "switchport access vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/18", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "local_native_vlan": 10, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 50, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/10", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "local_vlan": 30, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/20", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_vlan": 40, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_native_vlan": 30, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 50, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_vlan": 30, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/11", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/14", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/20", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/11", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/12", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/15", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 30, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "local_vlan": 40, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/19", "switchport access vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "local_native_vlan": 20, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 40, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "local_vlan": 20, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/24", "switchport access vlan 20"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/15", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 99, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/8", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "local_native_vlan": 10, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/3", "switchport trunk native vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 10, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/17", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_native_vlan": 40, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport trunk native vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/13", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "local_vlan": 99, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/7", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "local_vlan": 30, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/13", "switchport access vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 40, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 40"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/23", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "local_native_vlan": 40, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 40"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "local_vlan": 50, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "local_vlan": 99, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/8", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "local_native_vlan": 10, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/16", "switchport trunk native vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/1", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "local_vlan": 10, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/23", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/21", "switchport access vlan 10"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_vlan": 50, "remote_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/14", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "local_vlan": 99, "remote_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/2", "switchport access vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "local_vlan": 30, "remote_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 30"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "local_native_vlan": 50, "remote_native_vlan": 30}], "cli_fix": ["interface GigabitEthernet0/14", "switchport trunk native vlan 50"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "local_native_vlan": 40, "remote_native_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/1", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "local_native_vlan": 99, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/6", "switchport trunk native vlan 99"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "local_vlan": 20, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/22", "switchport access vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 40, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 40"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "local_native_vlan": 20, "remote_native_vlan": 20}], "cli_fix": ["interface GigabitEthernet0/7", "switchport trunk native vlan 20"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "local_native_vlan": 50, "remote_native_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/10", "switchport trunk native vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "local_vlan": 10, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/12", "switchport access vlan 10"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/10", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "local_native_vlan": 30, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/24", "switchport trunk native vlan 30"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/17", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "local_vlan": 20, "remote_vlan": 10}], "cli_fix": ["interface GigabitEthernet0/9", "switchport access vlan 20"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "local_vlan": 50, "remote_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/6", "switchport access vlan 50"]}
+{"incident_type": "vlan_mismatch", "instruction": "Analyze VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "VLAN mismatch detected", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "local_vlan": 50, "remote_vlan": 50}], "cli_fix": ["interface GigabitEthernet0/1", "switchport access vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "mode": "dynamic auto"}], "cli_fix": ["interface GigabitEthernet0/13", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/2", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "local_native_vlan": 50, "remote_native_vlan": 99}], "cli_fix": ["interface GigabitEthernet0/21", "switchport trunk native vlan 50"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "mode": "access"}], "cli_fix": ["interface GigabitEthernet0/5", "switchport mode trunk", "switchport nonegotiate"]}
+{"incident_type": "native_vlan_mismatch", "instruction": "Analyze native VLAN mismatch incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Native VLAN mismatch detected", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "local_native_vlan": 99, "remote_native_vlan": 40}], "cli_fix": ["interface GigabitEthernet0/11", "switchport trunk native vlan 99"]}
+{"incident_type": "trunk_negotiation_issue", "instruction": "Analyze trunk negotiation issues and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Trunk negotiation failure", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "mode": "dynamic desirable"}], "cli_fix": ["interface GigabitEthernet0/8", "switchport mode trunk", "switchport nonegotiate"]}